Update vectorim/element-web Docker tag to v1.11.93

manifests/_apps/base64.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: base64
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/base64
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/blog.yaml

@@ -22,5 +22,8 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/cel-tester.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: cel-tester
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/cel-tester
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/certmanager_chart.yaml

@@ -1,3 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager-civo
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: cert-manager
+    name: civo
+  source:
+    path: manifests/certmanager-civo
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---
+
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -35,7 +59,7 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://charts.jetstack.io'
-    targetRevision: v1.21.3
+    targetRevision: 1.11.0
     chart: cert-manager
     helm:
       version: v3

manifests/_apps/civo-versions.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: civo-versions
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/civo-versions
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/cv.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: cv
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/cv
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/dashboard.yaml

@@ -26,5 +26,4 @@ spec:
     kind: Deployment
     jqPathExpressions:
     - .spec.template.spec.containers[]?.image
-
 ---

manifests/_apps/devstats-viewer.yaml

@@ -22,5 +22,8 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/feed-fetcher.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: feed-fetcher
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/feed-fetcher
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/goldilocks.yaml

@@ -1,35 +0,0 @@
-
-# apiVersion: argoproj.io/v1alpha1
-# kind: Application
-# metadata:
-#   name: cluster-fun-goldilocks
-#   namespace: argocd
-#   finalizers:
-#   - resources-finalizer.argocd.argoproj.io
-# spec:
-#   project: cluster.fun
-#   destination:
-#     namespace: goldilocks
-#     name: cluster-fun (v2)
-#   source:
-#     repoURL: 'https://charts.fairwinds.com/stable'
-#     targetRevision: 10.1.0
-#     chart: goldilocks
-#     helm:
-#       version: v3
-#       values: |-
-#         vpa:
-#           enabled: true
-#         controller:
-#           flags:
-#             on-by-default: true
-#         dashboard:
-#           flags:
-#             on-by-default: true
-#           replicaCount: 1
-#   syncPolicy:
-#     automated: {}
-#     syncOptions:
-#       - CreateNamespace=true
-
-# ---

manifests/_apps/goplayground.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: goplayground
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/goplayground
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/grist.yaml

@@ -22,4 +22,8 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/link.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: link
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/link
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"

manifests/_apps/marcusnoble.yaml

@@ -22,5 +22,8 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/mastodon-digest.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cluster-fun-homelab-accessible-check
+  name: cluster-fun-mastodon-digest
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: homelab-accessible-check
+    namespace: mastodon-digest
     name: cluster-fun (v2)
   source:
-    path: manifests/homelab-accessible-check
+    path: manifests/mastodon-digest
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,5 +22,8 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/matrix_chart.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: yay-or-nay
+  name: cluster-fun-matrix
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: yay-or-nay
+    namespace: chat
     name: cluster-fun (v2)
   source:
-    path: manifests/yay-or-nay
+    path: manifests/matrix_chart
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:

manifests/_apps/mazanoke.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: mazanoke
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: mazanoke
-    name: cluster-fun (v2)
-  source:
-    path: manifests/mazanoke
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-

manifests/_apps/mealie.yaml

@@ -22,4 +22,8 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/monitoring-civo.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: airtrail
+  name: monitoring-civo
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: airtrail
-    name: cluster-fun (v2)
+    namespace: monitoring
+    name: civo
   source:
-    path: manifests/airtrail
+    path: manifests/monitoring-civo
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,4 +22,3 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-

manifests/_apps/opengraph-image-gen.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: opengraph
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/opengraph
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/pairdrop.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: pairdrop
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: pairdrop
-    name: cluster-fun (v2)
-  source:
-    path: manifests/pairdrop
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-

manifests/_apps/planning-poker.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: planning-poker
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: planning-poker
-    name: cluster-fun (v2)
-  source:
-    path: manifests/planning-poker
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-

manifests/_apps/proxy-civo.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: vert
+  name: proxy-civo
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: vert
-    name: cluster-fun (v2)
+    namespace: proxy-civo
+    name: civo
   source:
-    path: manifests/vert
+    path: manifests/proxy-civo
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,4 +22,3 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-

manifests/_apps/qr.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: qr
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/qr
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/reloader.yaml

@@ -12,7 +12,30 @@ spec:
     name: cluster-fun (v2)
   source:
     repoURL: 'https://stakater.github.io/stakater-charts'
-    targetRevision: v0.0.129
+    targetRevision: v0.0.89
+    chart: reloader
+  syncPolicy:
+    automated: {}
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-reloader-civo
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: kube-system
+    name: civo
+  source:
+    repoURL: 'https://stakater.github.io/stakater-charts'
+    targetRevision: v0.0.89
     chart: reloader
   syncPolicy:
     automated: {}

manifests/_apps/rss.yaml

@@ -22,4 +22,8 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/social-to-grist.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: social-to-grist
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: social-to-grist
+    name: civo
+  source:
+    path: manifests/social-to-grist
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/social-to-rolodex.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: social-to-rolodex
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: social-to-rolodex
-    name: cluster-fun (v2)
-  source:
-    path: manifests/social-to-rolodex
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-

manifests/_apps/sre-agent.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: sre-agent
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: cluster.fun
-  destination:
-    namespace: default
-    name: cluster-fun (v2)
-  source:
-    path: manifests/sre-agent
-    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
-    targetRevision: HEAD
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-  - kind: Secret
-    jsonPointers:
-    - /data
-

manifests/_apps/starling.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cluster-fun-priority-classes
+  name: cluster-fun-starling
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: kube-system
+    namespace: starling
     name: cluster-fun (v2)
   source:
-    path: manifests/priority-classes
+    path: manifests/starling
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,4 +22,8 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
 ---

manifests/_apps/svg-to-dxf.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: svg-to-dxf
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/svg-to-dxf
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/talks.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: talks
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/talks
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/tank.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: cors-proxy
+  name: cluster-fun-tank
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: cors-proxy
+    namespace: tank
     name: cluster-fun (v2)
   source:
-    path: manifests/cors-proxy
+    path: manifests/tank
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:

manifests/_apps/text-to-dxf.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: text-to-dxf
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/text-to-dxf
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/til.yaml

@@ -9,7 +9,7 @@ spec:
   project: cluster.fun
   destination:
     namespace: til
-    name: cluster-fun (v2)
+    name: civo
   source:
     path: manifests/til
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
@@ -22,4 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/traefik.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: trek
+  name: traefik-civo
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: trek
-    name: cluster-fun (v2)
+    namespace: kube-system
+    name: civo
   source:
-    path: manifests/trek
+    path: manifests/traefik
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,4 +22,3 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
-

manifests/_apps/tweetsvg.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: bsky-screenshot
+  name: tweetsvg
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: bsky-screenshot
-    name: cluster-fun (v2)
+    namespace: tweetsvg
+    name: civo
   source:
-    path: manifests/bsky-screenshot
+    path: manifests/tweetsvg
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:
@@ -22,3 +22,7 @@ spec:
   - kind: Secret
     jsonPointers:
     - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image

manifests/_apps/twitter-profile-pic.yaml

@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-fun-twitter-profile-pic
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: twitter-profile-pic
+    name: cluster-fun (v2)
+  source:
+    path: manifests/twitter-profile-pic
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+  - group: apps
+    kind: Deployment
+    jqPathExpressions:
+    - .spec.template.spec.containers[]?.image
+---

manifests/_apps/wallabag.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: url-to-grist
+  name: cluster-fun-wallabag
   namespace: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
 spec:
   project: cluster.fun
   destination:
-    namespace: cloudnative-now
+    namespace: wallabag
     name: cluster-fun (v2)
   source:
-    path: manifests/url-to-grist
+    path: manifests/wallabag
     repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
     targetRevision: HEAD
   syncPolicy:

manifests/airtrail/airtrail.yaml

@@ -1,145 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    kube-1password: 2322tcm3p5v6ql7oy2efrn4jse
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    reloader.stakater.com/match: "true"
-data:
-  ORIGIN: https://airtrail.cluster.fun
-  UPLOAD_LOCATION: /app/uploads
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: airtrail
-  template:
-    metadata:
-      labels:
-        app: airtrail
-        app.kubernetes.io/name: airtrail
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      containers:
-      - name: airtrail
-        image: johly/airtrail:v3.13.1@sha256:800466d42393a0a9f360a93d98ab8da524381b19f3c06cd4552c27106d982e3d
-        imagePullPolicy: IfNotPresent
-        envFrom:
-        - configMapRef:
-            name: airtrail
-        - secretRef:
-            name: airtrail
-        ports:
-        - containerPort: 3000
-          name: web
-        volumeMounts:
-          - mountPath: /app/uploads
-            name: uploads
-        livenessProbe:
-          httpGet:
-            path: /api/ping
-            port: 3000
-          initialDelaySeconds: 5
-          periodSeconds: 30
-        readinessProbe:
-          httpGet:
-            path: /api/ping
-            port: 3000
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        resources:
-          requests:
-            cpu: 100m
-            memory: 150Mi
-          limits:
-            cpu: 200m
-            memory: 300Mi
-      volumes:
-      - name: uploads
-        persistentVolumeClaim:
-          claimName: airtrail-uploads
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-    name: web
-  selector:
-    app: airtrail
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: airtrail
-  namespace: airtrail
-  labels:
-    app: airtrail
-    app.kubernetes.io/name: airtrail
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
-    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
-    nginx.ingress.kubernetes.io/proxy-next-upstream: "300"
-    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - airtrail.cluster.fun
-    secretName: airtrail-ingress
-  rules:
-  - host: airtrail.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: airtrail
-            port:
-              name: web

manifests/airtrail/pvs.yaml

@@ -1,13 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: airtrail-uploads
-  namespace: airtrail
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: sbs-default-retain
----

manifests/auth-proxy/auth-ingress.yaml

@@ -23,13 +23,10 @@ spec:
     - sonarr.cluster.fun
     - lidarr.cluster.fun
     - prowlarr.cluster.fun
-    - mylarr.cluster.fun
     - transmission.cluster.fun
     - tekton.cluster.fun
     - changedetection.cluster.fun
     - grafana.cluster.fun
-    - podgrab.cluster.fun
-    - stablediffusion.cluster.fun
     secretName: auth-proxy-ingress
   rules:
   - host: downloads.cluster.fun
@@ -202,33 +199,3 @@ spec:
             name: tailscale-proxy
             port:
               name: auth
-  - host: podgrab.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: tailscale-proxy
-            port:
-              name: auth
-  - host: mylarr.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: tailscale-proxy
-            port:
-              name: auth
-  - host: stablediffusion.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: tailscale-proxy
-            port:
-              name: auth

manifests/auth-proxy/non-auth-ingress.yaml

@@ -6,10 +6,6 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-body-size: 25m
-    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
 spec:
   ingressClassName: nginx
   tls:
@@ -17,8 +13,6 @@ spec:
     - hello-world.cluster.fun
     - ombi.cluster.fun
     - bsky-feeds.cluster.fun
-    - ai.cluster.fun
-    - hermes-hooks.cluster.fun
     secretName: non-auth-proxy-ingress
   rules:
   - host: hello-world.cluster.fun
@@ -51,23 +45,3 @@ spec:
             name: tailscale-proxy
             port:
               name: non-auth
-  - host: ai.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: tailscale-proxy
-            port:
-              name: non-auth
-  - host: hermes-hooks.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: tailscale-proxy
-            port:
-              name: non-auth

manifests/auth-proxy/proxy.yaml

@@ -38,7 +38,6 @@ spec:
       labels:
         app: internal-proxy
     spec:
-      priorityClassName: critical
       serviceAccountName: default
       dnsPolicy: ClusterFirst
       dnsConfig:
@@ -46,7 +45,7 @@ spec:
           - 100.100.100.100
       containers:
       - name: proxy
-        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest@sha256:2a401eec859bf665e75bbb737b3b1709cd1fa74576e4ba8c7daeb63d8b3e8d51
+        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest
         imagePullPolicy: Always
         env:
         - name: PROXY_DESTINATION
@@ -68,7 +67,7 @@ spec:
           mountPath: /config/
 
