update

argocd/Chart.yaml

@@ -9,6 +9,6 @@ appVersion: "1.16.0"
 dependencies:
 - name: argo-cd
   repository: https://argoproj.github.io/argo-helm
-  version: 6.11.1
+  version: 6.7.11
 
 

argocd/templates/InternalProxy.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/internalproxy
+    targetRevision: dmz
+    path: internalproxy
     directory:
       recurse: true
   destination:

argocd/templates/argocd.yaml

@@ -1,16 +1,16 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: durpot
+  name: argocd
   namespace: argocd
 spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/durpot
+    targetRevision: dmz
+    path: argocd
   destination:
-    namespace: durpot
+    namespace: argocd
     name: in-cluster
   syncPolicy:
     automated:

argocd/templates/cert-manager.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/cert-manager
+    targetRevision: dmz
+    path: cert-manager
   destination:
     namespace: cert-manager
     name: in-cluster

argocd/templates/external-dns.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/external-dns
+    targetRevision: dmz
+    path: external-dns
   destination:
     namespace: external-dns
     name: in-cluster

argocd/templates/external-secrets.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/external-secrets
+    targetRevision: dmz
+    path: external-secrets
   destination:
     namespace: external-secrets
     name: in-cluster

argocd/templates/gatekeeper.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/gatekeeper
+    targetRevision: dmz
+    path: gatekeeper
   destination:
     namespace: gatekeeper
     name: in-cluster

argocd/templates/gitlab-runner.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/gitlab-runner
+    targetRevision: dmz
+    path: gitlab-runner
   destination:
     namespace: gitlab-runner
     name: in-cluster

argocd/templates/kube-prometheus-stack.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/kube-prometheus-stack
+    targetRevision: dmz
+    path: kube-prometheus-stack
   destination:
     namespace: kube-prometheus-stack
     name: in-cluster

argocd/templates/kubeclarity.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/kubeclarity
+    targetRevision: dmz
+    path: kubeclarity
   destination:
     namespace: kubeclarity
     name: in-cluster

argocd/templates/longhorn.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: infra/longhorn
+    targetRevision: dmz
+    path: longhorn
   destination:
     namespace: longhorn-system
     name: in-cluster

argocd/templates/metallb-system.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/metallb-system
+    targetRevision: dmz
+    path: metallb-system
   destination:
     namespace: metallb-system
     name: in-cluster

argocd/templates/traefik.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/traefik
+    targetRevision: dmz
+    path: traefik
   destination:
     namespace: traefik
     name: in-cluster

argocd/templates/uptimekuma.yaml

@@ -7,8 +7,8 @@ spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/uptimekuma
+    targetRevision: dmz
+    path: uptimekuma
     directory:
       recurse: true
   destination:

argocd/templates/vault.yaml

@@ -1,16 +1,16 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: authentik
+  name: vault
   namespace: argocd
 spec:
   project: default
   source:
     repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/authentik
+    targetRevision: dmz
+    path: vault
   destination:
-    namespace: authentik
+    namespace: vault
     name: in-cluster
   syncPolicy:
     automated:
@@ -18,4 +18,8 @@ spec:
       selfHeal: true  
     syncOptions:
       - CreateNamespace=true 
-
+  ignoreDifferences:
+  - group: admissionregistration.k8s.io
+    kind: MutatingWebhookConfiguration
+    jqPathExpressions:
+    - .webhooks[]?.clientConfig.caBundle

cert-manager/Chart.yaml

@@ -8,4 +8,4 @@ appVersion: 0.0.1
 dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.15.3
+  version: 1.*.*

dmz/internalproxy/templates/ollama.yaml

@@ -1,101 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: ollama-secret
-  data:
-    - secretKey: users
-      remoteRef:
-        key: secrets/internalproxy/ollama
-        property: users
-
----
-
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: ollama-basic-auth
-spec:
-  basicAuth:
-    secret: ollama-secret
-
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: ollama
-spec:
-  ports:
-    - name: app
-      port: 11435
-      protocol: TCP
-      targetPort: 11435
-  clusterIP: None
-  type: ClusterIP
-
----
-
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: ollama
-subsets:
-  - addresses:
-      - ip: 192.168.20.104
-    ports:
-      - name: app
-        port: 11435
-        protocol: TCP
-
----
-
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: ollama-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`ollama.durp.info`) && PathPrefix(`/`)
-      middlewares:
-        - name: ollama-basic-auth
-      kind: Rule
-      services:
-        - name: ollama
-          port: 11435
-  tls:
-    secretName: ollama-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: ollama-tls
-spec:
-  secretName: ollama-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "ollama.durp.info"
-  dnsNames:
-    - "ollama.durp.info"
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: ollama-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: ollama.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

external-dns/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: 0.0.1
 dependencies:
 - name: external-dns
   repository: https://charts.bitnami.com/bitnami
-  version: 8.3.8
+  version: 6.20.3

external-dns/values.yaml

@@ -4,10 +4,10 @@ external-dns:
 
   image:
     pullPolicy: Always
-
+  txtPrefix: "dmz-"
   sources:
     - service
-    
+
   provider: cloudflare
   cloudflare:
     secretName : "external-dns"

external-secrets/Chart.yaml

@@ -8,5 +8,5 @@ appVersion: 0.0.1
 dependencies:
 - name: external-secrets
   repository: https://charts.external-secrets.io
-  version: 0.10.4
+  version: 0.8.1
 

external-secrets/templates/secret-store.yaml

@@ -0,0 +1,33 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: vault
+spec:
+  provider:
+    vault:
+      server: "https://vault.internal.prd.durp.info"
+      path: "secrets"
+      version: "v2"
+      auth:
+        kubernetes:
+          mountPath: "kubernetes"
+          role: "dmz-external-secrets"
+
+---
+
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token-secret
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: cloudflare-api-token-secret
+  data:
+  - secretKey: cloudflare-api-token-secret
+    remoteRef:
+      key: secrets/cert-manager
+      property: cloudflare-api-token-secret
+

