chore(deps): update ghcr.io/fluxcd/notification-controller docker tag to v1.4.0

Reviewed-on: #37

.editorconfig

@@ -14,10 +14,6 @@ insert_final_newline = true
 indent_style = tab
 indent_size = 4
 
-[*.md]
-indent_size = 4
-trim_trailing_whitespace = false
-
 [{Dockerfile,*.bash,*.sh}]
 indent_style = space
 indent_size = 4

.gitea/workflows/kubernetes-linter.yml

@@ -0,0 +1,40 @@
+name: Check Kubernetes YAMLs
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "kubernetes/apps/production/**"
+  pull_request:
+    paths:
+      - "kubernetes/apps/production/**"
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23.1"
+
+      - name: Cache Go modules
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Install kube-linter
+        run: |
+          go install golang.stackrox.io/kube-linter/cmd/kube-linter@latest
+
+      - name: Scan yaml files with kube-linter
+        run: |
+          kube-linter lint ./kubernetes/apps/production --config kubelinter-config.yaml

.gitignore

@@ -1,2 +1,3 @@
 kubeconfig
 secrets.yaml
+talos-cluster

README.md

@@ -0,0 +1,73 @@
+<!-- PROJECT LOGO -->
+<br />
+<div align="center">
+  <a href="https://git.fascinated.cc/Fascinated/homelab">
+    <img src="images/logo.png" alt="Logo" width="80" height="80">
+  </a>
+
+<h3 align="center">Homelab</h3>
+  <p align="center">
+    Welcome to the configuration for my homelab.
+    <br />
+    <a href="https://git.fascinated.cc/Fascinated/home-ops/issues">Report Issue</a>
+    ·
+    <a href="https://git.fascinated.cc/Fascinated/home-ops/issues">Request Feature/Service</a>
+
+  </p>
+</div>
+
+### Infrastructure
+
+- [Kubernetes][k8s] - Isn't it obvious?
+- [Helm][helm] - Easily deploy and manage Kubernetes applications
+- [Traefik][traefik] - Web reverse proxy
+- [Cert Manager][cert-manager] - Generates LetsEncrypt certificates
+- [Metallb][metallb] - Load Balancer
+- [NFS][nfs] - Remote Storage for PVs
+- [FluxCD][fluxcd] - GitOps
+- [Spegel][spegel] - Local Docker registry cache
+- [Eraser][eraser] - Automated cleanup of old docker images
+
+### Services
+
+See [services](./kubernetes/apps/production/) for a list of services that I use in my homelab.
+
+<!-- TODO -->
+
+## Todo
+
+- [ ] Setup Grafana and Traefik metrics
+
+### Backlog
+
+- [ ] Add some kind of guides for how to use this
+
+See the [open issues](https://git.fascinated.cc/Fascinated/home-ops/issues) for a full list of proposed features (and known issues).
+
+<!-- CONTRIBUTING -->
+
+## Contributing
+
+Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are **greatly appreciated**.
+
+If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement".
+Don't forget to give the project a star! Thanks again!
+
+1. Fork the Project
+2. Create your Feature Branch (`git checkout -b feature/AmazingFeature`)
+3. Commit your Changes (`git commit -m 'Add some AmazingFeature'`)
+4. Push to the Branch (`git push origin feature/AmazingFeature`)
+5. Open a Pull Request
+
+<!-- MARKDOWN LINKS & IMAGES -->
+<!-- https://www.markdownguide.org/basic-syntax/#reference-style-links -->
+
+[fluxcd]: https://fluxcd.io/
+[k8s]: https://kubernetes.io/
+[helm]: https://helm.sh/
+[traefik]: https://traefik.io/
+[cert-manager]: https://cert-manager.io/
+[metallb]: https://metallb.org/
+[nfs]: https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner/
+[spegel]: https://github.com/spegel-org/spegel/
+[eraser]: https://github.com/eraser-dev/eraser/

TALOS.MD

@@ -19,7 +19,7 @@ talosctl gen config hl-cluster https://$CONTROL_PLANE_IP:6443 -o talos-cluster
 talosctl apply-config --insecure --nodes $CONTROL_PLANE_IP --file talos-cluster/controlplane.yaml
 ```
 
-# Setup worker(s)
+## Setup worker(s)
 
 ```bash
 talosctl apply-config --insecure --nodes $WORKER_IP --file talos-cluster/worker.yaml

apps/production/traefik/external-services/img.fascinated.cc.yml

@@ -1,30 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: img-proxy-external
-  namespace: traefik
-spec:
-  type: ExternalName
-  externalName: 10.0.50.185
-  ports:
-    - name: http
-      port: 8080
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: img-proxy-external-ingress
-  namespace: traefik
-  annotations:
-    kubernetes.io/ingress.class: traefik-external
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`img.fascinated.cc`)
-      kind: Rule
-      services:
-        - name: img-proxy-external
-          port: 8080
-  tls:
-    secretName: fascinated-cc

common/seal-secret.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# Function to seal a Kubernetes secret
+seal_secret() {
+    local input_file="$1"
+    if [[ -z "$input_file" ]]; then
+        echo "Usage: seal <path-to-secret-file>"
+        exit 1
+    fi
+
+    if [[ ! -f "$input_file" ]]; then
+        echo "Error: File '$input_file' does not exist."
+        exit 1
+    fi
+
+    local output_file="$(dirname "$input_file")/sealed-$(basename "$input_file")"
+
+    echo "Sealing secret from '$input_file'..."
+    kubeseal --format=yaml < "$input_file" > "$output_file"
+
+    if [[ $? -eq 0 ]]; then
+        echo "Success! Sealed secret created at '$output_file'"
+    else
+        echo "Error: Failed to seal the secret."
+        exit 1
+    fi
+}
+
+# Call the function with the provided argument
+seal_secret "$1"

kubelinter-config.yaml

@@ -0,0 +1,3 @@
+checks:
+  include: []
+  exclude: ["run-as-non-root", "no-read-only-root-fs"]

kubernetes/apps/disabled/drone/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: drone-ci
+resources:
+  - namespace.yaml
+  - ./server/sealed-secrets.yaml
+  - ./server/pvc.yaml
+  - ./server/server-deployment.yaml
+  - ./server/service.yaml
+  - ./server/ingress.yaml
+  - ./runner/runner-deployment.yaml
+  - ./runner/rbac.yaml

kubernetes/apps/disabled/drone/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: drone-ci
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/apps/disabled/drone/runner/rbac.yaml