       - name: oauth-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1
         args:
         - --cookie-secure=false
         - --provider=oidc
@@ -102,9 +101,9 @@ spec:
           protocol: TCP
         resources:
           limits:
-            memory: 80Mi
+            memory: 50Mi
           requests:
-            memory: 80Mi
+            memory: 50Mi
       volumes:
       - name: host-mappings
         configMap:

manifests/base64/base64.yaml

@@ -29,10 +29,9 @@ spec:
     spec:
       imagePullSecrets:
         - name: docker-config
-      priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/base64:latest@sha256:1ec2b770a5ffe986bdfbf24094ed945191bd7b9dd27a7b3212af92a3dfcea032
+        image: rg.fr-par.scw.cloud/averagemarcus/base64:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 80
@@ -50,10 +49,11 @@ metadata:
   namespace: base64
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - base64.cluster.fun

manifests/blackhole/blackhole.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: black-hole
-        image: averagemarcus/black-hole:latest@sha256:1e9cb8396f67aeb25a9eaaf14b369a53a7b300ae465859f10d9f0f88ef3023e1
+        image: averagemarcus/black-hole:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 9090

manifests/blog/blog.yaml

@@ -27,18 +27,9 @@ spec:
       labels:
         app: blog
     spec:
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app: blog
-                topologyKey: kubernetes.io/hostname
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/blog:latest@sha256:d40aa67a51924a89ad0ac6f7387a63f2f41e9bff7b5e4c6f7675cd43354b0c28
+        image: rg.fr-par.scw.cloud/averagemarcus/blog:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8000

manifests/bsky-screenshot/bsky-screenshot.yaml

@@ -1,69 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: bsky-screenshot
-  namespace: bsky-screenshot
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-    name: web
-  selector:
-    app: bsky-screenshot
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bsky-screenshot
-  namespace: bsky-screenshot
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: bsky-screenshot
-  template:
-    metadata:
-      labels:
-        app: bsky-screenshot
-    spec:
-      containers:
-      - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/bsky-screenshot:latest@sha256:0fae863fc3123f73aa6268a125d5bf2c2122c8a3f2aedaf129462e668e56ab23
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 80
-          name: web
-        resources:
-          limits:
-            memory: 105Mi
-          requests:
-            memory: 105Mi
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: bsky-screenshot
-  namespace: bsky-screenshot
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - bsky-screenshot.cluster.fun
-    secretName: bsky-screenshot-ingress
-  rules:
-  - host: bsky-screenshot.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: bsky-screenshot
-            port:
-              number: 80
-

manifests/cel-tester/cel-tester.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/cel-tester:latest@sha256:caf9044a19fa0e14f92232f68c1fe808249580d33619ea3706ff935bd2853559
+        image: rg.fr-par.scw.cloud/averagemarcus/cel-tester:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 80
@@ -47,10 +47,11 @@ metadata:
   namespace: cel-tester
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - cel-tester.cluster.fun

manifests/certmanager-civo/certmanager_chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    certmanager.k8s.io/disable-validation: "true"
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: letsencrypt@marcusnoble.co.uk
+    privateKeySecretRef:
+      name: letsencrypt
+    solvers:
+    - http01:
+        ingress:
+          class: traefik

manifests/civo-versions/civo-versions.yaml

@@ -38,10 +38,9 @@ spec:
       labels:
         app: civo-versions
     spec:
-      priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/civo-versions:latest@sha256:90585c61b82e124f9179b60fc8231247e3b37cab76fd7c0185aeb4a4276a0ab4
+        image: rg.fr-par.scw.cloud/averagemarcus/civo-versions:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8000
@@ -67,10 +66,11 @@ metadata:
   namespace: civo-versions
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - civo-versions.cluster.fun

manifests/cors-proxy/cors-proxy.yaml

@@ -1,81 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: cors-proxy
-  namespace: cors-proxy
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: 8000
-    name: web
-  selector:
-    app: cors-proxy
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cors-proxy
-  namespace: cors-proxy
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: cors-proxy
-  template:
-    metadata:
-      labels:
-        app: cors-proxy
-    spec:
-      containers:
-      - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/cors-proxy:latest@sha256:306783c26392f92af7e34d173493b0f8d6fd7623421d16a02fad26857317aeec
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 8000
-          name: web
-        env:
-        - name: ALLOWLIST
-          value: cdn.bsky.app,en.wikipedia.org
-        resources:
-          requests:
-            memory: 184M
-          limits:
-            memory: 184M
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: cors-proxy
-  namespace: cors-proxy
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - cors-proxy.cluster.fun
-    - cors-proxy.marcusnoble.co.uk
-    secretName: cors-proxy-ingress
-  rules:
-  - host: cors-proxy.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: cors-proxy
-            port:
-              number: 80
-  - host: cors-proxy.marcusnoble.co.uk
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: cors-proxy
-            port:
-              number: 80

manifests/cv/cv.yaml

@@ -62,10 +62,11 @@ metadata:
   namespace: cv
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - cv.marcusnoble.co.uk

manifests/dashboard/dashboard.yaml

@@ -81,7 +81,7 @@ spec:
             secretKeyRef:
               key: password
               name: dashboard-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1
         name: oauth-proxy
         ports:
         - containerPort: 8000

manifests/devstats-viewer/devstats-viewer.yaml

@@ -31,7 +31,7 @@ spec:
         - name: docker-config
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/devstats-viewer:latest@sha256:ecf19a3dd9ecc16f78d0a276aa977a7a8ee17635d5ee68ea86e5ee0a2e1ebe48
+        image: rg.fr-par.scw.cloud/averagemarcus/devstats-viewer:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 80

manifests/feed-fetcher/feed-fetcher.yaml

@@ -29,16 +29,11 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/feed-fetcher:latest@sha256:fe79408673dda5c73ed05e38cac441cbbbebd264548318f1e4701751c6a32b35
+        image: rg.fr-par.scw.cloud/averagemarcus/feed-fetcher:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
           name: web
-        resources:
-          requests:
-            memory: 80M
-          limits:
-            memory: 80M
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -47,10 +42,11 @@ metadata:
   namespace: feed-fetcher
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - feed-fetcher.cluster.fun

manifests/git-sync/git-sync.yaml

@@ -78,7 +78,7 @@ spec:
         spec:
           containers:
           - name: sync
-            image: rg.fr-par.scw.cloud/averagemarcus/git-sync:latest@sha256:6060f0e77e324179cf6b2136a180ceecbcc64344682154b8848434fd105323e7
+            image: rg.fr-par.scw.cloud/averagemarcus/git-sync:latest
             imagePullPolicy: Always
             env:
             - name: GITHUB_TOKEN

manifests/gitea/gitea.yaml

@@ -40,10 +40,9 @@ spec:
       labels:
         app: git
     spec:
-      priorityClassName: critical
       containers:
       - name: git
-        image: gitea/gitea:28.2.0@sha256:30777c91280d973fa02be48b1ade735bd6859e8f6f7af3b4444d519437852504
+        image: gitea/gitea:1.23.4
         env:
         - name: APP_NAME
           value: "Git"
@@ -67,8 +66,6 @@ spec:
           value: arc-green
         - name: ALLOWED_HOST_LIST
           value: "*"
-        - name: EGRESS_MODE
-          value: "lax"
         - name: SECRET_KEY
           valueFrom:
             secretKeyRef:
@@ -79,7 +76,7 @@ spec:
           name: web
         resources:
           requests:
-            memory: 700Mi
+            memory: 400Mi
         volumeMounts:
         - mountPath: /data
           name: git-data

manifests/goplayground/goplayground.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: x1unix/go-playground:3.0.0@sha256:4c4a9bcbc0413faaacc8eb0a425922858a55b73ab03f5359082217d5b93cc000
+        image: x1unix/go-playground:2.5.3
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 8000
@@ -47,10 +47,11 @@ metadata:
   namespace: goplayground
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - go.cluster.fun

manifests/grist/grist.yaml

@@ -64,18 +64,15 @@ spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: grist
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app.kubernetes.io/name: grist
     spec:
       serviceAccountName: grist
-      priorityClassName: critical
       containers:
         - name: grist
-          image: gristlabs/grist-oss:1.7.21@sha256:5657dc14b1745ef759bf789e5206ff4591e9b7d61d53777cc2fc710bfc9fbe36
+          image: gristlabs/grist-oss:1.4.2
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -100,17 +97,14 @@ spec:
               value: default
             - name: GRIST_TELEMETRY_LEVEL
               value: "off"
+            - name: ALLOWED_WEBHOOK_DOMAINS
+              value: "tank.tank.svc,matrix.cluster.fun"
             - name: GRIST_ANON_PLAYGROUND
               value: "false"
             - name: GRIST_FORCE_LOGIN
               value: "true"
             - name: GRIST_SANDBOX_FLAVOR
               value: gvisor
-          resources:
-            requests:
-              memory: 300M
-            limits:
-              memory: 600M
           securityContext:
             capabilities:
               add:

manifests/homelab-accessible-check/homelab-accessible-check.yaml

@@ -1,53 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: docker-config
-  namespace: homelab-accessible-check
-  annotations:
-    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-key: .dockerconfigjson
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: e30=
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: homelab-accessible-check
-  namespace: homelab-accessible-check
-  annotations:
-    kube-1password: bz6ujxc5neqma242lpfqdxfiay
-    kube-1password/vault: Kubernetes
-    kube-1password/secret-text-parse: "true"
-type: Opaque
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: homelab-accessible-check
-  namespace: homelab-accessible-check
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: homelab-accessible-check
-  template:
-    metadata:
-      labels:
-        app: homelab-accessible-check
-    spec:
-      imagePullSecrets:
-        - name: docker-config
-      containers:
-      - name: checker
-        image: rg.fr-par.scw.cloud/averagemarcus-private/homelab-accessible-check:latest
-        imagePullPolicy: Always
-        envFrom:
-        - secretRef:
-            name: "homelab-accessible-check"
-        resources:
-          limits:
-            memory: 50Mi
-          requests:
-            memory: 50Mi

manifests/link/link.yaml

@@ -29,24 +29,6 @@ data:
     kcddk24: https://speaking.marcusnoble.co.uk/FU4W7x/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
     cndoslo: https://speaking.marcusnoble.co.uk/j5M53P/from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes
     rejekts25: https://speaking.marcusnoble.co.uk/AXARFf/pod-deep-dive-everything-you-didnt-know-you-needed-to-know
-    kcdbudapest: https://speaking.marcusnoble.co.uk/43QLpx/the-future-of-kubernetes-admission-logic
-    kcdczechslovak: https://speaking.marcusnoble.co.uk/Np2xUv/pod-deep-dive-the-interesting-bits
-    cnsmunich: https://speaking.marcusnoble.co.uk/HqYcp2/pod-deep-dive-the-interesting-bits
-    cnsmunich-feedback: https://yay-or-nay.cluster.fun/feedback/20UETBI0
-    containerdays25: https://speaking.marcusnoble.co.uk/HARSlE/the-future-of-kubernetes-admission-logic
-    containerdays25-feedback: https://yay-or-nay.cluster.fun/feedback/F8P351QK
-    cdl-2026: https://speaking.marcusnoble.co.uk/lMcEwR/pod-deep-dive-the-interesting-bits
-    cdl-2026-feedback: https://yay-or-nay.cluster.fun/feedback/EMLARINI
-    cdl-talk-2026: https://speaking.marcusnoble.co.uk/0rRvmv/debugging-your-conference-talk-practical-tips-to-resonate-with-your-audience
-    cdl-talk-2026-feedback: https://yay-or-nay.cluster.fun/feedback/22TO05MQ
-    technical-talking-blog-post: https://marcusnoble.co.uk/2025-04-30-my-tips-on-giving-technical-talks/
-    kubecon-eu-26: https://speaking.marcusnoble.co.uk/zT471P/kube-oddities-the-quirks-that-keep-kubernetes-interesting
-    cndro26: https://speaking.marcusnoble.co.uk/1OrBAe/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
-    cdh26: https://speaking.marcusnoble.co.uk/dvat0w/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
-    kcdsofia26: https://speaking.marcusnoble.co.uk/GFJgtL/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
-    cndpoland26: https://speaking.marcusnoble.co.uk/sZ2Ulk/kube-oddities-the-quirks-that-keep-kubernetes-interesting-marcus-noble-mark-sagi-kazar
-    kcduk2026: https://speaking.marcusnoble.co.uk/Xpj6t6/pod-deep-dive-the-interesting-bits
-    kcduk2026-feedback: https://yay-or-nay.cluster.fun/feedback/BS01AM1M
 ---
 apiVersion: v1
 kind: Service
@@ -71,8 +53,6 @@ metadata:
   namespace: link
   labels:
     app: link
-  annotations:
-    secret.reloader.stakater.com/reload: "urls-map"
 spec:
   replicas: 1
   selector:
@@ -83,10 +63,9 @@ spec:
       labels:
         app: link
     spec:
-      priorityClassName: critical
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/link:latest@sha256:11d3908c87c91c3e9b0ac64377a016f967eb96d92c5a478f61ac4d6e4b7128f9
+        image: rg.fr-par.scw.cloud/averagemarcus/link:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 5050
@@ -106,10 +85,11 @@ metadata:
   namespace: link
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - go-get.link

manifests/marcusnoble/marcusnoble.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/marcusnoble:latest@sha256:258e639003301f9a41a796c74a963b624454de6dad2dd90f0a1eb745027cfc88
+        image: rg.fr-par.scw.cloud/averagemarcus/marcusnoble:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -39,16 +39,16 @@ spec:
             memory: 50Mi
           requests:
             memory: 50Mi
-        livenessProbe:
-          httpGet:
-            path: /
-            port: web
-          initialDelaySeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /
-            port: web
-          initialDelaySeconds: 10
+        # livenessProbe:
+        #   httpGet:
+        #     path: /healthz
+        #     port: web
+        #   initialDelaySeconds: 10
+        # readinessProbe:
+        #   httpGet:
+        #     path: /healthz
+        #     port: web
+        #   initialDelaySeconds: 10
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/mastodon-digest/mastodon_digest.yaml