gatekeeper/Chart.yaml

@@ -8,4 +8,4 @@ appVersion: 0.0.1
 dependencies:
 - name: gatekeeper
   repository: https://open-policy-agent.github.io/gatekeeper/charts
-  version: 3.17.1
+  version: 3.14.0

gatekeeper/values.yaml

@@ -0,0 +1,277 @@
+gatekeeper:
+  replicas: 3
+  revisionHistoryLimit: 10
+  auditInterval: 60
+  metricsBackends: ["prometheus"]
+  auditMatchKindOnly: false
+  constraintViolationsLimit: 20
+  auditFromCache: false
+  disableMutation: false
+  disableValidatingWebhook: false
+  validatingWebhookName: gatekeeper-validating-webhook-configuration
+  validatingWebhookTimeoutSeconds: 3
+  validatingWebhookFailurePolicy: Ignore
+  validatingWebhookAnnotations: {}
+  validatingWebhookExemptNamespacesLabels: {}
+  validatingWebhookObjectSelector: {}
+  validatingWebhookCheckIgnoreFailurePolicy: Fail
+  validatingWebhookCustomRules: {}
+  validatingWebhookURL: null
+  enableDeleteOperations: false
+  enableExternalData: true
+  enableGeneratorResourceExpansion: true
+  enableTLSHealthcheck: false
+  maxServingThreads: -1
+  mutatingWebhookName: gatekeeper-mutating-webhook-configuration
+  mutatingWebhookFailurePolicy: Ignore
+  mutatingWebhookReinvocationPolicy: Never
+  mutatingWebhookAnnotations: {}
+  mutatingWebhookExemptNamespacesLabels: {}
+  mutatingWebhookObjectSelector: {}
+  mutatingWebhookTimeoutSeconds: 1
+  mutatingWebhookCustomRules: {}
+  mutatingWebhookURL: null
+  mutationAnnotations: false
+  auditChunkSize: 500
+  logLevel: INFO
+  logDenies: false
+  logMutations: false
+  emitAdmissionEvents: false
+  emitAuditEvents: false
+  admissionEventsInvolvedNamespace: false
+  auditEventsInvolvedNamespace: false
+  resourceQuota: true
+  externaldataProviderResponseCacheTTL: 3m
+  image:
+    repository: openpolicyagent/gatekeeper
+    crdRepository: openpolicyagent/gatekeeper-crds
+    release: v3.15.0-beta.0
+    pullPolicy: Always
+    pullSecrets: []
+  preInstall:
+    crdRepository:
+      image:
+        repository: null
+        tag: v3.15.0-beta.0
+  postUpgrade:
+    labelNamespace:
+      enabled: false
+      image:
+        repository: openpolicyagent/gatekeeper-crds
+        tag: v3.15.0-beta.0
+        pullPolicy: IfNotPresent
+        pullSecrets: []
+      extraNamespaces: []
+      podSecurity: ["pod-security.kubernetes.io/audit=restricted",
+        "pod-security.kubernetes.io/audit-version=latest",
+        "pod-security.kubernetes.io/warn=restricted",
+        "pod-security.kubernetes.io/warn-version=latest",
+        "pod-security.kubernetes.io/enforce=restricted",
+        "pod-security.kubernetes.io/enforce-version=v1.24"]
+      extraAnnotations: {}
+      priorityClassName: ""
+    affinity: {}
+    tolerations: []
+    nodeSelector: {kubernetes.io/os: linux}
+    resources: {}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - ALL
+      readOnlyRootFilesystem: true
+      runAsGroup: 999
+      runAsNonRoot: true
+      runAsUser: 1000
+  postInstall:
+    labelNamespace:
+      enabled: true
+      extraRules: []
+      image:
+        repository: openpolicyagent/gatekeeper-crds
+        tag: v3.15.0-beta.0
+        pullPolicy: IfNotPresent
+        pullSecrets: []
+      extraNamespaces: []
+      podSecurity: ["pod-security.kubernetes.io/audit=restricted",
+        "pod-security.kubernetes.io/audit-version=latest",
+        "pod-security.kubernetes.io/warn=restricted",
+        "pod-security.kubernetes.io/warn-version=latest",
+        "pod-security.kubernetes.io/enforce=restricted",
+        "pod-security.kubernetes.io/enforce-version=v1.24"]
+      extraAnnotations: {}
+      priorityClassName: ""
+    probeWebhook:
+      enabled: true
+      image:
+        repository: curlimages/curl
+        tag: 7.83.1
+        pullPolicy: IfNotPresent
+        pullSecrets: []
+      waitTimeout: 60
+      httpTimeout: 2
+      insecureHTTPS: false
+      priorityClassName: ""
+    affinity: {}
+    tolerations: []
+    nodeSelector: {kubernetes.io/os: linux}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - ALL
+      readOnlyRootFilesystem: true
+      runAsGroup: 999
+      runAsNonRoot: true
+      runAsUser: 1000
+  preUninstall:
+    deleteWebhookConfigurations:
+      extraRules: []
+      enabled: false
+      image:
+        repository: openpolicyagent/gatekeeper-crds
+        tag: v3.15.0-beta.0
+        pullPolicy: IfNotPresent
+        pullSecrets: []
+      priorityClassName: ""
+    affinity: {}
+    tolerations: []
+    nodeSelector: {kubernetes.io/os: linux}
+    resources: {}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - ALL
+      readOnlyRootFilesystem: true
+      runAsGroup: 999
+      runAsNonRoot: true
+      runAsUser: 1000
+  podAnnotations: {}
+  auditPodAnnotations: {}
+  podLabels: {}
+  podCountLimit: "100"
+  secretAnnotations: {}
+  enableRuntimeDefaultSeccompProfile: true
+  controllerManager:
+    exemptNamespaces: []
+    exemptNamespacePrefixes: []
+    hostNetwork: false
+    dnsPolicy: ClusterFirst
+    port: 8443
+    metricsPort: 8888
+    healthPort: 9090
+    readinessTimeout: 1
+    livenessTimeout: 1
+    priorityClassName: system-cluster-critical
+    disableCertRotation: false
+    tlsMinVersion: 1.3
+    clientCertName: ""
+    strategyType: RollingUpdate
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                  - key: gatekeeper.sh/operation
+                    operator: In
+                    values:
+                      - webhook
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+    topologySpreadConstraints: []
+    tolerations: []
+    nodeSelector: {kubernetes.io/os: linux}
+    resources:
+      limits:
+        memory: 512Mi
+      requests:
+        cpu: 100m
+        memory: 512Mi
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - ALL
+      readOnlyRootFilesystem: true
+      runAsGroup: 999
+      runAsNonRoot: true
+      runAsUser: 1000
+    podSecurityContext:
+      fsGroup: 999
+      supplementalGroups:
+        - 999
+    extraRules: []
+    networkPolicy:
+      enabled: false
+      ingress: { }
+        # - from:
+        #   - ipBlock:
+        #       cidr: 0.0.0.0/0
+  audit:
+    enablePubsub: false
+    connection: audit-connection
+    channel: audit-channel
+    hostNetwork: false
+    dnsPolicy: ClusterFirst
+    metricsPort: 8888
+    healthPort: 9090
+    readinessTimeout: 1
+    livenessTimeout: 1
+    priorityClassName: system-cluster-critical
+    disableCertRotation: false
+    affinity: {}
+    tolerations: []
+    nodeSelector: {kubernetes.io/os: linux}
+    resources:
+      limits:
+        memory: 512Mi
+      requests:
+        cpu: 100m
+        memory: 512Mi
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - ALL
+      readOnlyRootFilesystem: true
+      runAsGroup: 999
+      runAsNonRoot: true
+      runAsUser: 1000
+    podSecurityContext:
+      fsGroup: 999
+      supplementalGroups:
+        - 999
+    writeToRAMDisk: false
+    extraRules: []
+  crds:
+    affinity: {}
+    tolerations: []
+    nodeSelector: {kubernetes.io/os: linux}
+    resources: {}
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - ALL
+      readOnlyRootFilesystem: true
+      runAsGroup: 65532
+      runAsNonRoot: true
+      runAsUser: 65532
+  pdb:
+    controllerManager:
+      minAvailable: 1
+  service: {}
+  disabledBuiltins: ["{http.send}"]
+  psp:
+    enabled: true
+  upgradeCRDs:
+    enabled: true
+    extraRules: []
+    priorityClassName: ""
+  rbac:
+    create: true
+  externalCertInjection:
+    enabled: false
+    secretName: gatekeeper-webhook-server-cert

