Update Helm release crowdsec to v0.21.0

dmz/crowdsec/Chart.yaml

@@ -8,4 +8,4 @@ appVersion: 0.0.1
 dependencies:
   - name: crowdsec
     repository: https://crowdsecurity.github.io/helm-charts
-    version: 0.19.4
+    version: 0.21.0

dmz/internalproxy/templates/octopus.yaml

@@ -0,0 +1,40 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: octopus-ingress
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`octopus.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: infra-cluster
+          port: 443
+  tls:
+    secretName: octopus-tls
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: octopus-tls
+spec:
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  secretName: octopus-tls
+  commonName: "octopus.durp.info"
+  dnsNames:
+    - "octopus.durp.info"
+
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: octopus-external-dns
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: octopus.durp.info
+spec:
+  type: ExternalName
+  externalName: durp.info

dmz/internalproxy/templates/portainer.yaml

@@ -1,3 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: portainer
+spec:
+  ports:
+  - name: app
+    port: 9443
+    protocol: TCP
+    targetPort: 9443
+  clusterIP: None
+  type: ClusterIP
+
+---
+
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: portainer
+subsets:
+- addresses:
+  - ip: 192.168.20.104
+  ports:
+  - name: app
+    port: 9443
+    protocol: TCP
+
+---    
+
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -12,8 +41,9 @@ spec:
       #  namespace: traefik
     kind: Rule
     services:
-      - name: infra-cluster
+    - name: portainer
-        port: 443
+      port: 9443
+      scheme: https
   tls:
     secretName: portainer-tls
 

infra/argocd/templates/argocd-crossplane.yaml

@@ -0,0 +1,101 @@
+#apiVersion: external-secrets.io/v1
+#kind: ExternalSecret
+#metadata:
+#  name: argocd-secret-crossplane
+#spec:
+#  secretStoreRef:
+#    name: vault
+#    kind: ClusterSecretStore
+#  target:
+#    name: argocd-secret-crossplane
+#  data:
+#    - secretKey: authToken
+#      remoteRef:
+#        key: kv/argocd/provider-argocd
+#        property: token
+#
+#---
+#apiVersion: external-secrets.io/v1
+#kind: ExternalSecret
+#metadata:
+#  name: prod-kubeconfig
+#spec:
+#  secretStoreRef:
+#    name: vault
+#    kind: ClusterSecretStore
+#  target:
+#    name: prod-kubeconfig
+#  data:
+#    - secretKey: kubeconfig
+#      remoteRef:
+#        key: kv/argocd/prd
+#        property: kubeconfig
+#
+#---
+#apiVersion: argocd.crossplane.io/v1alpha1
+#kind: ProviderConfig
+#metadata:
+#  name: argocd-provider
+#spec:
+#  serverAddr: argocd-server.argocd.svc:443
+#  insecure: true
+#  plainText: false
+#  credentials:
+#    source: Secret
+#    secretRef:
+#      namespace: argocd
+#      name: argocd-secret-crossplane
+#      key: authToken
+#
+#---
+#apiVersion: cluster.argocd.crossplane.io/v1alpha1
+#kind: Cluster
+#metadata:
+#  name: prd
+#  labels:
+#    purpose: prd
+#spec:
+#  forProvider:
+#    name: prd
+#    config:
+#      kubeconfigSecretRef:
+#        name: prod-kubeconfig
+#        namespace: argocd
+#        key: kubeconfig
+#  providerConfigRef:
+#    name: argocd-provider
+#
+#---
+#apiVersion: external-secrets.io/v1
+#kind: ExternalSecret
+#metadata:
+#  name: dev-kubeconfig
+#spec:
+#  secretStoreRef:
+#    name: vault
+#    kind: ClusterSecretStore
+#  target:
+#    name: dev-kubeconfig
+#  data:
+#    - secretKey: kubeconfig
+#      remoteRef:
+#        key: kv/argocd/dev
+#        property: kubeconfig
+#
+#---
+#apiVersion: cluster.argocd.crossplane.io/v1alpha1
+#kind: Cluster
+#metadata:
+#  name: dev
+#  labels:
+#    purpose: dev
+#spec:
+#  forProvider:
+#    name: dev
+#    config:
+#      kubeconfigSecretRef:
+#        name: dev-kubeconfig
+#        namespace: argocd
+#        key: kubeconfig
+#  providerConfigRef:
+#    name: argocd-provider