@@ -0,0 +1,229 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-config
+  namespace: mastodon-digest
+  annotations:
+    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: .dockerconfigjson
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mastodon-digest-auth
+  namespace: mastodon-digest
+  annotations:
+    kube-1password: mr6spkkx7n3memkbute6ojaarm
+    kube-1password/vault: Kubernetes
+type: Opaque
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mastodon-digest
+  namespace: mastodon-digest
+  annotations:
+    kube-1password: bfklz3yi3dn4e7xtsbttcvhata
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+  namespace: mastodon-digest
+  labels:
+    app: mastodon-digest
+data:
+  config.json: |
+    [
+      {
+        "timeline": "home",
+        "hours": 12,
+        "scorer": "ExtendedSimpleWeighted",
+        "threshold": "lax",
+        "output": "/usr/share/nginx/html/home/"
+      },
+      {
+        "timeline": "federated",
+        "hours": 12,
+        "scorer": "ExtendedSimpleWeighted",
+        "threshold": "lax",
+        "output": "/usr/share/nginx/html/federated/"
+      }
+    ]
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: index
+  namespace: mastodon-digest
+  labels:
+    app: mastodon-digest
+data:
+  index.html: |
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+        <meta chartset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <title>Mastodon Digest</title>
+        <style>
+        body { background-color: #292c36; font-family: "Arial", sans-serif; }
+        div#container { margin: auto; max-width: 640px; padding: 10px; text-align: center; margin: 0 auto; }
+        .links { align: center; }
+        h1 { color: white; }
+        a.button { background: #595aff; color: #fff; line-height: 1.2; min-height: 38px; min-width: 88px; padding: 0 30px; border: 0; border-radius: 6px;; display: inline-flex; justify-content: center; align-items: center; }
+    </style>
+    </head>
+    <body>
+        <div id="container">
+            <h1>Mastodon Digest</h1>
+            <section class="links">
+                <a href="home/" class="button">Home</a>
+                <a href="federated/" class="button">Federated</a>
+            </section>
+        </div>
+    </body>
+    </html>
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mastodon-digest
+  namespace: mastodon-digest
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: auth
+    name: web
+  selector:
+    app: mastodon-digest
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mastodon-digest
+  namespace: mastodon-digest
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mastodon-digest
+  template:
+    metadata:
+      labels:
+        app: mastodon-digest
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - args:
+        - --cookie-secure=false
+        - --provider=oidc
+        - --provider-display-name=Auth0
+        - --upstream=http://localhost:80
+        - --http-address=$(HOST_IP):8000
+        - --redirect-url=https://mastodon-digest.cluster.fun/oauth2/callback
+        - --email-domain=marcusnoble.co.uk
+        - --pass-basic-auth=false
+        - --pass-access-token=false
+        - --oidc-issuer-url=https://marcusnoble.eu.auth0.com/
+        - --cookie-secret=KDGD6rrK6cBmryyZ4wcJ9xAUNW9AQNFT
+        env:
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: OAUTH2_PROXY_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: mastodon-digest-auth
+        - name: OAUTH2_PROXY_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: mastodon-digest-auth
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1
+        name: oauth-proxy
+        ports:
+        - containerPort: 8000
+          protocol: TCP
+          name: auth
+        resources:
+          limits:
+            memory: 50Mi
+          requests:
+            memory: 50Mi
+
+      - name: web
+        image: nginx:stable
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 80
+          name: web
+        volumeMounts:
+        - name: html
+          mountPath: /usr/share/nginx/html
+        - name: index
+          mountPath: /usr/share/nginx/html/index.html
+          subPath: index.html
+
+      - name: digest
+        image: rg.fr-par.scw.cloud/averagemarcus-private/mastodon-digest:latest
+        imagePullPolicy: Always
+        env:
+        - name: CONFIG_FILE
+          value: /config.json
+        envFrom:
+        - secretRef:
+            name: mastodon-digest
+        volumeMounts:
+        - name: config
+          mountPath: /config.json
+          subPath: config.json
+        - name: html
+          mountPath: /usr/share/nginx/html
+      volumes:
+      - name: html
+        emptyDir: {}
+      - name: config
+        configMap:
+          name: config
+      - name: index
+        configMap:
+          name: index
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: mastodon-digest
+  namespace: mastodon-digest
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - mastodon-digest.cluster.fun
+    secretName: mastodon-digest-ingress
+  rules:
+  - host: mastodon-digest.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: mastodon-digest
+            port:
+              number: 80

manifests/matrix_chart/matrix_chart.yaml

@@ -0,0 +1,536 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: matrix
+  namespace: chat
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - matrix.cluster.fun
+    secretName: matrix-ingress
+  rules:
+  - host: matrix.cluster.fun
+    http:
+      paths:
+      - path: /.well-known/matrix
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: well-known
+            port:
+              number: 80
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: matrix-synapse
+            port:
+              number: 80
+
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: riot
+  namespace: chat
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - chat.cluster.fun
+    secretName: riot-ingress
+  rules:
+  - host: chat.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: matrix-riot
+            port:
+              number: 80
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: well-known
+  namespace: chat
+  annotations:
+    configmap.reloader.stakater.com/reload: "well-known"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: well-known
+  template:
+    metadata:
+      labels:
+        app: well-known
+    spec:
+      containers:
+      - name: web
+        image: nginx
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 80
+          name: web
+        volumeMounts:
+        - name: well-known
+          mountPath: /usr/share/nginx/html/.well-known/matrix
+        resources:
+          limits:
+            memory: 15Mi
+          requests:
+            memory: 15Mi
+      volumes:
+      - name: well-known
+        configMap:
+          name: well-known
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: well-known
+  namespace: chat
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: 80
+    name: web
+  selector:
+    app: well-known
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: well-known
+  namespace: chat
+data:
+  server: |-
+    {
+      "m.server": "matrix.cluster.fun:443"
+    }
+  client: |-
+    {
+      "m.homeserver": {
+        "base_url": "https://matrix.cluster.fun"
+      },
+      "org.matrix.msc3575.proxy": {
+        "url": "https://syncv3.matrix.cluster.fun"
+      }
+    }
+
+
+---
+
+
+# Source: matrix/templates/riot/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: matrix-riot-config
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: element
+data:
+  config.json: |
+    {
+      "default_server_config": {
+        "m.homeserver": {
+          "base_url": "https://matrix.cluster.fun"
+        }
+      },
+      "brand": "Element",
+      "branding": {},
+      "integrations_ui_url": "https://scalar.vector.im/",
+      "integrations_rest_url": "https://scalar.vector.im/api",
+      "integrations_widgets_urls": [
+        "https://scalar.vector.im/_matrix/integrations/v1",
+        "https://scalar.vector.im/api",
+        "https://scalar-staging.vector.im/_matrix/integrations/v1",
+        "https://scalar-staging.vector.im/api",
+        "https://scalar-staging.riot.im/scalar/api"
+      ],
+      "showLabsSettings": true,
+      "features": {
+        "feature_pinning": true,
+        "feature_custom_status": "labs",
+        "feature_state_counters": "labs",
+        "feature_many_integration_managers": "labs",
+        "feature_mjolnir": "labs",
+        "feature_dm_verification": "labs",
+        "feature_bridge_state": "labs",
+        "feature_presence_in_room_list": true,
+        "feature_custom_themes": "labs",
+        "feature_new_spinner": "labs",
+        "feature_jump_to_date": "labs",
+        "feature_location_share_pin_drop": "labs",
+        "feature_location_share_live": "labs",
+        "feature_thread": true,
+        "feature_video_rooms": true,
+        "feature_favourite_messages": "labs"
+      },
+      "roomDirectory": {
+        "servers": []
+      },
+      "permalinkPrefix": "https://chat.cluster.fun",
+      "enable_presence_by_hs_url": {
+        "https://matrix.org": false,
+        "https://matrix-client.matrix.org": false
+      },
+      "map_style_url": "https://api.maptiler.com/maps/streets/style.json?key=2IerXP2a5g1e7hxxBbzs"
+    }
+  nginx.conf: |
+    worker_processes  auto;
+
+    error_log  /var/log/nginx/error.log warn;
+    pid        /var/run/pid/nginx.pid;
+
+    events {
+      worker_connections  1024;
+    }
+
+    http {
+      include       /etc/nginx/mime.types;
+      default_type  application/octet-stream;
+
+      log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+      '$status $body_bytes_sent "$http_referer" '
+      '"$http_user_agent" "$http_x_forwarded_for"';
+
+      access_log  /var/log/nginx/access.log  main;
+
+      sendfile        on;
+
+      keepalive_timeout  65;
+
+      include /etc/nginx/conf.d/*.conf;
+    }
+  default.conf: |
+    server {
+      listen       8080;
+      server_name  localhost;
+
+      location / {
+          root   /usr/share/nginx/html;
+          index  index.html index.htm;
+      }
+
+      # redirect server error pages to the static page /50x.html
+      #
+      error_page   500 502 503 504  /50x.html;
+      location = /50x.html {
+          root   /usr/share/nginx/html;
+      }
+    }
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: matrix-synapse-config
+  namespace: chat
+  annotations:
+    kube-1password: wbj4oozwyx6m2zz5m42pgcmymy
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: homeserver.yaml
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: synapse
+type: Opaque
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: matrix-synapse-config
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: element
+data:
+  matrix.cluster.fun.log.config: |
+    version: 1
+
+    formatters:
+      precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+    filters:
+      context:
+        (): synapse.util.logcontext.LoggingContextFilter
+        request: ""
+
+    handlers:
+      console:
+        class: logging.StreamHandler
+        formatter: precise
+        filters: [context]
+
+    loggers:
+      synapse:
+        level: WARNING
+      synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: WARNING
+
+    root:
+      level: WARNING
+      handlers: [console]
+---
+# Source: matrix/templates/riot/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-riot
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: element
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: matrix-riot
+---
+# Source: matrix/templates/synapse/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: matrix-synapse
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: synapse
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/path: "/_synapse/metrics"
+    prometheus.io/port: "9000"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+    - port: 9000
+      targetPort: metrics
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/name: matrix-synapse
+---
+# Source: matrix/templates/riot/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix-riot
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: element
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: matrix-riot
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: matrix-riot
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: "riot"
+          image: "vectorim/element-web:v1.11.93"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /app/config.json
+              name: riot-config
+              subPath: config.json
+              readOnly: true
+            - mountPath: /etc/nginx/nginx.conf
+              name: riot-config
+              subPath: nginx.conf
+              readOnly: true
+            - mountPath: /etc/nginx/conf.d/default.conf
+              name: riot-config
+              subPath: default.conf
+              readOnly: true
+            - mountPath: /var/cache/nginx
+              name: ephemeral
+              subPath: cache
+            - mountPath: /var/run/pid
+              name: ephemeral
+              subPath: pid
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          startupProbe:
+            httpGet:
+              path: /
+              port: http
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+      volumes:
+        - name: riot-config
+          configMap:
+            name: matrix-riot-config
+        - name: ephemeral
+          emptyDir: {}
+---
+# Source: matrix/templates/synapse/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: matrix-synapse
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: synapse
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: matrix-synapse
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: matrix-synapse
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      initContainers:
+        - name: generate-signing-key
+          image: "ghcr.io/element-hq/synapse:v1.125.0"
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: SYNAPSE_SERVER_NAME
+              value: matrix.cluster.fun
+            - name: SYNAPSE_REPORT_STATS
+              value: "no"
+          command: ["python"]
+          args:
+            - "-m"
+            - "synapse.app.homeserver"
+            - "--config-path"
+            - "/data/homeserver.yaml"
+            - "--keys-directory"
+            - "/data/keys"
+            - "--generate-keys"
+          volumeMounts:
+            - name: synapse-config-homeserver
+              mountPath: /data/homeserver.yaml
+              subPath: homeserver.yaml
+            - name: synapse-config-logging
+              mountPath: /data/matrix.cluster.fun.log.config
+              subPath: matrix.cluster.fun.log.config
+            - name: signing-key
+              mountPath: /data/keys
+      containers:
+        - name: "synapse"
+          image: "ghcr.io/element-hq/synapse:v1.125.0"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8008
+              protocol: TCP
+            - name: metrics
+              containerPort: 9000
+              protocol: TCP
+          volumeMounts:
+            - name: synapse-config-homeserver
+              mountPath: /data/homeserver.yaml
+              subPath: homeserver.yaml
+            - name: synapse-config-logging
+              mountPath: /data/matrix.cluster.fun.log.config
+              subPath: matrix.cluster.fun.log.config
+            - name: signing-key
+              mountPath: /data/keys
+            - name: user-media
+              mountPath: /data/media_store
+            - name: uploads
+              mountPath: /data/uploads
+            - name: tmp
+              mountPath: /tmp
+          readinessProbe:
+            httpGet:
+              path: /_matrix/static/
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+          startupProbe:
+            httpGet:
+              path: /_matrix/static/
+              port: http
+            failureThreshold: 6
+            periodSeconds: 5
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /_matrix/static/
+              port: http
+            periodSeconds: 10
+            timeoutSeconds: 5
+          securityContext:
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+      volumes:
+        - name: synapse-config-logging
+          configMap:
+            name: matrix-synapse-config
+        - name: synapse-config-homeserver
+          secret:
+            secretName: matrix-synapse-config
+        - name: signing-key
+          persistentVolumeClaim:
+            claimName: chat-matrix-signing-key
+        - name: user-media
+          persistentVolumeClaim:
+            claimName: chat-matrix-user-media
+        - name: uploads
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+---