gitlab-runner/Chart.yaml

@@ -8,4 +8,4 @@ appVersion: 0.0.1
 dependencies:
 - name: gitlab-runner
   repository: https://charts.gitlab.io/
-  version: 0.69.0
+  version: 0.43.0

infra/argocd/Chart.yaml

@@ -1,12 +0,0 @@
-apiVersion: v2
-name: argocd
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"
-
-dependencies:
-- name: argo-cd
-  repository: https://argoproj.github.io/argo-helm
-  version: 6.11.1

infra/argocd/templates/argocd.yaml

@@ -1,40 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: infra/argocd
-  destination:
-    namespace: argocd
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 
-
----
-
-#apiVersion: external-secrets.io/v1beta1
-#kind: ExternalSecret
-#metadata:
-#  name: vault-argocd
-#  labels:
-#    app.kubernetes.io/part-of: argocd
-#spec:
-#  secretStoreRef:
-#    name: vault
-#    kind: ClusterSecretStore
-#  target:
-#    name: client-secret
-#  data:
-#  - secretKey: clientSecret
-#    remoteRef:
-#      key: secrets/argocd/authentik
-#      property: clientsecret

infra/longhorn/templates/ingress.yaml

@@ -1,41 +0,0 @@
-#apiVersion: traefik.containo.us/v1alpha1
-#kind: IngressRoute
-#metadata:
-#  name: longhorn-ingress
-#spec:
-#  entryPoints:
-#    - websecure
-#  routes:
-#  - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`)
-#    middlewares:
-#    - name: whitelist
-#      namespace: traefik
-#    - name: authentik-proxy-provider
-#      namespace: traefik  
-#    kind: Rule
-#    services:
-#    - name: longhorn-frontend
-#      port: 80
-#  - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`)
-#    kind: Rule
-#    services:
-#    - name: ak-outpost-authentik-embedded-outpost
-#      namespace: authentik
-#      port: 9000
-#  tls:
-#    secretName: longhorn-tls
-#
-#---
-#
-#apiVersion: cert-manager.io/v1
-#kind: Certificate
-#metadata:
-#  name: longhorn-tls
-#spec:
-#  secretName: longhorn-tls
-#  issuerRef:
-#    name: letsencrypt-production
-#    kind: ClusterIssuer
-#  commonName: "longhorn.internal.durp.info"
-#  dnsNames:
-#  - "longhorn.internal.durp.info"  

infra/longhorn/templates/secrets.yaml

@@ -1,23 +0,0 @@
-#apiVersion: external-secrets.io/v1beta1
-#kind: ExternalSecret
-#metadata:
-#  name: external-longhorn-backup-token-secret
-#spec:
-#  secretStoreRef:
-#    name: vault
-#    kind: ClusterSecretStore
-#  target:
-#    name: longhorn-backup-token-secret
-#  data:
-#  - secretKey: AWS_ACCESS_KEY_ID
-#    remoteRef:
-#      key: secrets/longhorn/backup
-#      property: AWS_ACCESS_KEY_ID
-#  - secretKey: AWS_ENDPOINTS 
-#    remoteRef:
-#      key: secrets/longhorn/backup
-#      property: AWS_ENDPOINTS 
-#  - secretKey: AWS_SECRET_ACCESS_KEY
-#    remoteRef:
-#      key: secrets/longhorn/backup
-#      property: AWS_SECRET_ACCESS_KEY