@@ -0,0 +1,70 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: drone
+  namespace: drone-ci
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+      - pods/log
+    verbs:
+      - get
+      - create
+      - delete
+      - list
+      - watch
+      - update
+
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: drone
+  namespace: drone-ci
+subjects:
+  - kind: ServiceAccount
+    name: default
+    namespace: drone-ci
+roleRef:
+  kind: Role
+  name: drone
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: drone-deploy-sa
+  namespace: public-services
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: public-services
+  name: drone-deployment-manager
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "create", "update", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: drone-deployment-manager-binding
+  namespace: public-services
+subjects:
+  - kind: ServiceAccount
+    name: drone-deploy-sa
+    namespace: public-services
+roleRef:
+  kind: Role
+  name: drone-deployment-manager
+  apiGroup: rbac.authorization.k8s.io

kubernetes/apps/disabled/drone/runner/runner-deployment.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: drone-runner
+  namespace: drone-ci
+  labels:
+    app.kubernetes.io/name: drone
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: drone
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: drone
+    spec:
+      containers:
+        - name: runner
+          image: drone/drone-runner-kube:latest
+          ports:
+            - containerPort: 3000
+          resources:
+            requests:
+              cpu: 50m
+              memory: 75Mi
+            limits:
+              cpu: 100m
+              memory: 200Mi
+          env:
+            - name: DRONE_RPC_HOST
+              value: drone.fascinated.cc
+            - name: DRONE_RPC_PROTO
+              value: https
+            - name: DRONE_NAMESPACE_DEFAULT
+              value: drone-ci
+            - name: DRONE_RPC_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: DRONE_RPC_SECRET

kubernetes/apps/disabled/drone/server/ingress.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: drone-ci-ingress
+  namespace: drone-ci
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`drone.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: drone-service
+          port: 80
+  tls:
+    secretName: fascinated-cc

kubernetes/apps/disabled/drone/server/pvc.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: drone-pvc
+  namespace: drone-ci
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

kubernetes/apps/disabled/drone/server/sealed-secrets.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: drone-secret
+  namespace: drone-ci
+spec:
+  encryptedData:
+    DRONE_GITEA_CLIENT_ID: AgBvs/BRqipwanwhehkG+efGyDYwbvkaYkOSsoW6PCqiKx3GX7wFUnSEEljoTLn8qCx7GKGT73KBcK6ItwFisAlJwFHTC7DtgCSJzpHBwHvbCWs+QtKumHCtgnj2XCHGs8yt4o9I9KClGl6mqKFfWAWiDAoBcY6YHCM5l23jh/ipglT1jcRGm+dxouZ5QCCNjHSEN/SD0wVv4bCajRmZ7fwOrJ9lsJFhfhu6hvm0UsFggsrtOGavk0TzwzUoeZPvGM7LOhFk5qAFFdJAMucErcfKlEKcxfPd4V0rwJTNaSQqSL01iEQLSdgwQqsypJxKpKz5D2aByEiYHe4HvpFzm0KnwaOth7MO6gmnp7+mb008MyUL4KSdcj82z76YjD5S9uU3XaeuxlEWrAU1obGWNzFU5E8a9L0iJIoOhH33kwcYhUFjloZ3S2mL0gyl2EpZ3tIXlXpjr8B0WXC/bgWOk5kq+veIaM2+jeTge7iLXhS/8rtxAy7tUk22jEK9ecXT5zqlLrTIpcJz3UMpKTh5N397vIGfRNJ1DoRPCL/UHXWTleNBQTijhGWDb+JcT70makwroXYOLQorZXOVbRLWCC/b+i9Aq8yVNhyBUJy0SR1qhkO4tCgZ5/E5+mXFJvjkH64JYHCyFDI/KPjzefby2HSINjTR1AD5mW+KKOfINMCffFD7Zy90jcd9iViU9JE4coqBRPG4v1lmoGPv++fnJEC5ZNoWKy2FMTkf5rt0cPtuBSsP8CU=
+    DRONE_GITEA_CLIENT_SECRET: AgBBub2TZ2xb6oVxTVHWZkdiVMo9zFNUrYxL0Iw1YeUFgZmJjkk/CP6UCxlCJbnzOj+b//HbYn1w8sS3vzGK82be8GgfkgI4/hTHHll3GSjEbdaTn7xEL/XJrp+JyVvX7bQNPLCkTsaxIrz7dh7kHUvcgRxOoSsFKHj73hjf27lHa+Qa89fDO5Zb1PjUSeT4IlAHlUuQraKx0viAoy8uEX6OyX3lhX5Aa2NQkbLRYCd8T7+IW0lyKvwwOpOdVH/38G8eAVXmADdKuNyIoq9++bYnUMMFMBj6OdMp3xNyGcEkuKlMI9+DaT29tmOgvDiWog/E2Hg0IERh4z5Dr2p4oJyT7b1N1ynRiwfndLp2di9d+nrzG5STf9NRKOK8U+NWTRcXv4JRkKyIDAi0j4eoC9cVyKGe341A4os3kTg9dky0RL+Q7+NWCWUYFAXIkU5cRHgwW7LTkv96cduerVT8YF3sxvu4FlJgHDNKvNuxFAhPOCwoOozPX8JbhhlEPfxWZ0s9B7QgRdNm/GY6RxV0Dl7F+IhzSxA/PrMxYUzuhenW+K9bIJd5dR73NfTlxbTdt/tM7DpVb00DrHx2Y2BOME1H76AXrRr+MZdWz46XHBSh6yeTMf5D3PRU8SPDEqSUrODEnjlEnJCkjYoxLOYAjXa/5dyZnyxIpS4WDMIB0/aXde0CX83fJ9C5KM6P36kKUZL8VOiJ5HA4Fzz/45X0wjEOkccuIHElWzPzOcW5geLc4vZRNiJa5ydLoktnMObqf7Iy3Jxrlg3SGg==
+    DRONE_RPC_SECRET: AgA96+L9/gvS8PkIfwDBnpBcagdL+eE1wyTqvMnG2pIGMhy7li10yvra/B1ptsuBak1Aab7WNZvNR5zUf2b2QVEk9Rz0q7D0ZqVFP0U6JiILPJ6p61K0GC+Lh5MKI4yzFmYrT+hfk6HkKGy5dEtJ+JoY2aT6Mn26pIs3dEnKlIObxxR7rQzlKuV2yrkguHnhV38DCvsMkMYaF8G1IiwfDsHJ1JcwXjHlRtkl02v/Arc1sGZi/2lXZpqXMW3UFb2YGRGP6rgeXcsGeNslIkMJkJaUSZdI3HS0ufHwSbJJaiug370E/ZkHChpaABibAEImoblgrRD2IPbwlNymiZdAqXpwjj++sAgoHvBDUkFk48TkIXb0uxOmVFeevgxJgYyXP9DPqJVPj+CtSRxWle7pAODYpmf1avn4bOB4DXdJVR1IR9si8OYgTZW3Fz4Lxh8naOuaTrnyzJosJBrB3Nks9q96IZQHitnzBJZKEuEjhfp6oAzkgaYPej4q2EAy8DoIb8kltFyaA+f+0s+9ipQeXL5OKhfCzNq6vBFsOqn3g5wHse/86NH3FHZnHEmqlOw/4N18gsj+g09TqJSeDVm/Tbzq+eYyPV6KKNN2F/890VAieUo+AyoCznjjv85AXHjA5gfj3JQj7zczW7CyQolcXxvcxoE9+/7fiy6sDQgFciDo1qswFRnYpVML4Y/UBb3howbVMONAt/fSnytT/DB5EH6FLKBxFOzmM9yuTacu4jo1HQ==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: drone-secret
+      namespace: drone-ci
+    type: Opaque

