update

dmz/internalproxy/templates/gitlab.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitlab
+spec:
+  ports:
+    - name: app
+      port: 9080
+      protocol: TCP
+      targetPort: 9080
+  clusterIP: None
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: gitlab
+subsets:
+  - addresses:
+      - ip: 192.168.21.200
+    ports:
+      - name: app
+        port: 9080
+        protocol: TCP
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitlab-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitlab.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: gitlab
+          port: 9080
+          scheme: http
+  tls:
+    secretName: gitlab-tls
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gitlab-tls
+spec:
+  secretName: gitlab-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "gitlab.durp.info"
+  dnsNames:
+    - "gitlab.durp.info"
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: gitlab-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: gitlab.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

dmz/internalproxy/templates/n8n.yaml

@@ -12,21 +12,19 @@ spec:
   type: ClusterIP
 
 ---
-
 apiVersion: v1
 kind: Endpoints
 metadata:
   name: n8n
 subsets:
   - addresses:
-      - ip: 192.168.20.104
+      - ip: 192.168.21.200
     ports:
       - name: app
         port: 5678
         protocol: TCP
 
 ---
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -45,7 +43,6 @@ spec:
     secretName: n8n-tls
 
 ---
-
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -60,7 +57,6 @@ spec:
     - "n8n.durp.info"
 
 ---
-
 kind: Service
 apiVersion: v1
 metadata:

dmz/internalproxy/templates/octopus.yaml

@@ -1,40 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: octopus-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`octopus.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: infra-cluster
-          port: 443
-  tls:
-    secretName: octopus-tls
-
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: octopus-tls
-spec:
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  secretName: octopus-tls
-  commonName: "octopus.durp.info"
-  dnsNames:
-    - "octopus.durp.info"
-
----
-kind: Service
-apiVersion: v1
-metadata:
-  name: octopus-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: octopus.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

dmz/internalproxy/templates/portainer.yaml

@@ -1,32 +1,3 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: portainer
-spec:
-  ports:
-  - name: app
-    port: 9443
-    protocol: TCP
-    targetPort: 9443
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: portainer
-subsets:
-- addresses:
-  - ip: 192.168.20.104
-  ports:
-  - name: app
-    port: 9443
-    protocol: TCP
-
----    
-
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -41,9 +12,8 @@ spec:
       #  namespace: traefik
     kind: Rule
     services:
-    - name: portainer
-      port: 9443
-      scheme: https
+      - name: infra-cluster
+        port: 443
   tls:
     secretName: portainer-tls
 
@@ -60,4 +30,4 @@ spec:
     kind: ClusterIssuer
   commonName: "portainer.internal.durp.info"
   dnsNames:
-  - "portainer.internal.durp.info"  
+  - "portainer.internal.durp.info"

infra/argocd/templates/argocd-crossplane.yaml

@@ -1,101 +0,0 @@
-#apiVersion: external-secrets.io/v1
-#kind: ExternalSecret
-#metadata:
-#  name: argocd-secret-crossplane
-#spec:
-#  secretStoreRef:
-#    name: vault
-#    kind: ClusterSecretStore
-#  target:
-#    name: argocd-secret-crossplane
-#  data:
-#    - secretKey: authToken
-#      remoteRef:
-#        key: kv/argocd/provider-argocd
-#        property: token
-#
-#---
-#apiVersion: external-secrets.io/v1
-#kind: ExternalSecret
-#metadata:
-#  name: prod-kubeconfig
-#spec:
-#  secretStoreRef:
-#    name: vault
-#    kind: ClusterSecretStore
-#  target:
-#    name: prod-kubeconfig
-#  data:
-#    - secretKey: kubeconfig
-#      remoteRef:
-#        key: kv/argocd/prd
-#        property: kubeconfig
-#
-#---
-#apiVersion: argocd.crossplane.io/v1alpha1
-#kind: ProviderConfig
-#metadata:
-#  name: argocd-provider
-#spec:
-#  serverAddr: argocd-server.argocd.svc:443
-#  insecure: true
-#  plainText: false
-#  credentials:
-#    source: Secret
-#    secretRef:
-#      namespace: argocd
-#      name: argocd-secret-crossplane
-#      key: authToken
-#
-#---
-#apiVersion: cluster.argocd.crossplane.io/v1alpha1
-#kind: Cluster
-#metadata:
-#  name: prd
-#  labels:
-#    purpose: prd
-#spec:
-#  forProvider:
-#    name: prd
-#    config:
-#      kubeconfigSecretRef:
-#        name: prod-kubeconfig
-#        namespace: argocd
-#        key: kubeconfig
-#  providerConfigRef:
-#    name: argocd-provider
-#
-#---
-#apiVersion: external-secrets.io/v1
-#kind: ExternalSecret
-#metadata:
-#  name: dev-kubeconfig
-#spec:
-#  secretStoreRef:
-#    name: vault
-#    kind: ClusterSecretStore
-#  target:
-#    name: dev-kubeconfig
-#  data:
-#    - secretKey: kubeconfig
-#      remoteRef:
-#        key: kv/argocd/dev
-#        property: kubeconfig
-#
-#---
-#apiVersion: cluster.argocd.crossplane.io/v1alpha1
-#kind: Cluster
-#metadata:
-#  name: dev
-#  labels:
-#    purpose: dev
-#spec:
-#  forProvider:
-#    name: dev
-#    config:
-#      kubeconfigSecretRef:
-#        name: dev-kubeconfig
-#        namespace: argocd
-#        key: kubeconfig
-#  providerConfigRef:
-#    name: argocd-provider