infra/longhorn/values.yaml

@@ -1,192 +0,0 @@
-longhorn: 
-  global:
-    cattle:
-      systemDefaultRegistry: ""
-  
-  image:
-    longhorn:
-      engine:
-        repository: longhornio/longhorn-engine
-      manager:
-        repository: longhornio/longhorn-manager
-      ui:
-        repository: longhornio/longhorn-ui
-      instanceManager:
-        repository: longhornio/longhorn-instance-manager
-      shareManager:
-        repository: longhornio/longhorn-share-manager
-      backingImageManager:
-        repository: longhornio/backing-image-manager
-    csi:
-      attacher:
-        repository: longhornio/csi-attacher
-      provisioner:
-        repository: longhornio/csi-provisioner
-      nodeDriverRegistrar:
-        repository: longhornio/csi-node-driver-registrar
-      resizer:
-        repository: longhornio/csi-resizer
-      snapshotter:
-        repository: longhornio/csi-snapshotter
-    pullPolicy: Always
-  
-  service:
-    ui:
-      type: ClusterIP
-      nodePort: null
-    manager:
-      type: ClusterIP
-      nodePort: ""
-      loadBalancerIP: ""
-      loadBalancerSourceRanges: ""
-  
-  persistence:
-    defaultClass: true
-    defaultFsType: ext4
-    defaultClassReplicaCount: 3
-    defaultDataLocality: disabled # best-effort otherwise
-    reclaimPolicy: Retain
-    migratable: false
-    recurringJobSelector:
-      enable: true
-      jobList: '[
-          {
-            "name":"backup", 
-            "task":"backup", 
-            "cron":"0 0 * * ?", 
-            "retain":24
-          }
-        ]'
-    backingImage:
-      enable: false
-      name: ~
-      dataSourceType: ~
-      dataSourceParameters: ~
-      expectedChecksum: ~
-  
-  csi:
-    kubeletRootDir: ~
-    attacherReplicaCount: ~
-    provisionerReplicaCount: ~
-    resizerReplicaCount: ~
-    snapshotterReplicaCount: ~
-  
-  defaultSettings:
-    backupTarget: S3://longhorn-infra@us-east-1/
-    backupTargetCredentialSecret: longhorn-backup-token-secret
-    allowRecurringJobWhileVolumeDetached: ~
-    createDefaultDiskLabeledNodes: ~
-    defaultDataPath: ~
-    defaultDataLocality: ~
-    replicaSoftAntiAffinity: ~
-    replicaAutoBalance: ~
-    storageOverProvisioningPercentage: ~
-    storageMinimalAvailablePercentage: ~
-    upgradeChecker: ~
-    defaultReplicaCount: ~
-    defaultLonghornStaticStorageClass: longhorn
-    backupstorePollInterval: ~
-    taintToleration: ~
-    systemManagedComponentsNodeSelector: ~
-    priorityClass: ~
-    autoSalvage: ~
-    autoDeletePodWhenVolumeDetachedUnexpectedly: ~
-    disableSchedulingOnCordonedNode: ~
-    replicaZoneSoftAntiAffinity: ~
-    nodeDownPodDeletionPolicy: ~
-    allowNodeDrainWithLastHealthyReplica: ~
-    mkfsExt4Parameters: ~
-    disableReplicaRebuild: ~
-    replicaReplenishmentWaitInterval: ~
-    concurrentReplicaRebuildPerNodeLimit: ~
-    disableRevisionCounter: ~
-    systemManagedPodsImagePullPolicy: ~
-    allowVolumeCreationWithDegradedAvailability: ~
-    autoCleanupSystemGeneratedSnapshot: ~
-    concurrentAutomaticEngineUpgradePerNodeLimit: ~
-    backingImageCleanupWaitInterval: ~
-    backingImageRecoveryWaitInterval: ~
-    guaranteedEngineManagerCPU: ~
-    guaranteedReplicaManagerCPU: ~
-    kubernetesClusterAutoscalerEnabled: ~
-    orphanAutoDeletion: ~
-    storageNetwork: ~
-  privateRegistry:
-    createSecret: ~
-    registryUrl: ~
-    registryUser: ~
-    registryPasswd: ~
-    registrySecret: ~
-  
-  longhornManager:
-    priorityClass: ~
-    tolerations: []
-    ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
-    ## and uncomment this example block
-    # - key: "key"
-    #   operator: "Equal"
-    #   value: "value"
-    #   effect: "NoSchedule"
-    nodeSelector: {}
-    ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
-    ## and uncomment this example block
-    #  label-key1: "label-value1"
-    #  label-key2: "label-value2"
-  
-  longhornDriver:
-    priorityClass: ~
-    tolerations: []
-    ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
-    ## and uncomment this example block
-    # - key: "key"
-    #   operator: "Equal"
-    #   value: "value"
-    #   effect: "NoSchedule"
-    nodeSelector: {}
-    ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
-    ## and uncomment this example block
-    #  label-key1: "label-value1"
-    #  label-key2: "label-value2"
-  
-  longhornUI:
-    priorityClass: ~
-    tolerations: []
-    ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
-    ## and uncomment this example block
-    # - key: "key"
-    #   operator: "Equal"
-    #   value: "value"
-    #   effect: "NoSchedule"
-    nodeSelector: {}
-    ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
-    ## and uncomment this example block
-    #  label-key1: "label-value1"
-    #  label-key2: "label-value2"
-  
-  resources: {}
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    # limits:
-    #  cpu: 100m
-    #  memory: 128Mi
-    # requests:
-    #  cpu: 100m
-    #  memory: 128Mi
-    #
-  
-  ingress:
-    enabled: false
-  
-  ## Specify override namespace, specifically this is useful for using longhorn as sub-chart
-  ## and its release namespace is not the `longhorn-system`
-  namespaceOverride: ""
-  
-  # Annotations to add to the Longhorn Manager DaemonSet Pods. Optional.
-  annotations: {}
-  
-  serviceAccount:
-    # Annotations to add to the service account
-    annotations: {}
-  

internalproxy/templates/argocd.yaml

@@ -1,37 +1,46 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: vault-ingress
+  name: argocd-ingress
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production
 spec:
   entryPoints:
     - websecure
   routes:
-  - match: Host(`vault.internal.durp.info`)
+  - match: Host(`argocd.internal.durp.info`)
     middlewares:
     - name: whitelist
       namespace: traefik  
     kind: Rule
     services:
-    - name: vault
-      port: 8200
-      scheme: http
+    - name: argocd-server
+      port: 443
+      scheme: https
   tls:
-    secretName: vault-tls  
+    secretName: argocd-tls  
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  name: argocd-server
+spec:
+  type: ExternalName
+  externalName: argocd-server.argocd.svc.cluster.local  
 