manifests/matrix_chart/pvs.yaml

@@ -1,26 +1,32 @@
-kind: PersistentVolumeClaim
 apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
-  name: trek-data
-  namespace: trek
+  name: chat-matrix-user-media
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: synapse
 spec:
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 2Gi
+      storage: 12Gi
   storageClassName: sbs-default-retain
 ---
-kind: PersistentVolumeClaim
 apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
-  name: trek-uploads
-  namespace: trek
+  name: chat-matrix-signing-key
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: synapse
 spec:
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 2Gi
+      storage: 1Gi
   storageClassName: sbs-default-retain
 ---

manifests/matrix_chart/sliding-sync.yaml

@@ -0,0 +1,119 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: matrix-sliding-sync
+  namespace: chat
+  annotations:
+    kube-1password: 7kvyfcszfaavj2d7uvl4troagm
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: sliding-sync
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sliding-sync
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: sliding-sync
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: sliding-sync
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: sliding-sync
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: "sliding-sync"
+          image: "ghcr.io/matrix-org/sliding-sync:v0.99.19"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8008
+              protocol: TCP
+            - name: metrics
+              containerPort: 9090
+              protocol: TCP
+          env:
+          - name: SYNCV3_SERVER
+            value: https://matrix.cluster.fun
+          - name: SYNCV3_BINDADDR
+            value: ":8008"
+          - name: SYNCV3_PROM
+            value: ":9090"
+          - name: SYNCV3_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: matrix-sliding-sync
+                key: SYNCV3_SECRET
+          - name: SYNCV3_DB
+            valueFrom:
+              secretKeyRef:
+                name: matrix-sliding-sync
+                key: SYNCV3_DB
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sliding-sync
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: sliding-sync
+  annotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "9090"
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: http
+    name: web
+  - port: 9090
+    targetPort: metrics
+    protocol: TCP
+    name: metrics
+  selector:
+    app.kubernetes.io/name: sliding-sync
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: sliding-sync
+  namespace: chat
+  labels:
+    app.kubernetes.io/name: "matrix"
+    component: sliding-sync
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - syncv3.matrix.cluster.fun
+    secretName: sliding-sync-ingress
+  rules:
+  - host: syncv3.matrix.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: sliding-sync
+            port:
+              number: 80
+---

manifests/mazanoke/manifest.yaml

@@ -1,69 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: mazanoke
-  namespace: mazanoke
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-    name: web
-  selector:
-    app: mazanoke
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mazanoke
-  namespace: mazanoke
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mazanoke
-  template:
-    metadata:
-      labels:
-        app: mazanoke
-    spec:
-      containers:
-      - name: web
-        image: ghcr.io/civilblur/mazanoke:v1.1.7@sha256:ca83cddd90cd1e4b43102884bf39025731a1c7569f3bbda9d6530de72528cbab
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 80
-          name: web
-        resources:
-          limits:
-            memory: 200Mi
-          requests:
-            memory: 200Mi
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mazanoke
-  namespace: mazanoke
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - image.cluster.fun
-    secretName: mazanoke-ingress
-  rules:
-  - host: image.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: mazanoke
-            port:
-              number: 80
-

manifests/mealie/mealie.yaml

@@ -28,10 +28,9 @@ spec:
       labels:
         app: mealie
     spec:
-      priorityClassName: critical
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v3.29.0@sha256:78eb28b8776d0bad40c5e605c72b3f4f5976793e491558c7dcbdfc04c835d4bc
+        image: ghcr.io/mealie-recipes/mealie:v2.6.0
         imagePullPolicy: Always
         envFrom:
         - secretRef:
@@ -42,7 +41,7 @@ spec:
         - name: PGID
           value: "1000"
         - name: TOKEN_TIME
-          value: "720"
+          value: "168"
         - name: DB_ENGINE
           value: postgres
         - name: POSTGRES_DB
@@ -69,18 +68,12 @@ spec:
         volumeMounts:
           - mountPath: /app/data
             name: data
-        resources:
-          requests:
-            cpu: 200m
-            memory: 375Mi
-          limits:
-            cpu: 1000m
-            memory: 550Mi
       volumes:
       - name: data
         persistentVolumeClaim:
           claimName: mealie
 
+
 ---
 
 apiVersion: v1
@@ -98,6 +91,7 @@ spec:
     app: mealie
 ---
 
+
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:

manifests/monitoring-civo/kube-state-metrics.yaml

@@ -0,0 +1,255 @@
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kube-state-metrics
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: kube-state-metrics
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: kube-state-metrics
+  name: kube-state-metrics
+rules:
+  - apiGroups: ["certificates.k8s.io"]
+    resources:
+    - certificatesigningrequests
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - configmaps
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["batch"]
+    resources:
+    - cronjobs
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["extensions", "apps"]
+    resources:
+    - daemonsets
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["extensions", "apps"]
+    resources:
+    - deployments
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - endpoints
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["autoscaling"]
+    resources:
+    - horizontalpodautoscalers
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources:
+    - ingresses
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["batch"]
+    resources:
+    - jobs
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - limitranges
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources:
+      - mutatingwebhookconfigurations
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - namespaces
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["networking.k8s.io"]
+    resources:
+    - networkpolicies
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - nodes
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - persistentvolumeclaims
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - persistentvolumes
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["policy"]
+    resources:
+      - poddisruptionbudgets
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - pods
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["extensions", "apps"]
+    resources:
+    - replicasets
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - replicationcontrollers
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - resourcequotas
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - secrets
+    verbs: ["list", "watch"]
+
+  - apiGroups: [""]
+    resources:
+    - services
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["apps"]
+    resources:
+    - statefulsets
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["storage.k8s.io"]
+    resources:
+      - storageclasses
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources:
+      - validatingwebhookconfigurations
+    verbs: ["list", "watch"]
+
+  - apiGroups: ["storage.k8s.io"]
+    resources:
+      - volumeattachments
+    verbs: ["list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: kube-state-metrics
+  name: kube-state-metrics
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kube-state-metrics
+subjects:
+- kind: ServiceAccount
+  name: kube-state-metrics
+  namespace: monitoring
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: kube-state-metrics
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: kube-state-metrics
+  annotations:
+    prometheus.io/scrape: 'true'
+spec:
+  type: "ClusterIP"
+  ports:
+  - name: "http"
+    protocol: TCP
+    port: 8080
+    targetPort: 8080
+  selector:
+    app.kubernetes.io/name: kube-state-metrics
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kube-state-metrics
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: kube-state-metrics
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kube-state-metrics
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: kube-state-metrics
+    spec:
+      serviceAccountName: kube-state-metrics
+      securityContext:
+        fsGroup: 65534
+        runAsGroup: 65534
+        runAsUser: 65534
+      containers:
+      - name: kube-state-metrics
+        args:
+        #- --resources=certificatesigningrequests
+        - --resources=configmaps
+        - --resources=cronjobs
+        - --resources=daemonsets
+        - --resources=deployments
+        #- --resources=endpoints
+        #- --resources=horizontalpodautoscalers
+        - --resources=ingresses
+        - --resources=jobs
+        #- --resources=limitranges
+        - --resources=mutatingwebhookconfigurations
+        - --resources=namespaces
+        #- --resources=networkpolicies
+        - --resources=nodes
+        - --resources=persistentvolumeclaims
+        - --resources=persistentvolumes
+        - --resources=poddisruptionbudgets
+        - --resources=pods
+        - --resources=replicasets
+        #- --resources=replicationcontrollers
+        #- --resources=resourcequotas
+        - --resources=secrets
+        - --resources=services
+        - --resources=statefulsets
+        - --resources=storageclasses
+        - --resources=validatingwebhookconfigurations
+        #- --resources=volumeattachments
+        imagePullPolicy: IfNotPresent
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0"
+        ports:
+        - containerPort: 8080
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 8080
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+---

manifests/monitoring-civo/prometheus-server.yaml

@@ -0,0 +1,64 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: prometheus-server
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: prometheus
+    app.kubernetes.io/component: server
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: prometheus
+    app.kubernetes.io/component: server
+  name: prometheus-server
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+      - nodes/proxy
+      - nodes/metrics
+      - services
+      - endpoints
+      - pods
+      - ingresses
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "extensions"
+      - "networking.k8s.io"
+    resources:
+      - ingresses/status
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - nonResourceURLs:
+      - "/metrics"
+    verbs:
+      - get
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: prometheus
+    app.kubernetes.io/component: server
+  name: prometheus-server
+subjects:
+  - kind: ServiceAccount
+    name: prometheus-server
+    namespace: monitoring
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus-server
+---