kubernetes/apps/disabled/drone/server/server-deployment.yaml

@@ -0,0 +1,62 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: drone-server
+  namespace: drone-ci
+  labels:
+    app: drone
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: drone
+  template:
+    metadata:
+      labels:
+        app: drone
+    spec:
+      containers:
+        - name: drone
+          image: drone/drone:2
+          ports:
+            - containerPort: 80
+            - containerPort: 443
+          resources:
+            requests:
+              cpu: 50m
+              memory: 75Mi
+            limits:
+              cpu: 100m
+              memory: 200Mi
+          env:
+            - name: DRONE_GITEA_SERVER
+              value: "https://git.fascinated.cc"
+            - name: DRONE_GITEA_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: DRONE_GITEA_CLIENT_ID
+            - name: DRONE_GITEA_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: DRONE_GITEA_CLIENT_SECRET
+            - name: DRONE_RPC_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: drone-secret
+                  key: DRONE_RPC_SECRET
+            - name: DRONE_SERVER_HOST
+              value: "drone.fascinated.cc"
+            - name: DRONE_SERVER_PROTO
+              value: "https"
+            - name: DRONE_REGISTRATION_CLOSED
+              value: "true"
+          volumeMounts:
+            - name: drone-data
+              mountPath: /data
+      volumes:
+        - name: drone-data
+          persistentVolumeClaim:
+            claimName: drone-pvc

kubernetes/apps/disabled/drone/server/service.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: drone-service
+  namespace: drone-ci
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP
+    - name: https
+      port: 443
+      targetPort: 443
+      protocol: TCP
+  selector:
+    app: drone

kubernetes/apps/disabled/searxng/config.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: searxng-config
+data:
+  limiter.toml: |
+    # This configuration file updates the default configuration file
+    # See https://github.com/searxng/searxng/blob/master/searx/limiter.toml
+
+    [botdetection.ip_limit]
+    # activate link_token method in the ip_limit method
+    link_token = true
+
+  settings.yml: |
+    # see https://docs.searxng.org/admin/settings/settings.html#settings-use-default-settings
+    use_default_settings: true
+    server:
+      # base_url is defined in the SEARXNG_BASE_URL environment variable, see .env and docker-compose.yml
+      limiter: true  # can be disabled for a private instance
+      image_proxy: false
+    ui:
+      static_use_hash: true
+    redis:
+      url: redis://searxng-redis:6379/0

kubernetes/apps/disabled/searxng/deployment.yaml

@@ -0,0 +1,47 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: searxng
+  namespace: public-services
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: searxng
+  template:
+    metadata:
+      labels:
+        app: searxng
+    spec:
+      containers:
+        - name: searxng
+          image: docker.io/searxng/searxng:2024.9.23-6be56aee1
+          ports:
+            - containerPort: 8080
+          env:
+            - name: SEARXNG_BASE_URL
+              value: "https://search.fascinated.cc"
+            - name: SEARXNG_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: searxng-secret
+                  key: secret_key
+          volumeMounts:
+            - name: searxng-config-volume
+              mountPath: /etc/searxng/limiter.toml
+              subPath: limiter.toml
+            - name: searxng-config-volume
+              mountPath: /etc/searxng/settings.yml
+              subPath: settings.yml
+          resources:
+            requests:
+              memory: "1024Mi"
+              cpu: "100m"
+            limits:
+              memory: "1024M"
+              cpu: "500m"
+      volumes:
+        - name: searxng-config-volume
+          configMap:
+            name: searxng-config

kubernetes/apps/disabled/searxng/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: searxng-ingress
+  namespace: public-services
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`search.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: searxng-service
+          port: 8080
+  tls:
+    secretName: fascinated-cc

kubernetes/apps/disabled/searxng/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: public-services
+resources:
+  - ./redis/pvc.yaml
+  - ./redis/redis.yaml
+  - ./redis/service.yaml
+  - config.yaml
+  - sealed-secrets.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

kubernetes/apps/disabled/searxng/redis/pvc.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: searxng-redis-pvc
+  namespace: public-services
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