 ---
 
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: vault-tls
+  name: argocd-tls
 spec:
-  secretName: vault-tls
+  secretName: argocd-tls
   issuerRef:
     name: letsencrypt-production
     kind: ClusterIssuer
-  commonName: "vault.internal.durp.info"
+  commonName: "argocd.internal.durp.info"
   dnsNames:
-  - "vault.internal.durp.info"  
-
+  - "argocd.internal.durp.info"  

internalproxy/templates/gitea.yaml

@@ -0,0 +1,9 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: gitea-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: gitea.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

internalproxy/templates/guac.yaml

@@ -0,0 +1,71 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: guac-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: guac.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: guac
+spec:
+  ports:
+  - name: app
+    port: 8082
+    protocol: TCP
+    targetPort: 8082
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: guac
+subsets:
+- addresses:
+  - ip: 192.168.20.253
+  ports:
+  - name: app
+    port: 8082
+    protocol: TCP
+
+---    
+
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: guac-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`guac.durp.info`) && PathPrefix(`/`)
+    kind: Rule
+    services:
+    - name: guac
+      port: 8082
+  tls:
+    secretName: guac-tls
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: guac-tls
+spec:
+  secretName: guac-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "guac.durp.info"
+  dnsNames:
+  - "guac.durp.info"  

internalproxy/templates/jellyfin.yaml

@@ -0,0 +1,9 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: jellyfin-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: jellyfin.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info  

internalproxy/templates/kasm.yaml

@@ -0,0 +1,9 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: kasm-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: kasm.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

internalproxy/templates/plex.yaml

@@ -0,0 +1,9 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: plex-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: plex.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info  

internalproxy/templates/registry-internal.yaml

@@ -5,9 +5,9 @@ metadata:
 spec:
   ports:
   - name: app
-    port: 5000
+    port: 5001
     protocol: TCP
-    targetPort: 5000
+    targetPort: 5001
   clusterIP: None
   type: ClusterIP
 
@@ -22,7 +22,7 @@ subsets:
   - ip: 192.168.20.253
   ports:
   - name: app
-    port: 5000
+    port: 5001
     protocol: TCP
 
 ---    
@@ -39,9 +39,9 @@ spec:
     kind: Rule
     services:
     - name: registry-internal
-      port: 5000
+      port: 5001
   tls:
-    secretName: registry-internal-tls
+    secretName: registry-tls
 
 ---
 
@@ -54,6 +54,6 @@ spec:
   issuerRef:
     name: letsencrypt-production
     kind: ClusterIssuer
-  commonName: "registry.internal.durp.info"
+  commonName: "registry.durp.info"
   dnsNames:
-  - "registry.internal.durp.info"
+  - "registry.durp.info"  

kube-prometheus-stack/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
 - name: kube-prometheus-stack
   repository: https://prometheus-community.github.io/helm-charts
-  version: 63.1.0
+  version: 40.5.0

kubeclarity/Chart.yaml

@@ -8,4 +8,4 @@ appVersion: 0.0.1
 dependencies:
 - name: kubeclarity
   repository: https://openclarity.github.io/kubeclarity
-  version: 2.23.3
+  version: 2.22.0

longhorn/Chart.yaml

@@ -9,4 +9,4 @@ appVersion: "1.16.0"
 dependencies:
 - name: longhorn
   repository: https://charts.longhorn.io
-  version: 1.7.2
+  version: 1.3.2

longhorn/values.yaml

@@ -57,7 +57,7 @@ longhorn:
           {
             "name":"backup", 
             "task":"backup", 
-            "cron":"0 0 * * ?", 
+            "cron":"0 */6 * * *", 
             "retain":24
           }
         ]'
@@ -76,7 +76,7 @@ longhorn:
     snapshotterReplicaCount: ~
   
   defaultSettings:
-    backupTarget: S3://longhorn-master@us-east-1/
+    backupTarget: S3://longhorn@us-east-1/
     backupTargetCredentialSecret: longhorn-backup-token-secret
     allowRecurringJobWhileVolumeDetached: ~
     createDefaultDiskLabeledNodes: ~

master/argocd/templates/argocd.yaml

@@ -1,59 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/argocd
-  destination:
-    namespace: argocd
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 
-
----
-
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: argocd-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`argocd.internal.durp.info`)
-      middlewares:
-        - name: whitelist
-          namespace: traefik
-      kind: Rule
-      services:
-        - name: argocd-server
-          port: 443
-          scheme: https
-  tls:
-    secretName: argocd-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: argocd-tls
-spec:
-  secretName: argocd-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "argocd.internal.durp.info"
-  dnsNames:
-    - "argocd.internal.durp.info"

master/argocd/templates/bitwarden.yaml

@@ -1,23 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: bitwarden
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/bitwarden
-    directory:
-      recurse: true
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: bitwarden
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: false
-    syncOptions:
-      - CreateNamespace=true   
-

master/argocd/templates/crossplane.yml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: crossplane
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/crossplane
-  destination:
-    namespace: crossplane
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 

master/argocd/templates/durpapi.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: durpapi
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/durpapi
-  destination:
-    namespace: durpapi
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 

master/argocd/templates/heimdall.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: heimdall
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/heimdall
-  destination:
-    namespace: heimdall
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 

master/argocd/templates/krakend.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: krakend
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/krakend
-  destination:
-    namespace: krakend
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 

master/argocd/templates/littlelink.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: littlelink
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/littlelink
-    directory:
-      recurse: true
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: littlelink
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true        