manifests/monitoring-civo/promtail.yaml

@@ -0,0 +1,292 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: promtail
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: promtail
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: promtail
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: promtail
+data:
+  promtail.yaml: |
+    client:
+      backoff_config:
+        max_period: 5m
+        max_retries: 10
+        min_period: 500ms
+      batchsize: 1048576
+      batchwait: 1s
+      external_labels: {}
+      timeout: 10s
+    positions:
+      filename: /run/promtail/positions.yaml
+    server:
+      http_listen_port: 3101
+    clients:
+    - url: http://loki-distributed.proxy-civo.svc:80/loki/api/v1/push
+      external_labels:
+        kubernetes_cluster: civo
+    target_config:
+      sync_period: 10s
+    scrape_configs:
+    - job_name: kubernetes-pods
+      pipeline_stages:
+        - docker: {}
+        - cri: {}
+        - match:
+            selector: '{app="weave-net"}'
+            action: drop
+        - match:
+            selector: '{filename=~".*konnectivity.*"}'
+            action: drop
+        - match:
+            selector: '{name=~".*"} |~ ".*/healthz.*"'
+            action: drop
+        - match:
+            selector: '{name=~".*"} |~ ".*/api/health.*"'
+            action: drop
+        - match:
+            selector: '{name=~".*"} |~ ".*kube-probe/.*"'
+            action: drop
+        - match:
+            selector: '{app="internal-proxy"}'
+            action: drop
+        - match:
+            selector: '{app="non-auth-proxy"}'
+            action: drop
+        - match:
+            selector: '{app="vpa"}'
+            action: drop
+        - match:
+            selector: '{app="promtail"}'
+            action: drop
+        - match:
+            selector: '{app="csi-node"}'
+            action: drop
+        - match:
+            selector: '{app="victoria-metrics"}'
+            action: drop
+        - match:
+            selector: '{app="git-sync"}'
+            action: drop
+        - match:
+            selector: '{app="ingress-nginx"}'
+            stages:
+            - json:
+                expressions:
+                  request_host: host
+                  request_path: path
+                  request_method: method
+                  response_status: status
+            - drop:
+                source: "request_path"
+                value:  "/healthz"
+            - drop:
+                source: "request_path"
+                value:  "/health"
+            - labels:
+                request_host:
+                request_method:
+                response_status:
+        - match:
+            selector: '{app="traefik"}'
+            stages:
+            - json:
+                expressions:
+                  request_host: RequestHost
+                  request_path: RequestPath
+                  request_method: RequestMethod
+                  response_status: OriginStatus
+            - drop:
+                source: "request_path"
+                value:  "/healthz"
+            - drop:
+                source: "request_path"
+                value:  "/health"
+            - drop:
+                source: "request_path"
+                value:  "/ping"
+            - labels:
+                request_host:
+                request_method:
+                response_status:
+      kubernetes_sd_configs:
+        - role: pod
+      relabel_configs:
+        - source_labels:
+            - __meta_kubernetes_pod_controller_name
+          regex: ([0-9a-z-.]+?)(-[0-9a-f]{8,10})?
+          action: replace
+          target_label: __tmp_controller_name
+        - source_labels:
+            - __meta_kubernetes_pod_label_app_kubernetes_io_name
+            - __meta_kubernetes_pod_label_app
+            - __tmp_controller_name
+            - __meta_kubernetes_pod_name
+          regex: ^;*([^;]+)(;.*)?$
+          action: replace
+          target_label: app
+        - source_labels:
+            - __meta_kubernetes_pod_label_app_kubernetes_io_component
+            - __meta_kubernetes_pod_label_component
+          regex: ^;*([^;]+)(;.*)?$
+          action: replace
+          target_label: component
+        - action: replace
+          source_labels:
+            - __meta_kubernetes_pod_node_name
+          target_label: node_name
+        - action: replace
+          source_labels:
+            - __meta_kubernetes_namespace
+          target_label: namespace
+        - action: replace
+          replacement: $1
+          separator: /
+          source_labels:
+            - namespace
+            - app
+          target_label: job
+        - action: replace
+          source_labels:
+            - __meta_kubernetes_pod_name
+          target_label: pod
+        - action: replace
+          source_labels:
+            - __meta_kubernetes_pod_container_name
+          target_label: container
+        - action: replace
+          replacement: /var/log/pods/*$1/*.log
+          separator: /
+          source_labels:
+            - __meta_kubernetes_pod_uid
+            - __meta_kubernetes_pod_container_name
+          target_label: __path__
+        - action: replace
+          replacement: /var/log/pods/*$1/*.log
+          regex: true/(.*)
+          separator: /
+          source_labels:
+            - __meta_kubernetes_pod_annotationpresent_kubernetes_io_config_hash
+            - __meta_kubernetes_pod_annotation_kubernetes_io_config_hash
+            - __meta_kubernetes_pod_container_name
+          target_label: __path__
+        - action: labelmap
+          regex: __meta_kubernetes_pod_label_(.+)
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: promtail-clusterrole
+  labels:
+    app.kubernetes.io/name: promtail
+rules:
+- apiGroups: [""] # "" indicates the core API group
+  resources:
+  - nodes
+  - nodes/proxy
+  - services
+  - endpoints
+  - pods
+  verbs: ["get", "watch", "list"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: promtail-clusterrolebinding
+  labels:
+    app.kubernetes.io/name: promtail
+subjects:
+  - kind: ServiceAccount
+    name: promtail
+    namespace: monitoring
+roleRef:
+  kind: ClusterRole
+  name: promtail-clusterrole
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: promtail
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: promtail
+  annotations:
+    configmap.reloader.stakater.com/reload: "promtail"
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: promtail
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: promtail
+      annotations:
+        prometheus.io/port: http-metrics
+        prometheus.io/scrape: "true"
+    spec:
+      serviceAccountName: promtail
+      containers:
+        - name: promtail
+          image: "grafana/promtail:2.9.12"
+          imagePullPolicy: IfNotPresent
+          args:
+            - "-config.file=/etc/promtail/promtail.yaml"
+          volumeMounts:
+            - name: config
+              mountPath: /etc/promtail
+            - name: run
+              mountPath: /run/promtail
+            - mountPath: /var/lib/docker/containers
+              name: docker
+              readOnly: true
+            - mountPath: /var/log/pods
+              name: pods
+              readOnly: true
+          env:
+            - name: HOSTNAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          ports:
+            - containerPort: 3101
+              name: http-metrics
+          securityContext:
+            readOnlyRootFilesystem: true
+            runAsGroup: 0
+            runAsUser: 0
+          readinessProbe:
+            failureThreshold: 5
+            httpGet:
+              path: /ready
+              port: http-metrics
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+          operator: Exists
+      volumes:
+        - name: config
+          configMap:
+            name: promtail
+        - name: run
+          hostPath:
+            path: /run/promtail
+        - hostPath:
+            path: /var/lib/docker/containers
+          name: docker
+        - hostPath:
+            path: /var/log/pods
+          name: pods
+---

manifests/monitoring-civo/vmagent.yaml

@@ -0,0 +1,163 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vmagent
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: victoria-metrics
+    app.kubernetes.io/component: agent
+data:
+  prometheus.yml: |
+    global:
+      scrape_interval: 1m
+      external_labels:
+        source: civo
+        agent: vmagent
+    scrape_configs:
+    - job_name: 'vmagent'
+      static_configs:
+        - targets: ['localhost:8429']
+    - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      job_name: kubernetes-nodes
+      kubernetes_sd_configs:
+      - role: node
+      relabel_configs:
+      - action: labelmap
+        regex: __meta_kubernetes_node_label_(.+)
+      - replacement: kubernetes.default.svc:443
+        target_label: __address__
+      - regex: (.+)
+        replacement: /api/v1/nodes/$1/proxy/metrics
+        source_labels:
+        - __meta_kubernetes_node_name
+        target_label: __metrics_path__
+      scheme: https
+      tls_config:
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        insecure_skip_verify: true
+    - job_name: kubernetes-service-endpoints
+      kubernetes_sd_configs:
+      - role: endpoints
+      relabel_configs:
+      - action: keep
+        regex: true
+        source_labels:
+        - __meta_kubernetes_service_annotation_prometheus_io_scrape
+      - action: replace
+        regex: (https?)
+        source_labels:
+        - __meta_kubernetes_service_annotation_prometheus_io_scheme
+        target_label: __scheme__
+      - action: replace
+        regex: (.+)
+        source_labels:
+        - __meta_kubernetes_service_annotation_prometheus_io_path
+        target_label: __metrics_path__
+      - action: replace
+        regex: ([^:]+)(?::\d+)?;(\d+)
+        replacement: $1:$2
+        source_labels:
+        - __address__
+        - __meta_kubernetes_service_annotation_prometheus_io_port
+        target_label: __address__
+      - action: labelmap
+        regex: __meta_kubernetes_service_label_(.+)
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_namespace
+        target_label: kubernetes_namespace
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_service_name
+        target_label: kubernetes_name
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_endpoint_port_name
+        target_label: kubernetes_endpoint_port_name
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_pod_node_name
+        target_label: kubernetes_node
+    - job_name: kubernetes-pods
+      kubernetes_sd_configs:
+      - role: pod
+      relabel_configs:
+      - action: keep
+        regex: true
+        source_labels:
+        - __meta_kubernetes_pod_annotation_prometheus_io_scrape
+      - action: replace
+        regex: (.+)
+        source_labels:
+        - __meta_kubernetes_pod_annotation_prometheus_io_path
+        target_label: __metrics_path__
+      - action: replace
+        regex: ([^:]+)(?::\d+)?;(\d+)
+        replacement: $1:$2
+        source_labels:
+        - __address__
+        - __meta_kubernetes_pod_annotation_prometheus_io_port
+        target_label: __address__
+      - action: labelmap
+        regex: __meta_kubernetes_pod_label_(.+)
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_namespace
+        target_label: kubernetes_namespace
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_pod_name
+        target_label: kubernetes_pod_name
+      - action: replace
+        source_labels:
+        - __meta_kubernetes_pod_container_port_name
+        target_label: kubernetes_port_name
+      - action: drop
+        regex: Pending|Succeeded|Failed
+        source_labels:
+        - __meta_kubernetes_pod_phase
+
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vmagent
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: victoria-metrics
+    app.kubernetes.io/component: agent
+  annotations:
+    configmap.reloader.stakater.com/reload: "vmagent"
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: victoria-metrics
+      app.kubernetes.io/component: agent
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: victoria-metrics
+        app.kubernetes.io/component: agent
+    spec:
+      serviceAccountName: prometheus-server
+      containers:
+        - name: vmagent
+          image: "victoriametrics/vmagent:v1.112.0"
+          imagePullPolicy: "IfNotPresent"
+          args:
+            - -remoteWrite.url=http://vmcluster.proxy-civo.svc/insert/0/prometheus/
+            - -remoteWrite.showURL
+            - -promscrape.config=/config/prometheus.yml
+          volumeMounts:
+            - name: config-volume
+              mountPath: /config
+      volumes:
+        - name: config-volume
+          configMap:
+            name: vmagent
+---

manifests/monitoring/cadvisor.yaml

@@ -1,87 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app: cadvisor
-    app.kubernetes.io/name: cadvisor
-  name: cadvisor
-  namespace: monitoring
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  annotations:
-    seccomp.security.alpha.kubernetes.io/pod: docker/default
-  labels:
-    app: cadvisor
-    app.kubernetes.io/name: cadvisor
-  name: cadvisor
-  namespace: monitoring
-spec:
-  selector:
-    matchLabels:
-      app: cadvisor
-      app.kubernetes.io/name: cadvisor
-      name: cadvisor
-  template:
-    metadata:
-      labels:
-        app: cadvisor
-        app.kubernetes.io/name: cadvisor
-        name: cadvisor
-      annotations:
-        scheduler.alpha.kubernetes.io/critical-pod: ''
-    spec:
-      priorityClassName: system-node-critical
-      tolerations:
-        - key: "CriticalAddonsOnly"
-          operator: "Exists"
-      automountServiceAccountToken: false
-      containers:
-      - image: ghcr.io/google/cadvisor:v0.60.6@sha256:b8e7d1093144fd088f425ff003d75a4aa405de075db78dae3bc563730b1bd07a
-        name: cadvisor
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        resources:
-          limits:
-            cpu: 800m
-            memory: 800Mi
-          requests:
-            cpu: 400m
-            memory: 400Mi
-        volumeMounts:
-        - mountPath: /rootfs
-          name: rootfs
-          readOnly: true
-        - mountPath: /var/run
-          name: var-run
-          readOnly: true
-        - mountPath: /sys
-          name: sys
-          readOnly: true
-        - mountPath: /var/lib/docker
-          name: docker
-          readOnly: true
-        - mountPath: /dev/disk
-          name: disk
-          readOnly: true
-      serviceAccountName: cadvisor
-      terminationGracePeriodSeconds: 30
-      volumes:
-      - hostPath:
-          path: /
-        name: rootfs
-      - hostPath:
-          path: /var/run
-        name: var-run
-      - hostPath:
-          path: /sys
-        name: sys
-      - hostPath:
-          path: /var/lib/docker
-        name: docker
-      - hostPath:
-          path: /dev/disk
-        name: disk