kubernetes/apps/disabled/searxng/redis/redis.yaml

@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: searxng-redis
+  namespace: public-services
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: searxng-redis
+  template:
+    metadata:
+      labels:
+        app: searxng-redis
+    spec:
+      containers:
+        - name: searxng-redis
+          image: docker.io/valkey/valkey:8-alpine
+          command:
+            ["valkey-server", "--save", "30", "1", "--loglevel", "warning"]
+          ports:
+            - containerPort: 6379
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+          resources:
+            limits:
+              memory: "128Mi"
+              cpu: "100m"
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: searxng-redis-pvc

kubernetes/apps/disabled/searxng/redis/service.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: searxng-redis
+  namespace: public-services
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6379
+      targetPort: 6379
+  selector:
+    app: searxng-redis

kubernetes/apps/disabled/searxng/sealed-secrets.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: searxng-secret
+  namespace: public-services
+spec:
+  encryptedData:
+    secret_key: AgC0GFaPKSBszjmam9HxhhPIKPj3aTaa7BtMEJJBaPUGRA7wPi/9utkHcQL5MG/1HB2nHwfVmBKQY/nmJaYIZBCE+MGjLljjVED37rNEj6PCTcptA/b27+Rnbn7XxH8Zt19uBZapWf0TO8EZaHu/6B9cYIiThlQ0o5+Im7nwuMoYymQSpxMAAr7O6i5cF4XaehYxiNhP1YfveW34Uit/VCMG8qyVi03YBnxsgUKdMeb8krAL2p5zH15ELSd6CprfYdkB8xTZkFYXxEctKyYywsI6ZEC3G0f2R+lcJ46e19wEEZSaCvT1Nviij/jdt4zafHjdQ+U3ZH69Sc83KwNxKJ3hDRdhM2Nl6wDrftl5IFtMFyk2fwOOPPxd8i096dmMBKzljgNgUYzbH4E3f4LBBjaoW0Nrdgkg0wEJplolfpiZVEOtlCm+Jm9tCxEWGEIkrysuZCv90kmd41fJb+k43/J5oY25gMMzUgqEryjR1fXXexgTQoNd1YKOft6DvWy6jZw/RjZWpwxmBHjtxKx9tbr0kwIx/ZCGAQhZ/4LjYCvmP9axV5h7anBbBgiVMA36BJq6nxg//wJ2GMy4CXlIs1oFpob0zTWOg/aCPwzTfK2GrzYXH6xLFqN1ueTdXSxNjb6qi4aOwOFtmZ9z53ffT/XeKyHVgXsLCt6THc1TJVzaqeHL7eM93RtPWlSezdSf84MfzewokisJd3TD3dDoSzhob43ckHlbFV7lbclzPBUAdw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: searxng-secret
+      namespace: public-services
+    type: Opaque

kubernetes/apps/disabled/searxng/service.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: searxng-service
+  namespace: public-services
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8080
+      targetPort: 8080
+  selector:
+    app: searxng

kubernetes/apps/production/flyimg/deployment.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: flyimg
+  namespace: public-services
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: flyimg
+  template:
+    metadata:
+      labels:
+        app: flyimg
+    spec:
+      containers:
+        - name: flyimg-container
+          image: flyimg/flyimg:1.4.13
+          securityContext:
+            allowPrivilegeEscalation: false
+          ports:
+            - containerPort: 80
+          resources:
+            requests:
+              cpu: 50m
+              memory: 100Mi
+            limits:
+              cpu: 1000m # 1 vCPU
+              memory: 200Mi
+          volumeMounts:
+            - name: flyimg-storage
+              mountPath: /var/www/html/web/uploads
+      volumes:
+        - name: flyimg-storage
+          persistentVolumeClaim:
+            claimName: flyimg-pvc

kubernetes/apps/production/flyimg/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: capacitor-ingress
+  namespace: public-services
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`img.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: flyimg-service
+          port: 80
+  tls:
+    secretName: fascinated-cc

kubernetes/apps/production/flyimg/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: public-services
+resources:
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

kubernetes/apps/production/flyimg/pvc.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: flyimg-pvc
+  namespace: public-services
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

kubernetes/apps/production/flyimg/service.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: flyimg-service
+  namespace: public-services
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 80
+  selector:
+    app: flyimg

kubernetes/clusters/production/apps.yaml

@@ -5,12 +5,12 @@ metadata:
   name: apps
   namespace: flux-system
 spec:
-  interval: 10m0s
+  interval: 5m0s
   dependsOn:
     - name: infrastructure
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./apps/production
+  path: ./kubernetes/apps/production
   prune: true
   wait: true

kubernetes/clusters/production/flux-system/gotk-components.yaml

@@ -12331,7 +12331,7 @@ spec:
             resourceFieldRef:
               containerName: manager
               resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.3.0
+        image: ghcr.io/fluxcd/notification-controller:v1.4.0
         imagePullPolicy: IfNotPresent
         livenessProbe:
           httpGet:

kubernetes/clusters/production/flux-system/gotk-sync.yaml

@@ -6,12 +6,12 @@ metadata:
   name: flux-system
   namespace: flux-system
 spec:
-  interval: 10s
+  interval: 1m0s
   ref:
     branch: master
   secretRef:
     name: flux-system
-  url: https://git.fascinated.cc/fascinated/home-ops.git
+  url: https://git.fascinated.cc/fascinated/homelab.git
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -20,7 +20,7 @@ metadata:
   namespace: flux-system
 spec:
   interval: 10m0s
-  path: ./clusters/production
+  path: ./kubernetes/clusters/production
   prune: true
   sourceRef:
     kind: GitRepository

kubernetes/clusters/production/infrastructure.yaml

@@ -5,10 +5,10 @@ metadata:
   name: infrastructure
   namespace: flux-system
 spec:
-  interval: 10m0s
+  interval: 5m0s
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./infrastructure
+  path: ./kubernetes/infrastructure
   prune: true
   wait: true