master/argocd/templates/longhorn.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: longhorn-system
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/longhorn
-  destination:
-    namespace: longhorn-system
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 
-

master/argocd/templates/nfs-client.yaml

@@ -1,23 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: nfs-client
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/nfs-client
-    directory:
-      recurse: true
-  destination:
-    namespace: nfs-client
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 
-

master/argocd/templates/open-webui.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: open-webui
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/open-webui
-  destination:
-    namespace: open-webui
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true  
-    syncOptions:
-      - CreateNamespace=true 

master/argocd/templates/secrets.yaml

@@ -1,17 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: vault-argocd
-  labels:
-    app.kubernetes.io/part-of: argocd
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: client-secret
-  data:
-  - secretKey: clientSecret
-    remoteRef:
-      key: secrets/argocd/authentik
-      property: clientsecret

master/argocd/templates/vault.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: vault
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: master/vault
-  destination:
-    namespace: vault
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-  ignoreDifferences:
-    - group: admissionregistration.k8s.io
-      kind: MutatingWebhookConfiguration
-      jqPathExpressions:
-        - .webhooks[]?.clientConfig.caBundle

master/argocd/values.yaml

@@ -1,62 +0,0 @@
-argo-cd:
-
-  global:
-    revisionHistoryLimit: 1
-    image:
-      repository: registry.internal.durp.info/argoproj/argocd
-      imagePullPolicy: Always
-
-  server:
-    #extraArgs:
-    #  - --dex-server-plaintext
-    #  - --dex-server=argocd-dex-server:5556
-    # oidc.config: |
-    #   name: AzureAD
-    #   issuer: https://login.microsoftonline.com/TENANT_ID/v2.0
-    #   clientID: CLIENT_ID
-    #   clientSecret: $oidc.azuread.clientSecret
-    #   requestedIDTokenClaims:
-    #     groups:
-    #       essential: true
-    #   requestedScopes:
-    #     - openid
-    #     - profile
-    #     - email
-
-  dex:
-    enabled: true
-    image:
-      repository: registry.internal.durp.info/dexidp/dex
-      imagePullPolicy: Always
-
-  configs:
-    cm:
-      create: true
-      annotations: {}
-      url: https://argocd.internal.durp.info
-      oidc.tls.insecure.skip.verify: "true"
-      dex.config: |
-        connectors:
-          - config:
-              issuer: https://authentik.durp.info/application/o/argocd/
-              clientID: dbb8ffc06104fb6e7fac3e4ae7fafb1d90437625
-              clientSecret: $client-secret:clientSecret
-              insecureEnableGroups: true
-              scopes:
-                - openid
-                - profile
-                - email
-                - groups
-            name: authentik
-            type: oidc
-            id: authentik
-
-    rbac:
-      create: true
-      policy.csv: |
-        g, ArgoCD Admins, role:admin 
-      scopes: "[groups]"
-
-  server:
-    route: 
-      enabled: false

master/authentik/Chart.yaml

@@ -1,12 +0,0 @@
-apiVersion: v2
-name: authentik
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"
-
-dependencies:
-- name: authentik
-  repository: https://charts.goauthentik.io
-  version: 2024.8.3

master/authentik/templates/authentik-pv.yaml

@@ -1,24 +0,0 @@
-#apiVersion: v1
-#kind: PersistentVolume
-#metadata:
-#  annotations:
-#    pv.kubernetes.io/provisioned-by: durp.info/nfs
-#  finalizers:
-#  - kubernetes.io/pv-protection
-#  name: authentik-pv
-#spec:
-#  accessModes:
-#  - ReadWriteMany
-#  capacity:
-#    storage: 10Gi
-#  claimRef:
-#    apiVersion: v1
-#    kind: PersistentVolumeClaim
-#    name: authentik-pvc
-#    namespace: authentik
-#  nfs:
-#    path: /mnt/user/k3s/authentik
-#    server: 192.168.20.253
-#  persistentVolumeReclaimPolicy: Retain
-#  storageClassName: nfs-storage
-#  volumeMode: Filesystem

master/authentik/templates/authentik-pvc.yaml

@@ -1,18 +0,0 @@
-#apiVersion: v1
-#kind: PersistentVolumeClaim
-#metadata:
-#  labels:
-#    app.kubernetes.io/component: app
-#    app.kubernetes.io/instance: authentik
-#    app.kubernetes.io/managed-by: Helm
-#    app.kubernetes.io/name: authentik
-#    helm.sh/chart: authentik-2.14.4
-#  name: authentik-pvc
-#  namespace: authentik
-#spec:
-#  accessModes:
-#    - ReadWriteMany
-#  resources:
-#    requests:
-#      storage: 10Gi
-#  storageClassName: nfs-storage

master/authentik/templates/ingress.yaml

@@ -1,42 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: authentik-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`authentik.durp.info`) && PathPrefix(`/`) 
-    kind: Rule
-    services:
-    - name: authentik-server
-      port: 80
-  tls:
-    secretName: authentik-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: authentik-tls
-spec:
-  secretName: authentik-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "authentik.durp.info"
-  dnsNames:
-  - "authentik.durp.info" 
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: authentik-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: authentik.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

master/authentik/templates/secrets.yaml

@@ -1,28 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: authentik-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: db-pass
-  data:
-  - secretKey: dbpass
-    remoteRef:
-      key: secrets/authentik/database
-      property: dbpass
-  - secretKey: secretkey
-    remoteRef:
-      key: secrets/authentik/database
-      property: secretkey     
-  - secretKey: postgresql-postgres-password 
-    remoteRef:
-      key: secrets/authentik/database
-      property: dbpass
-  - secretKey: postgresql-password 
-    remoteRef:
-      key: secrets/authentik/database
-      property: dbpass
-        