infra/argocd/templates/crowdsec.yaml

@@ -1,20 +0,0 @@
-#apiVersion: argoproj.io/v1alpha1
-#kind: Application
-#metadata:
-#  name: crowdsec
-#  namespace: argocd
-#spec:
-#  project: default
-#  source:
-#    repoURL: https://gitlab.com/developerdurp/homelab.git
-#    targetRevision: main
-#    path: dmz/crowdsec
-#  destination:
-#    namespace: crowdsec
-#    name: dmz
-#  syncPolicy:
-#    automated:
-#      prune: true
-#      selfHeal: true
-#    syncOptions:
-#      - CreateNamespace=true

infra/argocd/templates/octopusdeploy.yaml

@@ -1,42 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: octopusdeploy
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: infra/octopusdeploy
-  destination:
-    namespace: octopusdeploy
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: octopusdeploy-agent
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: infra/octopus-agent
-  destination:
-    namespace: octopus-agent
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

infra/argocd/templates/portainer.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: portainer
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: main
+    path: infra/portainer
+  destination:
+    namespace: portainer
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

infra/octopus-agent/Chart.yaml

@@ -1,12 +0,0 @@
-apiVersion: v2
-name: octopusdeploy
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"
-
-dependencies:
-  - name: kubernetes-agent
-    repository: oci://registry-1.docker.io/octopusdeploy
-    version: 2.*.*

infra/octopus-agent/templates/secret.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault
-
----
-
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: agent-token
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: agent-token
-  data:
-    - secretKey: bearer-token
-      remoteRef:
-        key: kv/octopusdeploy
-        property: infra-bearer-token
-

infra/octopus-agent/values.yaml

@@ -1,19 +0,0 @@
-kubernetes-agent:
-  agent:
-    bearerTokenSecretName: agent-token
-    acceptEula: "Y"
-    serverUrl: "https://octopus.durp.info/"
-    serverCommsAddresses:
-      - "https://octopus-deploy-node0.octopusdeploy.svc.cluster.local:10943/"
-      - "https://octopus-deploy-node1.octopusdeploy.svc.cluster.local:10943/"
-      - "https://octopus-deploy-node2.octopusdeploy.svc.cluster.local:10943/"
-    space: "Default"
-    name: "infra"
-    deploymentTarget:
-      initial:
-        environments:
-          - "development"
-          - "production"
-        tags:
-          - "infra-cluster"
-      enabled: "true"

infra/octopusdeploy/templates/ingress.yaml

@@ -1,32 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: octopus-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`octopus.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: octopusdeploy-octopus-deploy
-          port: 80
-  tls:
-    secretName: octopus-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: octopus-tls
-spec:
-  secretName: octopus-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "octopus.durp.info"
-  dnsNames:
-    - "octopus.durp.info"