kubernetes/infrastructure/alerting/flux/alert.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Provider
+metadata:
+  name: discord
+  namespace: flux-system
+spec:
+  type: discord
+  address: "https://discord.com/api/webhooks/1287224007820574841/4lZh3e3OxI6Qu0BnzyEBzbGBc3tdhzWG66Dh9t8RdVbenClhOOAnqooclrw1amRoY5nB"
+---
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Alert
+metadata:
+  name: discord-alert
+  namespace: flux-system
+spec:
+  summary: "Discord Alert"
+  providerRef:
+    name: discord # Changed from discord-webhook to discord
+  eventSeverity: info
+  eventSources:
+    - kind: GitRepository
+      name: "*"
+    - kind: Kustomization
+      name: "*"

kubernetes/infrastructure/alerting/flux/kustomization.yaml

@@ -2,5 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - crds
+  - alert.yaml
-  - nfs

kubernetes/infrastructure/backup/backup-task-template.yaml

@@ -0,0 +1,27 @@
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: kubernetes-backups
+  namespace: backups
+spec:
+  # The PVC to be backed up
+  sourcePVC: set me
+  trigger:
+    # Take a backup every hour
+    schedule: "* * * * *"
+  restic:
+    # Prune the repository (repack to free space) every 2 weeks
+    pruneIntervalDays: 14
+    # Name of the Secret with the connection information
+    repository: restic-config
+    # Retention policy for backups
+    retain:
+      hourly: 6
+      daily: 5
+      weekly: 4
+      monthly: 2
+      yearly: 1
+    # Clone the source volume prior to taking a backup to ensure a
+    # point-in-time image.
+    copyMethod: Clone

kubernetes/infrastructure/backup/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: backups
+resources:
+  - namespace.yaml
+  - volsync.yaml

kubernetes/infrastructure/backup/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: backups

kubernetes/infrastructure/backup/volsync.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: volsync-repository
+  namespace: backups
+spec:
+  interval: 5m0s
+  url: https://backube.github.io/helm-charts/
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: volsync
+  namespace: backups
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: volsync
+      version: "0.10.0"
+      sourceRef:
+        kind: HelmRepository
+        name: volsync
+        namespace: backups
+      interval: 12h

kubernetes/infrastructure/capacitor/capacitor.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: capacitor
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: oci://ghcr.io/gimlet-io/capacitor-manifests
+  ref:
+    semver: ">=0.1.0"
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: capacitor
+  namespace: flux-system
+spec:
+  targetNamespace: flux-system
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  wait: true
+  prune: true
+  path: "./"
+  sourceRef:
+    kind: OCIRepository
+    name: capacitor

kubernetes/infrastructure/capacitor/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: capacitor-external-ingress
+  namespace: flux-system
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`capacitor.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: capacitor
+          port: 9000
+  tls:
+    secretName: fascinated-cc

kubernetes/infrastructure/capacitor/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - capacitor.yaml
+  - ingress.yaml

kubernetes/infrastructure/cert-manager/cert-manager.yaml

@@ -5,7 +5,7 @@ metadata:
   name: cert-manager
   namespace: cert-manager
 spec:
-  interval: 12h
+  interval: 5m0s
   url: https://charts.jetstack.io
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2

kubernetes/infrastructure/crds/kustomization.yaml

@@ -3,5 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: flux-system
 resources:
-  - traefik-crds.yaml
+  - traefik.crds.yaml
   - cert-manager.crds.yaml

kubernetes/infrastructure/crds/traefik.crds.yaml

@@ -1,5 +1,5 @@
 ---
-apiVersion: source.toolkit.fluxcd.io/v1beta1
+apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
   name: traefik-crds
@@ -8,7 +8,7 @@ spec:
   interval: 30m
   url: https://github.com/traefik/traefik-helm-chart.git
   ref:
-    tag: v10.3.0
+    tag: v32.0.0
   ignore: |
     # exclude all
     /*