master/authentik/values.yaml

@@ -1,56 +0,0 @@
-authentik:
-  global:
-    env: 
-      - name: AUTHENTIK_POSTGRESQL__PASSWORD
-        valueFrom:
-          secretKeyRef:
-            name: db-pass
-            key: dbpass
-      - name: AUTHENTIK_SECRET_KEY
-        valueFrom:
-          secretKeyRef:
-            name: db-pass
-            key: secretkey
-    revisionHistoryLimit: 1
-    image:
-      repository: registry.internal.durp.info/goauthentik/server
-      pullPolicy: Always
-  authentik:
-    outposts:
-      container_image_base: registry.internal.durp.info/goauthentik/%(type)s:%(version)s
-    postgresql:
-      host: '{{ .Release.Name }}-postgresql-hl'
-      name: "authentik"
-      user: "authentik"
-      port: 5432
-  server:
-    name: server
-    replicas: 3
-  worker:
-    replicas: 3
-  postgresql:
-    enabled: true
-    image:
-      registry: registry.internal.durp.info
-      repository: bitnami/postgresql
-      pullPolicy: Always
-    postgresqlUsername: "authentik"
-    postgresqlDatabase: "authentik"
-    existingSecret: db-pass 
-    persistence:
-      enabled: true
-      storageClass: longhorn
-      accessModes:
-        - ReadWriteMany
-  redis:
-    enabled: true
-    master:
-      persistence:
-        enabled: false    
-    image:
-      registry: registry.internal.durp.info
-      repository: bitnami/redis
-      pullPolicy: Always
-    architecture: standalone
-    auth:
-      enabled: false

master/bitwarden/Chart.yaml

@@ -1,7 +0,0 @@
-apiVersion: v2
-name: bitwarden
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"

master/bitwarden/templates/bitwarden-pv.yaml

@@ -1,25 +0,0 @@
-#apiVersion: v1
-#kind: PersistentVolume
-#metadata:
-#  annotations:
-#    pv.kubernetes.io/provisioned-by: durp.info/nfs
-#  finalizers:
-#  - kubernetes.io/pv-protection
-#  name: bitwarden-pv
-#spec:
-#  accessModes:
-#  - ReadWriteMany
-#  capacity:
-#    storage: 10Gi
-#  claimRef:
-#    apiVersion: v1
-#    kind: PersistentVolumeClaim
-#    name: bitwarden-pvc
-#    namespace: bitwarden
-#  nfs:
-#    path: /mnt/user/k3s/bitwarden
-#    server: 192.168.20.253
-#  persistentVolumeReclaimPolicy: Retain
-#  storageClassName: nfs-storage
-#  volumeMode: Filesystem
-#

master/bitwarden/templates/bitwarden-pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: bitwarden-pvc
-spec:
-  storageClassName: longhorn
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

master/bitwarden/templates/deployment.yaml

@@ -1,50 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: bitwarden
-  name: bitwarden
-  labels:
-    app: bitwarden
-spec:
-  selector:
-    matchLabels:
-      app: bitwarden
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: bitwarden
-    spec:
-      containers:
-      - name: bitwarden
-        image: registry.internal.durp.info/vaultwarden/server:1.32.7
-        imagePullPolicy: Always
-        volumeMounts:
-        - name: bitwarden-pvc
-          mountPath: /data
-          subPath: bitwaren-data              
-        ports:
-        - name: http
-          containerPort: 80
-        env:
-          - name: SIGNUPS_ALLOWED
-            value: "FALSE"
-          - name: INVITATIONS_ALLOWED
-            value: "FALSE"                      
-          - name: WEBSOCKET_ENABLED
-            value: "TRUE"          
-          - name: ROCKET_ENV
-            value: "staging"              
-          - name: ROCKET_PORT
-            value: "80"            
-          - name: ROCKET_WORKERS
-            value: "10"
-          - name: SECRET_USERNAME
-            valueFrom:
-              secretKeyRef:
-                name: bitwarden-secret
-                key: ADMIN_TOKEN
-      volumes:
-      - name: bitwarden-pvc
-        persistentVolumeClaim:
-          claimName: bitwarden-pvc             

master/bitwarden/templates/ingress.yaml

@@ -1,42 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: bitwarden-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`)
-    kind: Rule
-    services:
-    - name: bitwarden
-      port: 80
-  tls:
-    secretName: bitwarden-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: bitwarden-tls
-spec:
-  secretName: bitwarden-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "bitwarden.durp.info"
-  dnsNames:
-  - "bitwarden.durp.info"  
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  name: bitwarden-external-dns
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info
-spec:
-  type: ExternalName
-  externalName: durp.info

master/bitwarden/templates/secrets.yaml

@@ -1,16 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: bitwarden-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: bitwarden-secret
-  data:
-  - secretKey: ADMIN_TOKEN
-    remoteRef:
-      key: secrets/bitwarden/admin
-      property: ADMIN_TOKEN
-

master/bitwarden/templates/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: bitwarden
-spec:
-  ports:
-  - name: http
-    port: 80
-    targetPort: 80
-    protocol: TCP
-  selector:
-    app: bitwarden

master/crossplane/Chart.yaml

@@ -1,12 +0,0 @@
-apiVersion: v2
-name: crossplane
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0
-appVersion: "1.16.0"
-
-dependencies:
-- name: crossplane
-  repository: https://charts.crossplane.io/stable
-  version: 1.17.1

master/crossplane/templates/gitlab.yml

@@ -1,55 +0,0 @@
-apiVersion: pkg.crossplane.io/v1
-kind: Provider
-metadata:
-  name: provider-gitlab
-spec:
-  package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0
----
-
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitlab-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: gitlab-secret
-  data:
-  - secretKey: accesstoken
-    remoteRef:
-      key: secrets/gitlab/token
-      property: accesstoken
-
----
-
-#apiVersion: gitlab.crossplane.io/v1beta1
-#kind: ProviderConfig
-#metadata:
-#  name: gitlab-provider
-#spec:
-#  baseURL: https://gitlab.com/
-#  credentials:
-#    source: Secret
-#    secretRef:
-#      namespace: crossplane
-#      name: gitlab-secret
-#      key: accesstoken
-#
-#---
-#
-#apiVersion: projects.gitlab.crossplane.io/v1alpha1
-#kind: Project
-#metadata:
-#  name: example-project
-#spec:
-#  deletionPolicy: Orphan
-#  forProvider:
-#    name: "Example Project"
-#    description: "example project description"
-#  providerConfigRef:
-#    name: gitlab-provider
-#    policy:
-#      resolution: Optional
-#      resolve: Always