manifests/monitoring/ephemeral-storage-exporter.yaml

@@ -1,142 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
-  name: k8s-ephemeral-storage-metrics
-  namespace: monitoring
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: k8s-ephemeral-storage-metrics
-  labels:
-    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
-rules:
-  - apiGroups: [""]
-    resources: ["nodes","nodes/proxy", "nodes/stats", "pods"]
-    verbs: ["get","list", "watch"]
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: k8s-ephemeral-storage-metrics
-  labels:
-    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
-subjects:
-  - kind: ServiceAccount
-    name: k8s-ephemeral-storage-metrics
-    namespace: monitoring
-roleRef:
-  kind: ClusterRole
-  name: k8s-ephemeral-storage-metrics
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: k8s-ephemeral-storage-metrics
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
-  annotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "9100"
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
-  ports:
-    - name: metrics
-      port: 9100
-      protocol: TCP
-      targetPort: metrics
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: k8s-ephemeral-storage-metrics
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: k8s-ephemeral-storage-metrics
-spec:
-  replicas: 1
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: k8s-ephemeral-storage-metrics
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: k8s-ephemeral-storage-metrics
-    spec:
-      serviceAccountName: k8s-ephemeral-storage-metrics
-      securityContext:
-        runAsNonRoot: true
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: metrics
-          image: ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics:1.21.3@sha256:8297aa4a92787ebda42827be98da6f7a77206f4c8d140858626c97c469997b67
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: metrics
-              containerPort: 9100
-              protocol: TCP
-          livenessProbe:
-            failureThreshold: 10
-            httpGet:
-              path: /metrics
-              port: 9100
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 30
-          readinessProbe:
-            failureThreshold: 10
-            httpGet:
-              path: /metrics
-              port: 9100
-              scheme: HTTP
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 1
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            privileged: false
-            readOnlyRootFilesystem: false
-            runAsNonRoot: true
-          env:
-            - name: DEPLOY_TYPE
-              value: "Deployment"
-            - name: SCRAPE_INTERVAL
-              value: "15"
-            - name: MAX_NODE_CONCURRENCY
-              value: "10"
-            - name: CLIENT_GO_QPS
-              value: "5"
-            - name: CLIENT_GO_BURST
-              value: "10"
-            - name: LOG_LEVEL
-              value: "info"
-            - name: EPHEMERAL_STORAGE_POD_USAGE
-              value: "true"
-            - name: EPHEMERAL_STORAGE_NODE_AVAILABLE
-              value: "true"
-            - name: EPHEMERAL_STORAGE_NODE_CAPACITY
-              value: "true"
-            - name: EPHEMERAL_STORAGE_NODE_PERCENTAGE
-              value: "true"
-            - name: EPHEMERAL_STORAGE_CONTAINER_LIMIT_PERCENTAGE
-              value: "true"
-            - name: EPHEMERAL_STORAGE_CONTAINER_VOLUME_USAGE
-              value: "true"
-            - name: EPHEMERAL_STORAGE_CONTAINER_VOLUME_LIMITS_PERCENTAGE
-              value: "true"
-            - name: EPHEMERAL_STORAGE_INODES
-              value: "true"

manifests/monitoring/kube-state-metrics.yaml

@@ -201,7 +201,6 @@ spec:
       labels:
         app.kubernetes.io/name: kube-state-metrics
     spec:
-      priorityClassName: system-cluster-critical
       serviceAccountName: kube-state-metrics
       securityContext:
         fsGroup: 65534
@@ -238,7 +237,7 @@ spec:
         - --resources=validatingwebhookconfigurations
         #- --resources=volumeattachments
         imagePullPolicy: IfNotPresent
-        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0@sha256:42cfe3723a5f058171c627537fb57a3ea0f26e4380fa18555a95cb1a1b4cfc5b"
+        image: "registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0"
         ports:
         - containerPort: 8080
         livenessProbe:

manifests/monitoring/node-exporter.yaml

@@ -51,11 +51,10 @@ spec:
         app.kubernetes.io/name: prometheus
         app.kubernetes.io/component: node-exporter
     spec:
-      priorityClassName: system-node-critical
       serviceAccountName: prometheus-node-exporter
       containers:
         - name: prometheus-node-exporter
-          image: "prom/node-exporter:v1.12.1@sha256:1b4e4438faca4dd7e001dd445d161a4a2091b0fededa84093b3a8dfeae1f1be0"
+          image: "prom/node-exporter:v1.9.0"
           imagePullPolicy: "IfNotPresent"
           args:
             - --path.procfs=/host/proc

manifests/monitoring/promtail.yaml

@@ -212,11 +212,10 @@ spec:
         prometheus.io/port: http-metrics
         prometheus.io/scrape: "true"
     spec:
-      priorityClassName: system-node-critical
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:2.9.17@sha256:b28495fdab552b183428c5b5cebbf258231fc5f00be7724be2bc091ad21ac390"
+          image: "grafana/promtail:2.9.12"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/monitoring/vmagent.yaml

@@ -17,11 +17,6 @@ data:
     - job_name: 'vmagent'
       static_configs:
         - targets: ['localhost:8429']
-      relabel_configs:
-      - action: drop
-        source_labels: [__name__]
-        regex: "flag"
-
     - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
       job_name: kubernetes-nodes
       kubernetes_sd_configs:
@@ -41,38 +36,6 @@ data:
         ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
         insecure_skip_verify: true
 
-    - job_name: cadvisor
-      bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-      scheme: https
-      tls_config:
-        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-        insecure_skip_verify: true
-      kubernetes_sd_configs:
-      - role: node
-      relabel_configs:
-      - action: labelmap
-        regex: __meta_kubernetes_node_label_(.+)
-      - replacement: kubernetes.default.svc:443
-        target_label: __address__
-      - source_labels: [__meta_kubernetes_node_name]
-        regex: (.+)
-        target_label: __metrics_path__
-        replacement: /api/v1/nodes/$1/proxy/metrics/cadvisor
-      # Drop high cardinality labels
-      - action: labeldrop
-        regex: id
-      # Drop unneeded labels
-      - action: labeldrop
-        regex: beta_kubernetes_io_os
-      - action: labeldrop
-        regex: beta_kubernetes_io_arch
-      - action: labeldrop
-        regex: kubernetes_io_arch
-      - action: labeldrop
-        regex: kubernetes_io_os
-      - action: labeldrop
-        regex: topology_jiva_openebs_io_nodeName
-
     - job_name: kubernetes-service-endpoints
       kubernetes_sd_configs:
       - role: endpoints
@@ -115,21 +78,6 @@ data:
         source_labels:
         - __meta_kubernetes_pod_node_name
         target_label: kubernetes_node
-      # We don't care about the flag metrics from VM
-      - action: drop
-        source_labels: [__name__]
-        regex: "flag"
-      # Drop unneeded labels
-      - action: labeldrop
-        regex: beta_kubernetes_io_os
-      - action: labeldrop
-        regex: beta_kubernetes_io_arch
-      - action: labeldrop
-        regex: kubernetes_io_arch
-      - action: labeldrop
-        regex: kubernetes_io_os
-      - action: labeldrop
-        regex: topology_jiva_openebs_io_nodeName
 
     - job_name: kubernetes-pods
       kubernetes_sd_configs:
@@ -168,17 +116,6 @@ data:
         regex: Pending|Succeeded|Failed
         source_labels:
         - __meta_kubernetes_pod_phase
-      # Drop unneeded labels
-      - action: labeldrop
-        regex: beta_kubernetes_io_os
-      - action: labeldrop
-        regex: beta_kubernetes_io_arch
-      - action: labeldrop
-        regex: kubernetes_io_arch
-      - action: labeldrop
-        regex: kubernetes_io_os
-      - action: labeldrop
-        regex: topology_jiva_openebs_io_nodeName
 
     - job_name: 'node-exporter'
       kubernetes_sd_configs:
@@ -213,11 +150,10 @@ spec:
         app.kubernetes.io/name: victoria-metrics
         app.kubernetes.io/component: agent
     spec:
-      priorityClassName: system-cluster-critical
       serviceAccountName: prometheus-server
       containers:
         - name: vmagent
-          image: "victoriametrics/vmagent:v1.155.0@sha256:8e3c03905be15bba8312d4868e8ae6f9fc2fefee0a41d544472034249ca42bb4"
+          image: "victoriametrics/vmagent:v1.112.0"
           imagePullPolicy: "IfNotPresent"
           args:
             - -remoteWrite.url=http://vmcluster.auth-proxy.svc/insert/0/prometheus/

manifests/nextcloud_chart/manifest.yaml

@@ -56,9 +56,7 @@ data:
   general.config.php: |-
     <?php
     $CONFIG = array (
-        'overwriteprotocol' => 'https',
-        'loglevel' => 1,
-        'log_rotate_size' => 100 * 1024 * 1024
+        'overwriteprotocol' => 'https'
     );
   .htaccess: |-
     # line below if for Apache 2.4
@@ -203,10 +201,9 @@ spec:
         app.kubernetes.io/component: app
         nextcloud-nextcloud-redis-client: "true"
     spec:
-      priorityClassName: critical
       containers:
       - name: nextcloud
-        image: "nextcloud:35.0.2-apache@sha256:0347adaf2fa460aa9589f8c2b1ed246788d11a72ad9918d55ca288f3137fe5ca"
+        image: "nextcloud:31.0.0-apache"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -285,102 +282,7 @@ spec:
           periodSeconds: 10
         resources:
           requests:
-            cpu: 1038m
-            memory: 500M
-          limits:
-            cpu: 1200m
-            memory: 765M
-        volumeMounts:
-        - name: nextcloud-data
-          mountPath: /var/www/
-          subPath: root
-        - name: nextcloud-data
-          mountPath: /var/www/html
-          subPath: html
-        - name: nextcloud-data
-          mountPath: /var/www/html/data
-          subPath: data
-        - name: nextcloud-data
-          mountPath: /var/www/html/config
-          subPath: config
-        - name: nextcloud-data
-          mountPath: /var/www/html/custom_apps
-          subPath: custom_apps
-        - name: nextcloud-data
-          mountPath: /var/www/tmp
-          subPath: tmp
-        - name: nextcloud-data
-          mountPath: /var/www/html/themes
-          subPath: themes
-        - name: nextcloud-config
-          mountPath: /var/www/html/config/general.config.php
-          subPath: general.config.php
-        - name: nextcloud-s3
-          mountPath: /var/www/html/config/s3.config.php
-          subPath: s3.config.php
-        - name: nextcloud-config
-          mountPath: /var/www/html/config/.htaccess
-          subPath: .htaccess
-        - name: nextcloud-config
-          mountPath: /var/www/html/config/apache-pretty-urls.config.php
-          subPath: apache-pretty-urls.config.php
-        - name: nextcloud-config
-          mountPath: /var/www/html/config/apcu.config.php
-          subPath: apcu.config.php
-        - name: nextcloud-config
-          mountPath: /var/www/html/config/apps.config.php
-          subPath: apps.config.php
-        - name: nextcloud-config
-          mountPath: /var/www/html/config/autoconfig.php
-          subPath: autoconfig.php
-        - name: nextcloud-config
-          mountPath: /var/www/html/config/redis.config.php
-          subPath: redis.config.php
-        - name: nextcloud-config
-          mountPath: /var/www/html/config/smtp.config.php
-          subPath: smtp.config.php
-      - name: cron
-        image: "nextcloud:35.0.2-apache@sha256:0347adaf2fa460aa9589f8c2b1ed246788d11a72ad9918d55ca288f3137fe5ca"
-        imagePullPolicy: IfNotPresent
-        command:
-          - /cron.sh
-        env:
-          - name: SQLITE_DATABASE
-            value: "nextcloud"
-          - name: NEXTCLOUD_ADMIN_USER
-            valueFrom:
-              secretKeyRef:
-                name: nextcloud-nextcloud
-                key: nextcloud-username
-          - name: NEXTCLOUD_ADMIN_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: nextcloud-nextcloud
-                key: nextcloud-password
-          - name: NEXTCLOUD_TRUSTED_DOMAINS
-            value: nextcloud.cluster.fun
-          - name: NEXTCLOUD_DATA_DIR
-            value: "/var/www/html/data"
-          - name: REDIS_HOST
-            valueFrom:
-              secretKeyRef:
-                name: nextcloud-nextcloud-redis
-                key: redis-host
-          - name: REDIS_PORT
-            valueFrom:
-              secretKeyRef:
-                name: nextcloud-nextcloud-redis
-                key: redis-port
-          - name: REDIS_HOST_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: nextcloud-nextcloud-redis
-                key: redis-password
-          - name: REDIS_DB_INDEX
-            valueFrom:
-              secretKeyRef:
-                name: nextcloud-nextcloud-redis
-                key: redis-db-index
+            memory: 450Mi
         volumeMounts:
         - name: nextcloud-data
           mountPath: /var/www/
@@ -444,6 +346,45 @@ spec:
       securityContext:
         fsGroup: 33
 ---
+# Source: nextcloud/templates/cronjob.yaml
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: nextcloud-nextcloud-cron
+  labels:
+    app.kubernetes.io/name: nextcloud
+    app.kubernetes.io/instance: nextcloud-nextcloud
+  annotations:
+    {}
+spec:
+  schedule: "*/5 * * * *"
+  concurrencyPolicy: Forbid
+  failedJobsHistoryLimit: 5
+  successfulJobsHistoryLimit: 2
+  jobTemplate:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nextcloud
+    spec:
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: nextcloud
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: nextcloud
+              image: "nextcloud:31.0.0-apache"
+              imagePullPolicy: IfNotPresent
+              command: [ "curl" ]
+              args:
+                - "--fail"
+                - "-L"
+                - "https://nextcloud.cluster.fun/cron.php"
+              resources:
+                requests:
+                  memory: 200Mi
+---
 # Source: nextcloud/templates/ingress.yaml
 apiVersion: networking.k8s.io/v1
 kind: Ingress

