Update rancher/mirrored-library-traefik Docker tag to v3

manifests/_apps/vaultwarden.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vaultwarden
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: cluster.fun
+  destination:
+    namespace: vaultwarden
+    name: cluster-fun (v2)
+  source:
+    path: manifests/vaultwarden
+    repoURL: "https://git.cluster.fun/AverageMarcus/cluster.fun.git"
+    targetRevision: HEAD
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+  ignoreDifferences:
+  - kind: Secret
+    jsonPointers:
+    - /data
+

manifests/mealie/mealie.yaml

@@ -31,7 +31,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: frontend
-        image: ghcr.io/mealie-recipes/mealie:v3.28.0
+        image: ghcr.io/mealie-recipes/mealie:v3.27.0
         imagePullPolicy: Always
         envFrom:
         - secretRef:

manifests/monitoring/promtail.yaml

@@ -216,7 +216,7 @@ spec:
       serviceAccountName: promtail
       containers:
         - name: promtail
-          image: "grafana/promtail:3.6.11"
+          image: "grafana/promtail:2.9.17"
           imagePullPolicy: IfNotPresent
           args:
             - "-config.file=/etc/promtail/promtail.yaml"

manifests/nextcloud_chart/manifest.yaml

@@ -206,7 +206,7 @@ spec:
       priorityClassName: critical
       containers:
       - name: nextcloud
-        image: "nextcloud:35.0.1-apache"
+        image: "nextcloud:35.0.0-apache"
         imagePullPolicy: IfNotPresent
         env:
         - name: SQLITE_DATABASE
@@ -340,7 +340,7 @@ spec:
           mountPath: /var/www/html/config/smtp.config.php
           subPath: smtp.config.php
       - name: cron
-        image: "nextcloud:35.0.1-apache"
+        image: "nextcloud:35.0.0-apache"
         imagePullPolicy: IfNotPresent
         command:
           - /cron.sh

manifests/traefik/traefik.yaml

@@ -45,7 +45,7 @@ spec:
         - --entrypoints.websecure.http.tls=true
         - --entrypoints.web.http.redirections.entrypoint.to=websecure
         - --entrypoints.web.http.redirections.entrypoint.scheme=https
-        image: rancher/mirrored-library-traefik:2.11.50
+        image: rancher/mirrored-library-traefik:3.7.13
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

manifests/trek/trek.yaml

@@ -58,7 +58,7 @@ spec:
     spec:
       containers:
       - name: trek
-        image: mauriceboe/trek:4.3.2
+        image: mauriceboe/trek:4.3.0
         imagePullPolicy: IfNotPresent
         envFrom:
         - configMapRef:

manifests/vaultwarden/README.md

@@ -0,0 +1,5 @@
+# vaultwarden
+
+Note: There's a catch-22 when deploying this in that the Secrets can't be pulled from Vaultwarden as that are needed _for_ Vaultwarden. These need to be manually populated for this to work.
+
+During migration, secrets are still pulled from 1Password.

manifests/vaultwarden/config.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vaultwarden-credentials
+  labels:
+    app: vaultwarden
+    app.kubernetes.io/name: vaultwarden
+  annotations:
+    kube-1password: e75k7oktk43v4mmvbs24vyelwy
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vaultwarden-smtp
+  labels:
+    app: vaultwarden
+    app.kubernetes.io/name: vaultwarden
+  annotations:
+    kube-1password: 3kiighdh7la4wdfiv5fzgm34yu
+    kube-1password/vault: Kubernetes
+    kube-1password/secret-text-parse: "true"
+type: Opaque
+
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vaultwarden-config
+  labels:
+    app: vaultwarden
+    app.kubernetes.io/name: vaultwarden
+data:
+  DOMAIN: "https://vault.cluster.fun"
+
+  # Signup Controls
+  SIGNUPS_ALLOWED: "false"
+  INVITATIONS_ALLOWED: "true"
+  INVITATION_ORG_NAME: "Noble"
+
+  # Security
+  SHOW_PASSWORD_HINT: "false"
+  EXTENDED_LOGGING: "true"
+  LOG_LEVEL: "info"
+  REQUIRE_DEVICE_EMAIL: "true"
+

manifests/vaultwarden/deployment.yaml

@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  labels:
+    app: vaultwarden
+    app.kubernetes.io/name: vaultwarden
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vaultwarden
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+        app.kubernetes.io/name: vaultwarden
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - vaultwarden
+              topologyKey: kubernetes.io/hostname
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: vaultwarden
+          image: vaultwarden/server:1.37.3-alpine
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          envFrom:
+          - configMapRef:
+              name: vaultwarden-config
+          - secretRef:
+              name: vaultwarden-credentials
+          - secretRef:
+              name: vaultwarden-smtp
+          volumeMounts:
+            - name: vaultwarden-data
+              mountPath: /data
+            - name: vaultwarden-attachments
+              mountPath: /data/attachments
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+      volumes:
+        - name: vaultwarden-data
+          persistentVolumeClaim:
+            claimName: vaultwarden-data
+        - name: vaultwarden-attachments
+          persistentVolumeClaim:
+            claimName: vaultwarden-attachments

manifests/vaultwarden/ingres.yaml

@@ -0,0 +1,37 @@
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden
+  labels:
+    app: vaultwarden
+    app.kubernetes.io/name: vaultwarden
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.2 TLSv1.3"
+    nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+    nginx.ingress.kubernetes.io/client-body-buffer-size: 25m
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-next-upstream: "300"
+    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "300"
+    nginx.ingress.kubernetes.io/limit-rps: "10"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - vault.cluster.fun
+    secretName: vaultwarden-ingress
+  rules:
+  - host: vault.cluster.fun
+    http:
+      paths:
+      - path: /
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: vaultwarden
+            port:
+              name: http

manifests/vaultwarden/pv.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-data
+  labels:
+    app: vaultwarden
+    app.kubernetes.io/name: vaultwarden
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: sbs-default-retain
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-attachments
+  labels:
+    app: vaultwarden
+    app.kubernetes.io/name: vaultwarden
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: sbs-default-retain

manifests/vaultwarden/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  labels:
+    app: vaultwarden
+    app.kubernetes.io/name: vaultwarden
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+  selector:
+    app: vaultwarden