kubernetes/infrastructure/eraser/eraser.yaml

@@ -0,0 +1,549 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: eraser-system
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.9.0
+  creationTimestamp: null
+  name: imagejobs.eraser.sh
+spec:
+  group: eraser.sh
+  names:
+    kind: ImageJob
+    listKind: ImageJobList
+    plural: imagejobs
+    singular: imagejob
+  scope: Cluster
+  versions:
+    - name: v1
+      schema:
+        openAPIV3Schema:
+          description: ImageJob is the Schema for the imagejobs API.
+          properties:
+            apiVersion:
+              description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            status:
+              description: ImageJobStatus defines the observed state of ImageJob.
+              properties:
+                deleteAfter:
+                  description: Time to delay deletion until
+                  format: date-time
+                  type: string
+                desired:
+                  description: desired number of pods
+                  type: integer
+                failed:
+                  description: number of pods that failed
+                  type: integer
+                phase:
+                  description: job running, successfully completed, or failed
+                  type: string
+                skipped:
+                  description: number of nodes that were skipped e.g. because they are not a linux node
+                  type: integer
+                succeeded:
+                  description: number of pods that completed successfully
+                  type: integer
+              required:
+                - desired
+                - failed
+                - phase
+                - skipped
+                - succeeded
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+    - deprecated: true
+      deprecationWarning: v1alpha1 of the eraser API has been deprecated. Please migrate to v1.
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: ImageJob is the Schema for the imagejobs API.
+          properties:
+            apiVersion:
+              description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            status:
+              description: ImageJobStatus defines the observed state of ImageJob.
+              properties:
+                deleteAfter:
+                  description: Time to delay deletion until
+                  format: date-time
+                  type: string
+                desired:
+                  description: desired number of pods
+                  type: integer
+                failed:
+                  description: number of pods that failed
+                  type: integer
+                phase:
+                  description: job running, successfully completed, or failed
+                  type: string
+                skipped:
+                  description: number of nodes that were skipped e.g. because they are not a linux node
+                  type: integer
+                succeeded:
+                  description: number of pods that completed successfully
+                  type: integer
+              required:
+                - desired
+                - failed
+                - phase
+                - skipped
+                - succeeded
+              type: object
+          type: object
+      served: true
+      storage: false
+      subresources:
+        status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.9.0
+  creationTimestamp: null
+  name: imagelists.eraser.sh
+spec:
+  group: eraser.sh
+  names:
+    kind: ImageList
+    listKind: ImageListList
+    plural: imagelists
+    singular: imagelist
+  scope: Cluster
+  versions:
+    - name: v1
+      schema:
+        openAPIV3Schema:
+          description: ImageList is the Schema for the imagelists API.
+          properties:
+            apiVersion:
+              description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ImageListSpec defines the desired state of ImageList.
+              properties:
+                images:
+                  description: The list of non-compliant images to delete if non-running.
+                  items:
+                    type: string
+                  type: array
+              required:
+                - images
+              type: object
+            status:
+              description: ImageListStatus defines the observed state of ImageList.
+              properties:
+                failed:
+                  description: Number of nodes that failed to run the job
+                  format: int64
+                  type: integer
+                skipped:
+                  description: Number of nodes that were skipped due to a skip selector
+                  format: int64
+                  type: integer
+                success:
+                  description: Number of nodes that successfully ran the job
+                  format: int64
+                  type: integer
+                timestamp:
+                  description: Information when the job was completed.
+                  format: date-time
+                  type: string
+              required:
+                - failed
+                - skipped
+                - success
+                - timestamp
+              type: object
+          type: object
+      served: true
+      storage: true
+      subresources:
+        status: {}
+    - deprecated: true
+      deprecationWarning: v1alpha1 of the eraser API has been deprecated. Please migrate to v1.
+      name: v1alpha1
+      schema:
+        openAPIV3Schema:
+          description: ImageList is the Schema for the imagelists API.
+          properties:
+            apiVersion:
+              description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+              type: string
+            kind:
+              description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+              type: string
+            metadata:
+              type: object
+            spec:
+              description: ImageListSpec defines the desired state of ImageList.
+              properties:
+                images:
+                  description: The list of non-compliant images to delete if non-running.
+                  items:
+                    type: string
+                  type: array
+              required:
+                - images
+              type: object
+            status:
+              description: ImageListStatus defines the observed state of ImageList.
+              properties:
+                failed:
+                  description: Number of nodes that failed to run the job
+                  format: int64
+                  type: integer
+                skipped:
+                  description: Number of nodes that were skipped due to a skip selector
+                  format: int64
+                  type: integer
+                success:
+                  description: Number of nodes that successfully ran the job
+                  format: int64
+                  type: integer
+                timestamp:
+                  description: Information when the job was completed.
+                  format: date-time
+                  type: string
+              required:
+                - failed
+                - skipped
+                - success
+                - timestamp
+              type: object
+          type: object
+      served: true
+      storage: false
+      subresources:
+        status: {}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eraser-controller-manager
+  namespace: eraser-system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: eraser-imagejob-pods
+  namespace: eraser-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: eraser-imagejob-pods-cluster-role
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: eraser-manager-role
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - update
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - podtemplates
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - eraser.sh
+    resources:
+      - imagejobs
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - eraser.sh
+    resources:
+      - imagejobs/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - eraser.sh
+    resources:
+      - imagelists
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - eraser.sh
+    resources:
+      - imagelists/status
+    verbs:
+      - get
+      - patch
+      - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eraser-imagejob-pods-cluster-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: eraser-imagejob-pods-cluster-role
+subjects:
+  - kind: ServiceAccount
+    name: eraser-imagejob-pods
+    namespace: eraser-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: eraser-manager-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: eraser-manager-role
+subjects:
+  - kind: ServiceAccount
+    name: eraser-controller-manager
+    namespace: eraser-system
+---
+apiVersion: v1
+data:
+  controller_manager_config.yaml: |
+    apiVersion: eraser.sh/v1alpha3
+    kind: EraserConfig
+    manager:
+      runtime:
+        name: containerd
+        address: unix:///run/containerd/containerd.sock
+      otlpEndpoint: ""
+      logLevel: info
+      scheduling:
+        repeatInterval: 24h
+        beginImmediately: true
+      profile:
+        enabled: false
+        port: 6060
+      imageJob:
+        successRatio: 1.0
+        cleanup:
+          delayOnSuccess: 0s
+          delayOnFailure: 24h
+      pullSecrets: [] # image pull secrets for collector/scanner/eraser
+      priorityClassName: "" # priority class name for collector/scanner/eraser
+      nodeFilter:
+        type: exclude # must be either exclude|include
+        selectors:
+          - eraser.sh/cleanup.filter
+          - kubernetes.io/os=windows
+    components:
+      collector:
+        enabled: true
+        image:
+          repo: ghcr.io/eraser-dev/collector
+          tag: v1.4.0-beta.0
+        request:
+          mem: 25Mi
+          cpu: 7m
+        limit:
+          mem: 500Mi
+          # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
+          cpu: 0
+      scanner:
+        enabled: true
+        image:
+          repo: ghcr.io/eraser-dev/eraser-trivy-scanner # supply custom image for custom scanner
+          tag: v1.4.0-beta.0
+        request:
+          mem: 500Mi
+          cpu: 1000m
+        limit:
+          mem: 2Gi
+          # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
+          cpu: 0
+        # The config needs to be passed through to the scanner as yaml, as a
+        # single string. Because we allow custom scanner images, the scanner is
+        # responsible for defining a schema, parsing, and validating.
+        config: |
+          # this is the schema for the provided 'trivy-scanner'. custom scanners
+          # will define their own configuration.
+          cacheDir: /var/lib/trivy
+          dbRepo: ghcr.io/aquasecurity/trivy-db
+          deleteFailedImages: true
+          deleteEOLImages: true
+          vulnerabilities:
+            ignoreUnfixed: true
+            types:
+              - os
+              - library
+            securityChecks:
+              - vuln
+            severities:
+              - CRITICAL
+              - HIGH
+              - MEDIUM
+              - LOW
+            ignoredStatuses:
+          timeout:
+            total: 23h
+            perImage: 1h
+      remover:
+        image:
+          repo: ghcr.io/eraser-dev/remover
+          tag: v1.4.0-beta.0
+        request:
+          mem: 25Mi
+          # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#how-pods-with-resource-limits-are-run
+          cpu: 0
+        limit:
+          mem: 30Mi
+          cpu: 0
+kind: ConfigMap
+metadata:
+  name: eraser-manager-config
+  namespace: eraser-system
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    control-plane: controller-manager
+  name: eraser-controller-manager
+  namespace: eraser-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      control-plane: controller-manager
+  template:
+    metadata:
+      labels:
+        control-plane: controller-manager
+    spec:
+      containers:
+        - args:
+            - --config=/config/controller_manager_config.yaml
+          command:
+            - /manager
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: OTEL_SERVICE_NAME
+              value: eraser-manager
+          image: ghcr.io/eraser-dev/eraser-manager:v1.5.0-beta.0
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8081
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          name: manager
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8081
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            limits:
+              memory: 30Mi
+            requests:
+              cpu: 100m
+              memory: 20Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsGroup: 65532
+            runAsNonRoot: true
+            runAsUser: 65532
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - mountPath: /config
+              name: manager-config
+      nodeSelector:
+        kubernetes.io/os: linux
+      serviceAccountName: eraser-controller-manager
+      terminationGracePeriodSeconds: 10
+      volumes:
+        - configMap:
+            name: eraser-manager-config
+          name: manager-config