infra/octopusdeploy/templates/secrets.yaml

@@ -1,106 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: octopusdeploy-adminpassword
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: octopusdeploy-adminpassword
-  data:
-    - secretKey: secret
-      remoteRef:
-        key: kv/octopusdeploy
-        property: adminpassword
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: octopusdeploy-adminusername
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: octopusdeploy-adminusername
-  data:
-    - secretKey: secret
-      remoteRef:
-        key: kv/octopusdeploy
-        property: adminusername
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: octopusdeploy-connectionstring
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: octopusdeploy-connectionstring
-  data:
-    - secretKey: secret
-      remoteRef:
-        key: kv/octopusdeploy
-        property: connectionstring
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: octopusdeploy-masterkey
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: octopusdeploy-masterkey
-  data:
-    - secretKey: secret
-      remoteRef:
-        key: kv/octopusdeploy
-        property: masterkey
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: octopusdeploy-sapassword
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: octopusdeploy-sapassword
-  data:
-    - secretKey: secret
-      remoteRef:
-        key: kv/octopusdeploy
-        property: sapassword
-
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: octopusdeploy-licensekey
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: octopusdeploy-licensekey
-  data:
-    - secretKey: secret
-      remoteRef:
-        key: kv/octopusdeploy
-        property: licensekey

infra/octopusdeploy/values.yaml

@@ -1,10 +0,0 @@
-octopusdeploy-helm:
-  octopus:
-    image:
-      repository: registry.durp.info/octopusdeploy/octopusdeploy
-      tag: 2025.3
-    createSecrets: false
-    acceptEula: Y
-    replicaCount: 3
-  mssql:
-    enabled: true

infra/portainer/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-name: octopusdeploy
+name: portainer
 description: A Helm chart for Kubernetes
 type: application
 
@@ -7,6 +7,6 @@ version: 0.1.0
 appVersion: "1.16.0"
 
 dependencies:
-  - name: octopusdeploy-helm
-    repository: oci://ghcr.io/octopusdeploy
-    version: 1.7.0
+  - name: portainer
+    repository: https://portainer.github.io/k8s/
+    version: 2.33.5

infra/portainer/templates/ingress.yaml

@@ -0,0 +1,30 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: portainer-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: portainer
+          port: 9000
+  tls:
+    secretName: portainer-tls
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: portainer-tls
+spec:
+  secretName: portainer-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: "portainer.internal.durp.info"
+  dnsNames:
+    - "portainer.internal.durp.info"

infra/portainer/values.yaml

@@ -0,0 +1,78 @@
+portainer:
+  replicaCount: 1
+  image:
+    repository: registry.durp.info/portainer/portainer-ce
+    tag: 2.33.5
+    pullPolicy: Always
+
+  imagePullSecrets: []
+
+  nodeSelector: {}
+  tolerations: []
+
+  serviceAccount:
+    annotations: {}
+    name: portainer-sa-clusteradmin
+
+  # This flag provides the ability to enable or disable RBAC-related resources during the deployment of the Portainer application
+  # If you are using Portainer to manage the K8s cluster it is deployed to, this flag must be set to true
+  localMgmt: true
+
+  service:
+    # Set the httpNodePort and edgeNodePort only if the type is NodePort
+    # For Ingress, set the type to be ClusterIP and set ingress.enabled to true
+    # For Cloud Providers, set the type to be LoadBalancer
+    type: NodePort
+    httpPort: 9000
+    httpsPort: 9443
+    httpNodePort: 30777
+    httpsNodePort: 30779
+    edgePort: 8000
+    edgeNodePort: 30776
+    annotations: {}
+
+  tls:
+    # If set, Portainer will be configured to use TLS only
+    force: false
+    # If set, will mount the existing secret into the pod
+    existingSecret: ""
+
+  trusted_origins:
+    # If set, Portainer will be configured to trust the domains specified in domains
+      enabled: false
+        # specify (in a comma-separated list) the domain(s) used to access Portainer when it is behind a reverse proxy
+          # example: portainer.mydomain.com,portainer.example.com
+      domains: ""
+
+  mtls:
+    # If set, Portainer will be configured to use mTLS only
+    enable: false
+    # If set, will mount the existing secret into the pod
+    existingSecret: ""
+
+  feature:
+    flags: []
+
+  ingress:
+    enabled: false
+    ingressClassName: ""
+    annotations: {}
+      # kubernetes.io/ingress.class: nginx
+      # Only use below if tls.force=true
+      # nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+    # Note: Hosts and paths are of type array
+    hosts:
+      - host:
+        paths: []
+        # - path: "/"
+    tls: []
+
+  resources: {}
+
+  persistence:
+    enabled: true
+    size: "10Gi"
+    annotations: {}
+    storageClass: longhorn
+    existingClaim:
+