manifests/nginx-lb/nginx-lb.yaml

@@ -15,6 +15,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
   namespace: ingress-nginx
 ---
@@ -26,6 +27,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
   namespace: ingress-nginx
 ---
@@ -37,6 +39,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
   namespace: ingress-nginx
 rules:
@@ -141,6 +144,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
   namespace: ingress-nginx
 rules:
@@ -159,6 +163,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
 rules:
 - apiGroups:
@@ -240,6 +245,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
 rules:
 - apiGroups:
@@ -258,6 +264,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
   namespace: ingress-nginx
 roleRef:
@@ -277,6 +284,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
   namespace: ingress-nginx
 roleRef:
@@ -295,6 +303,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -313,6 +322,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-admission
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -325,7 +335,6 @@ subjects:
 ---
 apiVersion: v1
 data:
-  annotations-risk-level: Critical
   allow-snippet-annotations: "true"
   use-proxy-protocol: "true"
   log-format-upstream: '{"time": "$time_iso8601", "request_id": "$req_id", "remote_user": "$remote_user", "remote_addr_masked": "$remote_addr_masked", "bytes_sent": $bytes_sent, "request_time": $request_time, "status": $status, "host": "$host", "request_proto": "$server_protocol", "path": "$uri", "request_query": "$args", "request_length": $request_length, "duration": $request_time,"method": "$request_method", "http_referrer": "$http_referer", "http_user_agent": "$http_user_agent", "redirect_location": "$redirect_location" }'
@@ -360,6 +369,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-controller
   namespace: ingress-nginx
 ---
@@ -395,6 +405,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-controller
   namespace: ingress-nginx
 spec:
@@ -427,6 +438,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-controller-admission
   namespace: ingress-nginx
 spec:
@@ -449,6 +461,7 @@ metadata:
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.5.1
   name: ingress-nginx-controller
   namespace: ingress-nginx
 spec:
@@ -492,7 +505,7 @@ spec:
               fieldPath: metadata.namespace
         - name: LD_PRELOAD
           value: /usr/local/lib/libmimalloc.so
-        image: registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1
+        image: registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
@@ -533,7 +546,7 @@ spec:
         resources:
           requests:
             cpu: 100m
-            memory: 150Mi
+            memory: 90Mi
         securityContext:
           allowPrivilegeEscalation: true
           capabilities:
@@ -702,20 +715,3 @@ webhooks:
     resources:
     - ingresses
   sideEffects: None
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  labels:
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/part-of: ingress-nginx
-  name: ingress-nginx
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: controller
-      app.kubernetes.io/instance: ingress-nginx
-      app.kubernetes.io/name: ingress-nginx
-  minAvailable: 1

manifests/nodered/nodered.yaml

@@ -44,7 +44,7 @@ spec:
         fsGroup: 1000
       initContainers:
       - name: config-copy
-        image: bash:latest@sha256:ab2ada570d744f42f517986fdd3c81ef60fe2054ed0c5295a7922e3b0ccd1b02
+        image: bash:latest
         imagePullPolicy: IfNotPresent
         args:
           - -c
@@ -57,7 +57,7 @@ spec:
           - name: data
             mountPath: /data
       - name: update-native-modules
-        image: nodered/node-red:4.1.17-18@sha256:161239fa8c3ebc2e6c5c831eb536960d4bdec677c7117a738d89a106cc2755a6
+        image: nodered/node-red:4.0.9-18
         imagePullPolicy: IfNotPresent
         command:
           - bash
@@ -73,16 +73,11 @@ spec:
             mountPath: /data
       containers:
       - name: web
-        image: nodered/node-red:4.1.17-18@sha256:161239fa8c3ebc2e6c5c831eb536960d4bdec677c7117a738d89a106cc2755a6
+        image: nodered/node-red:4.0.9-18
         imagePullPolicy: Always
         ports:
         - containerPort: 1880
           name: web
-        resources:
-          requests:
-            memory: 200M
-          limits:
-            memory: 200M
         volumeMounts:
           - name: data
             mountPath: /data

manifests/opengraph/opengraph.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/opengraph-image-gen:latest@sha256:97aea61e4db1e6d441fdfecd28f614b1e5342bfacd3a5ca6021ffca5c03db833
+        image: rg.fr-par.scw.cloud/averagemarcus/opengraph-image-gen:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 3000
@@ -47,10 +47,11 @@ metadata:
   namespace: opengraph
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - opengraph.cluster.fun

manifests/outline/outline.yaml

@@ -43,10 +43,9 @@ spec:
       labels:
         app.kubernetes.io/name: outline
     spec:
-      priorityClassName: critical
       containers:
       - name: outline
-        image: outlinewiki/outline:1.12.0@sha256:25d6a2ced2f1f0cf03c09abd776d87ba31941ed96d3a99992aa84b3bd0afc074
+        image: outlinewiki/outline:0.82.0
         imagePullPolicy: IfNotPresent
         env:
         - name: ALLOWED_DOMAINS
@@ -73,9 +72,7 @@ spec:
         resources:
           requests:
             cpu: 8m
-            memory: 900Mi
-          limits:
-            memory: 1489Mi
+            memory: 800Mi
         volumeMounts:
           - mountPath: /opt/outline/.env
             subPath: .env

manifests/pairdrop/pairdrop.yaml

@@ -1,88 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: pairdrop
-  namespace: pairdrop
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    targetPort: web
-    name: web
-  selector:
-    app: pairdrop
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pairdrop
-  namespace: pairdrop
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pairdrop
-  template:
-    metadata:
-      labels:
-        app: pairdrop
-    spec:
-      imagePullSecrets:
-        - name: docker-config
-      priorityClassName: low
-      containers:
-      - name: web
-        image: ghcr.io/schlagmichdoch/pairdrop:v1.11.2@sha256:c4b30977264a76e335740089e693a52a0d0d616330dec7f93c7b96beef7b4a02
-        imagePullPolicy: IfNotPresent
-        ports:
-        - containerPort: 3000
-          name: web
-        env:
-        - name: RATE_LIMIT
-          value: "1"
-        - name: DONATION_BUTTON_ACTIVE
-          value: "false"
-        - name: TWITTER_BUTTON_ACTIVE
-          value: "false"
-        - name: MASTODON_BUTTON_ACTIVE
-          value: "false"
-        - name: BLUESKY_BUTTON_ACTIVE
-          value: "false"
-        - name: PRIVACYPOLICY_BUTTON_ACTIVE
-          value: "false"
-        resources:
-          limits:
-            memory: 100Mi
-          requests:
-            memory: 100Mi
-        livenessProbe:
-          httpGet:
-            path: /
-            port: web
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: pairdrop
-  namespace: pairdrop
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - drop.cluster.fun
-    secretName: pairdrop-ingress
-  rules:
-  - host: drop.cluster.fun
-    http:
-      paths:
-      - path: /
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: pairdrop
-            port:
-              number: 80

manifests/planning-poker/planning-poker.yaml

@@ -1,111 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: planning-poker
-  namespace: planning-poker
-  labels:
-    app.kubernetes.io/name: planning-poker
----
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: planning-poker-data
-  namespace: planning-poker
-  labels:
-    app.kubernetes.io/name: planning-poker
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
-  storageClassName: "sbs-default-retain"
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: planning-poker
-  namespace: planning-poker
-  labels:
-    app.kubernetes.io/name: planning-poker
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: web
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/name: planning-poker
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: planning-poker
-  namespace: planning-poker
-  labels:
-    app.kubernetes.io/name: planning-poker
-  annotations:
-    secret.reloader.stakater.com/reload: "planning-poker"
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: planning-poker
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: planning-poker
-    spec:
-      serviceAccountName: planning-poker
-      priorityClassName: critical
-      containers:
-        - name: planning-poker
-          image: ghcr.io/axeleroy/self-host-planning-poker:1.2.1@sha256:0253f17c07f6c484b6fbef65867863541494e063355d39757ca27963404864d4
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: web
-              containerPort: 8000
-              protocol: TCP
-          livenessProbe:
-            tcpSocket:
-              port: web
-          readinessProbe:
-            tcpSocket:
-              port: web
-          volumeMounts:
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: planning-poker-data
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: planning-poker
-  namespace: planning-poker
-  labels:
-    app.kubernetes.io/name: planning-poker
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - planning-poker.cluster.fun
-    secretName: planning-poker-ingress
-  rules:
-    - host: "planning-poker.cluster.fun"
-      http:
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: planning-poker
-                port:
-                  number: 80

manifests/priority-classes/critical.yaml

@@ -1,7 +0,0 @@
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: critical
-value: 1000
-globalDefault: false
-preemptionPolicy: PreemptLowerPriority

manifests/priority-classes/low.yaml

@@ -1,7 +0,0 @@
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: low
-value: 10
-globalDefault: false
-preemptionPolicy: Never

manifests/priority-classes/normal.yaml

@@ -1,7 +0,0 @@
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: normal
-value: 100
-globalDefault: true
-preemptionPolicy: PreemptLowerPriority

manifests/proxy-civo/non-auth-proxy.yaml

@@ -0,0 +1,149 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: tailscale-auth
+  namespace: proxy-civo
+  annotations:
+    kube-1password: 2cqycmsgv5r7vcyvjpblcl2l4y
+    kube-1password/vault: Kubernetes
+type: Opaque
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: host-mappings
+  namespace: proxy-civo
+  labels:
+    app: proxy
+data:
+  mapping.json: |
+    {
+      "vmcluster.proxy-civo.svc": "vmcluster.cluster.local",
+      "loki.proxy-civo.svc": "loki-write.cluster.local",
+      "loki.proxy-civo.svc:80": "loki-write.cluster.local",
+      "loki-distributed.proxy-civo.svc": "loki-loki.cluster.local",
+      "loki-distributed.proxy-civo.svc:80": "loki-loki.cluster.local"
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: internal-proxy
+  namespace: proxy-civo
+  labels:
+    app: internal-proxy
+  annotations:
+    configmap.reloader.stakater.com/reload: "host-mappings"
+    secret.reloader.stakater.com/reload: "tailscale-auth"
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: internal-proxy
+  template:
+    metadata:
+      labels:
+        app: internal-proxy
+    spec:
+      serviceAccountName: default
+      dnsPolicy: ClusterFirst
+      dnsConfig:
+        nameservers:
+          - 100.100.100.100
+      containers:
+      - name: proxy
+        image: rg.fr-par.scw.cloud/averagemarcus/proxy:latest
+        imagePullPolicy: Always
+        env:
+        - name: PROXY_DESTINATION
+          value: talos.tail4dfb.ts.net
+        - name: PORT
+          value: "8080"
+        - name: TS_AUTH_KEY
+          valueFrom:
+            secretKeyRef:
+              name: tailscale-auth
+              key: password
+        - name: TS_HOSTNAME
+          value: proxy-civo-internal-proxy
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        volumeMounts:
+        - name: host-mappings
+          mountPath: /config/
+      volumes:
+      - name: host-mappings
+        configMap:
+          name: host-mappings
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: loki
+  namespace: proxy-civo
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: loki-distributed
+  namespace: proxy-civo
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: prometheus
+  namespace: proxy-civo
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vmcluster
+  namespace: proxy-civo
+  labels:
+    app: internal-proxy
+spec:
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    app: internal-proxy
+  type: ClusterIP
+---

manifests/qr/qr.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/qr:latest@sha256:e98db60ab26d5769bc5b17384fcb10d98e71b353fc23d154d5049fd88bab00eb
+        image: rg.fr-par.scw.cloud/averagemarcus/qr:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -47,10 +47,11 @@ metadata:
   namespace: qr
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - qr.cluster.fun