kubernetes/infrastructure/eraser/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: eraser-system
+resources:
+  - eraser.yaml

kubernetes/infrastructure/fluxci/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - ./notification/sealed-secrets.yaml
+  - ./notification/reciever.yaml
+  - ./notification/ingress.yaml

kubernetes/infrastructure/fluxci/notification/ingress.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: flux-notifications-ingress
+  namespace: flux-system
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`flux-notifications.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: notification-controller
+          port: 80
+  tls:
+    secretName: fascinated-cc

kubernetes/infrastructure/fluxci/notification/reciever.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: notification.toolkit.fluxcd.io/v1
+kind: Receiver
+metadata:
+  name: webapp
+  namespace: flux-system
+spec:
+  type: github
+  events:
+    - "ping"
+    - "push"
+  secretRef:
+    name: notification-secret
+  resources:
+    - kind: GitRepository
+      name: webapp

kubernetes/infrastructure/fluxci/notification/sealed-secrets.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: notification-secret
+  namespace: flux-system
+spec:
+  encryptedData:
+    token: AgB9gxfRBYdK3njhBAyXkKsFDSxncYLfO33bvV4Rq7hu4H6OM43xseXveMoSN5+Bw9gvjoaIkn/2Z7pUXNCIUwzG+JAtkDDyY25Xkmu53FN96f3ZUFBQyvtPcB3WTai3spki8GABqLUUkRFX3j7j+hBKLLdryKpkv77OSs/rh0K6V+LhtDjedSW+dKaywPA2kwf1jaX4T675fZpe0h5xpiV1KWO+mHyAmF03CgCC2LvnpCze1/6ZToU6EC+hETe2W6r3fDMxffnkggDgDO0hGy6py4ID00TFXd23dMHu/72caUUgFZGgKTkCF5/+AvOPNoVAaZSrs1V9xPPljYyCzDTucV8O7TfrG6tvsyPG74wU+y9R1OAbq/ZWBh8grMB8zfRHNKMbpGnCphcnB98vkZLQXAnlWYpCJOmerkQYBxiMs3l6XBbDPURuyO2/xOJe70XXDQ7BPA7ZsCilNQNSm+xY9U0Uf8g9oycNBhFoy96+b3VMy7VvAl0smsBPu4VuUwGxAJTftAmqT6lBFoordynEcUiL+q/xph7gKEZj6JQtNibrw5p8k1V8MreoWZe2DmeelgDvZcT7QpPgrHDvbCKNeHM2xFlOzgemBK8+/+Qcr9gZAJGQKE8ppUssD5zDECzk76A2mZ7/tJkGQFaFrC5zh7WDnpMfdXDkQac5e6hKFDAvuBckfgcLok8AAMlCeQgDcdwjlnrGXs1ZFYbvf73gIoAJknB9WZ44tM0I7Um3nzlqGXn5GF2S
+  template:
+    metadata:
+      creationTimestamp: null
+      name: notification-secret
+      namespace: flux-system
+    type: Opaque

kubernetes/infrastructure/kustomization.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespaces
+  - sealed-secrets
+  - cert-manager
+  - crds
+  - metallb
+  - fluxci
+  - nfs
+  - traefik
+  - capacitor
+  - monitoring
+  - alerting/flux
+  - eraser
+  - spegel
+  #- backup

kubernetes/infrastructure/monitoring/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: kubernetes-grafana-external-ingress
+  namespace: monitoring
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`kubernetes-grafana.local.fascinated.cc`)
+      kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
+      services:
+        - name: kube-prometheus-stack-grafana
+          port: 80
+  tls:
+    secretName: fascinated-cc

kubernetes/infrastructure/monitoring/kube-prometheus-stack.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: monitoring
+  namespace: monitoring
+spec:
+  interval: 5m0s
+  url: https://prometheus-community.github.io/helm-charts
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-prometheus-stack
+  namespace: monitoring
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: "63.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: monitoring
+        namespace: monitoring
+      interval: 12h
+  values:
+    # Prometheus Volume
+    prometheus:
+      prometheusSpec:
+        scrapeInterval: 30s
+        evaluationInterval: 30s
+        ruleSelectorNilUsesHelmValues: false
+        serviceMonitorSelectorNilUsesHelmValues: false
+        podMonitorSelectorNilUsesHelmValues: false
+        probeSelectorNilUsesHelmValues: false
+        scrapeConfigSelectorNilUsesHelmValues: false
+        enableAdminAPI: true
+        walCompression: true
+        enableFeatures:
+          - auto-gomemlimit
+          - memory-snapshot-on-shutdown
+          - new-service-discovery-manager
+        retention: 30d
+        retentionSize: 40GB
+        resources:
+          requests:
+            cpu: 100m
+          limits:
+            memory: 1500Mi
+        storageSpec:
+          volumeClaimTemplate:
+            spec:
+              storageClassName: nfs-csi
+              accessModes: ["ReadWriteOnce"]
+              resources:
+                requests:
+                  storage: 50Gi
+
+    # ServiceMonitor configurations
+    serviceMonitors:
+      node-exporter:
+        metricRelabelings:
+          - action: replace
+            regex: (.*)
+            replacement: $1
+            sourceLabels:
+              - __meta_kubernetes_pod_node_name
+            targetLabel: kubernetes_node
+      kubelet:
+        metricRelabelings:
+          - action: replace
+            sourceLabels:
+              - node
+            targetLabel: instance