master/durpapi/Chart.yaml

@@ -1,13 +0,0 @@
-apiVersion: v2
-name: durpapi
-description: A Helm chart for Kubernetes
-type: application
-
-version: 0.1.0-dev0184
-appVersion: 0.1.0
-
-dependencies:
-- condition: postgresql.enabled
-  version: 12.5.*
-  repository: https://charts.bitnami.com/bitnami
-  name: postgresql

master/durpapi/templates/deployment.yaml

@@ -1,38 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Chart.Name }}
-  labels:
-    app: {{ .Chart.Name }}
-spec:
-  revisionHistoryLimit: 1
-  selector:
-    matchLabels:
-      app: {{ .Chart.Name }}
-  replicas: {{ .Values.deployment.hpa.minReplicas }}
-  template:
-    metadata:
-      labels:
-        app: {{ .Chart.Name }}
-    spec:
-      containers:
-      - name: api
-        image: "{{ .Values.deployment.image }}:{{ default .Chart.Version .Values.deployment.tag }}"
-        imagePullPolicy: {{ .Values.deployment.imagePullPolicy }}   
-        readinessProbe:
-          {{- toYaml .Values.deployment.probe.readiness | nindent 12 }}
-        livenessProbe:
-          {{- toYaml .Values.deployment.probe.liveness | nindent 12 }}
-        startupProbe:
-          {{- toYaml .Values.deployment.probe.startup | nindent 12 }}
-        ports:
-        - name: http
-          containerPort: {{ .Values.service.targetport }}
-        env:
-          - name: host
-            value: {{ .Values.swagger.host }}
-          - name: version
-            value: {{ default .Chart.Version .Values.deployment.tag }}
-        envFrom:
-        - secretRef:
-            name: {{ .Values.deployment.secretfile }} 

master/durpapi/templates/hpa.yaml

@@ -1,24 +0,0 @@
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: "{{ .Chart.Name }}-hpa"
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: {{ .Chart.Name }}
-  minReplicas: {{ .Values.deployment.hpa.minReplicas  }}
-  maxReplicas: {{ .Values.deployment.hpa.maxReplicas  }}
-  metrics:
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          type: Utilization
-          averageUtilization: 80
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 40

master/durpapi/templates/ingress.yaml

@@ -1,44 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: "{{ .Chart.Name }}-ingress"
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host("api.durp.info") && PathPrefix(`/api`)
-    kind: Rule
-    middlewares:
-      - name: jwt
-    services:
-    - name: "durpapi-service"
-      port: 80
-
----
-
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: "{{ .Chart.Name }}-swagger"
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host("api.durp.info") && PathPrefix(`/swagger`)
-    kind: Rule
-    services:
-    - name: "durpapi-service"
-      port: 80
-
----
-
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: jwt
-spec:
-  plugin:
-    jwt:
-      Required: true
-      Keys:
-        - https://authentik.durp.info/application/o/api/jwks

master/durpapi/templates/secrets.yaml

@@ -1,39 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: durpapi-secret
-spec:
-  secretStoreRef:
-    name: vault
-    kind: ClusterSecretStore
-  target:
-    name: durpapi-secret
-  data:
-  - secretKey: db_host
-    remoteRef:
-      key: secrets/durpapi/postgres
-      property: db_host
-  - secretKey: db_port
-    remoteRef:
-      key: secrets/durpapi/postgres
-      property: db_port
-  - secretKey: db_pass
-    remoteRef:
-      key: secrets/durpapi/postgres
-      property: db_pass
-  - secretKey: db_user
-    remoteRef:
-      key: secrets/durpapi/postgres
-      property: db_user                                                        
-  - secretKey: db_sslmode
-    remoteRef:
-      key: secrets/durpapi/postgres
-      property: db_sslmode
-  - secretKey: db_name
-    remoteRef:
-      key: secrets/durpapi/postgres
-      property: db_name
-  - secretKey: llamaurl
-    remoteRef:
-      key: secrets/durpapi/llamaurl
-      property: llamaurl

master/durpapi/templates/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: "{{ .Chart.Name }}-service"
-spec:
-  ports:
-  - name: http
-    port: {{ .Values.service.port }}
-    targetPort: {{ .Values.service.targetport }}
-    protocol: TCP
-  selector:
-    app: {{ .Chart.Name }}

master/durpapi/values.yaml

@@ -1,39 +0,0 @@
-ingress:
-  enabled: false
-deployment: 
-  image: registry.internal.durp.info/developerdurp/durpapi
-  secretfile: durpapi-secret
-  imagePullPolicy: Always
-  hpa:
-    minReplicas: 3
-    maxReplicas: 10
-  probe:
-    readiness:  
-      httpGet:
-        path: /health/gethealth
-        port: 8080
-    liveness: 
-      httpGet:
-        path: /health/gethealth
-        port: 8080
-    startup: 
-      httpGet:
-        path: /health/gethealth
-        port: 8080
-service:
-  type: ClusterIP
-  port: 80
-  targetport: 8080
-
-swagger:
-  host: api.durp.info
-postgresql:
-  enabled: true
-  auth:
-    existingSecret: durpapi-secret
-    secretKeys:
-      adminPasswordKey: db_pass
-      userPasswordKey: db_pass
-      replicationPasswordKey: db_pass
-    database: postgres
-    username: postgres

master/durpot/Chart.yaml

@@ -1,11 +0,0 @@
-apiVersion: v2
-name: durpapi
-description: A Helm chart for Kubernetes
-type: application
-version: 0.0.1
-appVersion: 0.0.1
-
-dependencies:
-- name: durpot
-  repository: https://gitlab.com/api/v4/projects/45025485/packages/helm/stable
-  version: 0.1.0-dev0038