manifests/redis/redis.yaml

@@ -327,10 +327,9 @@ spec:
               weight: 1
         nodeAffinity:
       terminationGracePeriodSeconds: 30
-      priorityClassName: critical
       containers:
         - name: redis
-          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11@sha256:c81b0644726b22fa65669b427610701e86dceb0007438f5d75d271b3197a48bf
+          image: docker.io/bitnami/redis:7.2.4-debian-11-r11
           imagePullPolicy: "IfNotPresent"
           securityContext:
             runAsUser: 1001
@@ -472,7 +471,7 @@ spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: redis
-          image: docker.io/bitnamilegacy/redis:7.2.4-debian-11-r11@sha256:c81b0644726b22fa65669b427610701e86dceb0007438f5d75d271b3197a48bf
+          image: docker.io/bitnami/redis:7.2.4-debian-11-r11
           imagePullPolicy: "IfNotPresent"
           securityContext:
             runAsUser: 1001

manifests/rss/miniflux.yaml

@@ -25,8 +25,6 @@ data:
   POLLING_FREQUENCY: "15"
   BASE_URL: "https://miniflux.cluster.fun/"
   METRICS_COLLECTOR: "1"
-  CLEANUP_ARCHIVE_READ_DAYS: "365"
-  CLEANUP_ARCHIVE_UNREAD_DAYS: "365"
 ---
 apiVersion: v1
 kind: Service
@@ -68,7 +66,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: ghcr.io/miniflux/miniflux:2.3.4@sha256:72e49f513a63104506aab98ba8cfc3a409d4fde23550a583dec07ec941f1e94e
+        image: ghcr.io/miniflux/miniflux:2.2.6
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/social-to-grist/social-to-grist.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: docker-config
-  namespace: social-to-rolodex
+  namespace: social-to-grist
   annotations:
     kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
     kube-1password/vault: Kubernetes
@@ -14,8 +14,8 @@ data:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: social-to-rolodex-auth
-  namespace: social-to-rolodex
+  name: social-to-grist-auth
+  namespace: social-to-grist
   annotations:
     kube-1password: mr6spkkx7n3memkbute6ojaarm
     kube-1password/vault: Kubernetes
@@ -24,8 +24,8 @@ type: Opaque
 apiVersion: v1
 kind: Secret
 metadata:
-  name: social-to-rolodex
-  namespace: social-to-rolodex
+  name: social-to-grist
+  namespace: social-to-grist
   annotations:
     kube-1password: oa3ycnui3ji4lc665bifaao63q
     kube-1password/vault: Kubernetes
@@ -35,8 +35,8 @@ type: Opaque
 apiVersion: v1
 kind: Service
 metadata:
-  name: social-to-rolodex
-  namespace: social-to-rolodex
+  name: social-to-grist
+  namespace: social-to-grist
 spec:
   type: ClusterIP
   ports:
@@ -44,22 +44,22 @@ spec:
     targetPort: auth
     name: web
   selector:
-    app: social-to-rolodex
+    app: social-to-grist
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: social-to-rolodex
-  namespace: social-to-rolodex
+  name: social-to-grist
+  namespace: social-to-grist
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: social-to-rolodex
+      app: social-to-grist
   template:
     metadata:
       labels:
-        app: social-to-rolodex
+        app: social-to-grist
     spec:
       imagePullSecrets:
         - name: docker-config
@@ -70,7 +70,7 @@ spec:
         - --provider-display-name=Auth0
         - --upstream=http://localhost:8080
         - --http-address=$(HOST_IP):8000
-        - --redirect-url=https://social-to-rolodex.cluster.fun/oauth2/callback
+        - --redirect-url=https://social-to-grist.cluster.fun/oauth2/callback
         - --email-domain=marcusnoble.co.uk
         - --pass-basic-auth=false
         - --pass-access-token=false
@@ -86,13 +86,13 @@ spec:
           valueFrom:
             secretKeyRef:
               key: username
-              name: social-to-rolodex-auth
+              name: social-to-grist-auth
         - name: OAUTH2_PROXY_CLIENT_SECRET
           valueFrom:
             secretKeyRef:
               key: password
-              name: social-to-rolodex-auth
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+              name: social-to-grist-auth
+        image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1
         name: oauth-proxy
         ports:
         - containerPort: 8000
@@ -104,14 +104,14 @@ spec:
           requests:
             memory: 50Mi
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus-private/social-to-rolodex:latest
+        image: rg.fr-par.scw.cloud/averagemarcus-private/social-to-grist:latest
         imagePullPolicy: Always
         env:
         - name: PORT
           value: "8080"
         envFrom:
         - secretRef:
-            name: "social-to-rolodex"
+            name: "social-to-grist"
         ports:
         - containerPort: 8080
           name: web
@@ -125,26 +125,27 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: social-to-rolodex
-  namespace: social-to-rolodex
+  name: social-to-grist
+  namespace: social-to-grist
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
-    - social-to-rolodex.cluster.fun
-    secretName: social-to-rolodex-ingress
+    - social-to-grist.cluster.fun
+    secretName: social-to-grist-ingress
   rules:
-  - host: social-to-rolodex.cluster.fun
+  - host: social-to-grist.cluster.fun
     http:
       paths:
       - path: /
         pathType: ImplementationSpecific
         backend:
           service:
-            name: social-to-rolodex
+            name: social-to-grist
             port:
               number: 80

manifests/sre-agent/sre-agent.yaml

@@ -1,131 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: sre-agent
-  namespace: default
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: sre-agent
-  namespace: default
-  annotations:
-    kubernetes.io/service-account.name: sre-agent
-type: kubernetes.io/service-account-token
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: sre-agent
-  labels:
-    app.kubernetes.io/name: sre-agent
-rules:
-  # Node-level diagnostics
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["nodes/proxy", "nodes/metrics", "nodes/stats"]
-    verbs: ["get", "list"]
-
-  # Pod diagnostics
-  - apiGroups: [""]
-    resources: ["pods", "pods/log", "pods/status", "pods/ephemeralcontainers"]
-    verbs: ["get", "list", "watch"]
-
-  # Services, endpoints, networking
-  - apiGroups: [""]
-    resources: ["services", "endpoints", "endpointslices", "namespaces"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims", "persistentvolumes"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: [""]
-    resources: ["configmaps", "secrets"]
-    verbs: ["get", "list"]    # readable only, no modify/delete
-  - apiGroups: [""]
-    resources: ["resourcequotas", "limitranges"]
-    verbs: ["get", "list"]
-
-  # Network policies
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["discovery.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-
-  # Workloads
-  - apiGroups: ["apps"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources: ["deployments/scale", "replicasets/scale"]
-    verbs: ["get"]
-
-  # Jobs & cronjobs
-  - apiGroups: ["batch"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["batch"]
-    resources: ["jobs/log"]
-    verbs: ["get", "list"]
-
-  # Autoscaling
-  - apiGroups: ["autoscaling"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-
-  # RBAC visibility (diagnose who owns what)
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-
-  # Custom Resource Definitions (so we can inspect custom resources)
-  - apiGroups: ["apiextensions.k8s.io"]
-    resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch"]
-
-  # Priority classes
-  - apiGroups: ["scheduling.k8s.io"]
-    resources: ["priorityclasses"]
-    verbs: ["get", "list"]
-
-  # Certificate rotation
-  - apiGroups: ["certificates.k8s.io"]
-    resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
-    verbs: ["get", "list", "watch"]
-
-  # Metrics Server (if installed)
-  - apiGroups: ["metrics.k8s.io"]
-    resources: ["*"]
-    verbs: ["get", "list"]
-
-  # Admission controllers / pod security (diagnostic)
-  - apiGroups: ["policy"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch"]
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: sre-agent-binding
-  labels:
-    app.kubernetes.io/name: sre-agent
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: sre-agent
-subjects:
-  - kind: ServiceAccount
-    name: sre-agent
-    namespace: default

manifests/starling/starling.yaml

@@ -0,0 +1,106 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: docker-config
+  namespace: starling
+  annotations:
+    kube-1password: i6ngbk5zf4k52xgwdwnfup5bby
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-key: .dockerconfigjson
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: e30=
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: starling
+  namespace: starling
+  annotations:
+    kube-1password: ufxpki65ffgprn2upksirweeie
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: starling
+  namespace: starling
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: starling
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: starling
+  namespace: starling
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: starling
+  template:
+    metadata:
+      labels:
+        app: starling
+    spec:
+      imagePullSecrets:
+        - name: docker-config
+      containers:
+      - name: web
+        image: rg.fr-par.scw.cloud/averagemarcus-private/starling:latest
+        imagePullPolicy: Always
+        env:
+        - name: PORT
+          value: "3000"
+        - name: SHARED_SECRET
+          valueFrom:  
+            secretKeyRef:
+              name: starling
+              key: SHARED_SECRET
+        - name: ACCESS_TOKEN
+          valueFrom:  
+            secretKeyRef:
+              name: starling
+              key: ACCESS_TOKEN
+        ports:
+        - containerPort: 3000
+          name: web
+        resources:
+          limits:
+            memory: 50Mi
+          requests:
+            memory: 50Mi
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: starling
+  namespace: starling
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - starling.marcusnoble.co.uk
+    secretName: starling-ingress
+  rules:
+  - host: starling.marcusnoble.co.uk
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: starling
+            port:
+              number: 80

manifests/svg-to-dxf/svg-to-dxf.yaml

@@ -27,10 +27,9 @@ spec:
       labels:
         app: svg-to-dxf
     spec:
-      priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/svg-to-dxf:latest@sha256:7e74cd6569ed68d46b012ffbd672be9e4c6422b28fb13eb5d83b2c1dc85e9cb9
+        image: rg.fr-par.scw.cloud/averagemarcus/svg-to-dxf:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -46,11 +45,14 @@ metadata:
   namespace: svg-to-dxf
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/buffering: |
+      maxrequestbodybytes: 31457280
+      memrequestbodybytes: 62914560
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - svg-to-dxf.cluster.fun

manifests/talks/talks.yaml

@@ -1,3 +1,45 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: talks
+  namespace: talks
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+    name: web
+  selector:
+    app: talks
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: talks
+  namespace: talks
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: talks
+  template:
+    metadata:
+      labels:
+        app: talks
+    spec:
+      containers:
+      - name: web
+        image: rg.fr-par.scw.cloud/averagemarcus/talks:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: web
+        resources:
+          limits:
+            memory: 20Mi
+          requests:
+            memory: 20Mi
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -5,13 +47,24 @@ metadata:
   namespace: talks
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/permanent-redirect: https://speaking.marcusnoble.co.uk
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - talks.marcusnoble.co.uk
     secretName: talks-ingress
   rules:
   - host: talks.marcusnoble.co.uk
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: talks
+            port:
+              number: 80
+

manifests/tank/tank.yaml

@@ -0,0 +1,57 @@
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: tank
+  namespace: tank
+  annotations:
+    kube-1password: g6xle67quzowvvekf6zukjbbm4
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tank
+  namespace: tank
+spec:
+  type: ClusterIP
+  ports:
+  - port: 80
+    targetPort: web
+  selector:
+    app: tank
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tank
+  namespace: tank
+  labels:
+    app: tank
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tank
+  template:
+    metadata:
+      labels:
+        app: tank
+    spec:
+      containers:
+      - name: web
+        image: rg.fr-par.scw.cloud/averagemarcus/tank:latest
+        imagePullPolicy: Always
+        envFrom:
+          - secretRef:
+              name: tank
+        ports:
+        - containerPort: 3000
+          name: web
+        resources:
+          limits:
+            memory: 10Mi
+          requests:
+            memory: 10Mi

manifests/text-to-dxf/text-to-dxf.yaml

@@ -27,10 +27,9 @@ spec:
       labels:
         app: text-to-dxf
     spec:
-      priorityClassName: low
       containers:
       - name: web
-        image: rg.fr-par.scw.cloud/averagemarcus/text-to-dxf:latest@sha256:f1ce90feec0dae575979c7fa83b855ced939efe23d749cc2615f5d43a08cacb0
+        image: rg.fr-par.scw.cloud/averagemarcus/text-to-dxf:latest
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -46,10 +45,11 @@ metadata:
   namespace: text-to-dxf
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.tls: "true"
     ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  ingressClassName: nginx
   tls:
   - hosts:
     - text-to-dxf.cluster.fun