kubernetes/infrastructure/monitoring/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+  - namespace.yaml
+  - kube-prometheus-stack.yaml
+  - ingress.yaml

kubernetes/infrastructure/monitoring/namespace.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/enforce-version: latest

kubernetes/infrastructure/namespaces/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: public-services
+resources:
+  - public-services-namespace.yaml

kubernetes/infrastructure/namespaces/public-services-namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: public-services

kubernetes/infrastructure/nfs/kustomization.yaml

@@ -1,6 +1,7 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: nfs-csi
+namespace: kube-system
 resources:
+  - nfs-driver.yaml
   - nfs-csi.yaml

kubernetes/infrastructure/nfs/nfs-csi.yaml

@@ -7,7 +7,7 @@ metadata:
     storageclass.kubernetes.io/is-default-class: "true"
 provisioner: nfs.csi.k8s.io
 parameters:
-  server: 10.0.136
+  server: 10.0.0.136
   share: /mnt/user/Kubernetes
 reclaimPolicy: Delete
 volumeBindingMode: Immediate

kubernetes/infrastructure/nfs/nfs-driver.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: csi-driver-nfs
+  namespace: kube-system
+spec:
+  interval: 5m0s
+  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: csi-driver-nfs
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: csi-driver-nfs
+      version: "v4.9.0"
+      sourceRef:
+        kind: HelmRepository
+        name: csi-driver-nfs
+        namespace: kube-system

kubernetes/infrastructure/sealed-secrets/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - sealed-secrets.yaml

kubernetes/infrastructure/sealed-secrets/sealed-secrets.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 5m0s
+  url: https://bitnami-labs.github.io/sealed-secrets
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sealed-secrets
+  namespace: kube-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: sealed-secrets
+      version: "2.16.1"
+      sourceRef:
+        kind: HelmRepository
+        name: sealed-secrets
+        namespace: kube-system
+      interval: 12h
+  values:
+    fullnameOverride: "sealed-secrets-controller"

kubernetes/infrastructure/spegel/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: spegel
+resources:
+  - namespace.yaml
+  - spegel.yaml

kubernetes/infrastructure/spegel/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: spegel
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/infrastructure/spegel/spegel.yaml

@@ -0,0 +1,42 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  type: "oci"
+  interval: 5m0s
+  url: oci://ghcr.io/spegel-org/helm-charts
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: spegel
+  namespace: spegel
+spec:
+  interval: 1m
+  chart:
+    spec:
+      chart: spegel
+      version: "v0.0.24"
+      interval: 5m
+      sourceRef:
+        kind: HelmRepository
+        name: spegel
+  values:
+    spegel:
+      containerdRegistryConfigPath: /etc/cri/conf.d/hosts
+      registries:
+        [
+          "https://cgr.dev",
+          "https://docker.io",
+          "https://ghcr.io",
+          "https://quay.io",
+          "https://mcr.microsoft.com",
+          "https://public.ecr.aws",
+          "https://gcr.io",
+          "https://registry.k8s.io",
+          "https://k8s.gcr.io",
+          "https://lscr.io",
+          "https://git.fascinated.cc",
+        ]

kubernetes/infrastructure/traefik/external-services/aetheria-grafana.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`aetheria-grafana.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: aetheria-grafana-external
           port: 3000

kubernetes/infrastructure/traefik/external-services/aetheria-influx.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`aetheria-influx.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: aetheria-influx-external
           port: 8086

kubernetes/infrastructure/traefik/external-services/analytics.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`analytics.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: analytics-external
           port: 8000

kubernetes/infrastructure/traefik/external-services/api.mcutils.xyz.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`api.mcutils.xyz`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: mc-utils-api-external
           port: 80

kubernetes/infrastructure/traefik/external-services/azure-metrics.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`azure-metrics.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: azure-metrics-external
           port: 3000

kubernetes/infrastructure/traefik/external-services/azure-phpma.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`azure-phpma.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: azure-phpma-external
           port: 8080

kubernetes/infrastructure/traefik/external-services/bitmagnet.local.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`bitmagnet.local.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: bitmagnet-local-external
           port: 3333

kubernetes/infrastructure/traefik/external-services/cdn.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`cdn.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: cdn-external
           port: 8087

kubernetes/infrastructure/traefik/external-services/cloud.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`cloud.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: nextcloud-external
           port: 80

kubernetes/infrastructure/traefik/external-services/docs.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`docs.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: docs-external
           port: 80

kubernetes/infrastructure/traefik/external-services/fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: main-site-external
           port: 3000

kubernetes/infrastructure/traefik/external-services/git.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`git.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: git-external
           port: 3003

kubernetes/infrastructure/traefik/external-services/glitchtip.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`glitchtip.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: sentry-external
           port: 8000

kubernetes/infrastructure/traefik/external-services/grafana.mcutils.xyz.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`grafana.mcutils.xyz`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: mc-utils-grafana-external
           port: 3000

kubernetes/infrastructure/traefik/external-services/influx.mcutils.xyz.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`influx.mcutils.xyz`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: mc-utils-influx-external
           port: 8086

kubernetes/infrastructure/traefik/external-services/mastodon.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`mastodon.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: mastodon-external
           port: 3000

kubernetes/infrastructure/traefik/external-services/mc-tracker.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`mc-tracker.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: mc-tracker-external
           port: 3000

kubernetes/infrastructure/traefik/external-services/mcutils.xyz.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`mcutils.xyz`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: mc-utils-external
           port: 80

kubernetes/infrastructure/traefik/external-services/node-hl-01.fascinated.cc.yml

@@ -23,6 +23,9 @@ spec:
   routes:
     - match: Host(`node-hl-01.fascinated.cc`)
       kind: Rule
+      middlewares:
+        - name: default-headers
+          namespace: traefik
       services:
         - name: node-hl-01-external
           port: 443