infra/argocd/templates/crowdsec.yaml

@@ -0,0 +1,20 @@
+#apiVersion: argoproj.io/v1alpha1
+#kind: Application
+#metadata:
+#  name: crowdsec
+#  namespace: argocd
+#spec:
+#  project: default
+#  source:
+#    repoURL: https://gitlab.com/developerdurp/homelab.git
+#    targetRevision: main
+#    path: dmz/crowdsec
+#  destination:
+#    namespace: crowdsec
+#    name: dmz
+#  syncPolicy:
+#    automated:
+#      prune: true
+#      selfHeal: true
+#    syncOptions:
+#      - CreateNamespace=true

infra/argocd/templates/octopusdeploy.yaml

@@ -0,0 +1,42 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: octopusdeploy
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: main
+    path: infra/octopusdeploy
+  destination:
+    namespace: octopusdeploy
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: octopusdeploy-agent
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitlab.com/developerdurp/homelab.git
+    targetRevision: main
+    path: infra/octopus-agent
+  destination:
+    namespace: octopus-agent
+    name: in-cluster
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

infra/argocd/templates/portainer.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: portainer
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://gitlab.com/developerdurp/homelab.git
-    targetRevision: main
-    path: infra/portainer
-  destination:
-    namespace: portainer
-    name: in-cluster
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

infra/octopus-agent/Chart.yaml

@@ -0,0 +1,12 @@
+apiVersion: v2
+name: octopusdeploy
+description: A Helm chart for Kubernetes
+type: application
+
+version: 0.1.0
+appVersion: "1.16.0"
+
+dependencies:
+  - name: kubernetes-agent
+    repository: oci://registry-1.docker.io/octopusdeploy
+    version: 2.*.*

infra/octopus-agent/templates/secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault
+
+---
+
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: agent-token
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: agent-token
+  data:
+    - secretKey: bearer-token
+      remoteRef:
+        key: kv/octopusdeploy
+        property: infra-bearer-token
+

infra/octopus-agent/values.yaml

@@ -0,0 +1,19 @@
+kubernetes-agent:
+  agent:
+    bearerTokenSecretName: agent-token
+    acceptEula: "Y"
+    serverUrl: "https://octopus.durp.info/"
+    serverCommsAddresses:
+      - "https://octopus-deploy-node0.octopusdeploy.svc.cluster.local:10943/"
+      - "https://octopus-deploy-node1.octopusdeploy.svc.cluster.local:10943/"
+      - "https://octopus-deploy-node2.octopusdeploy.svc.cluster.local:10943/"
+    space: "Default"
+    name: "infra"
+    deploymentTarget:
+      initial:
+        environments:
+          - "development"
+          - "production"
+        tags:
+          - "infra-cluster"
+      enabled: "true"

infra/octopusdeploy/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-name: portainer
+name: octopusdeploy
 description: A Helm chart for Kubernetes
 type: application
 
@@ -7,6 +7,6 @@ version: 0.1.0
 appVersion: "1.16.0"
 
 dependencies:
-  - name: portainer
+  - name: octopusdeploy-helm
-    repository: https://portainer.github.io/k8s/
+    repository: oci://ghcr.io/octopusdeploy
-    version: 2.33.5
+    version: 1.7.0

infra/octopusdeploy/templates/ingress.yaml

@@ -0,0 +1,32 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: octopus-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`octopus.durp.info`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: octopusdeploy-octopus-deploy
+          port: 80
+  tls:
+    secretName: octopus-tls
+
+---
+
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: octopus-tls
+spec:
+  secretName: octopus-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: "octopus.durp.info"
+  dnsNames:
+    - "octopus.durp.info"

infra/octopusdeploy/templates/secrets.yaml

@@ -0,0 +1,106 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vault
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: octopusdeploy-adminpassword
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: octopusdeploy-adminpassword
+  data:
+    - secretKey: secret
+      remoteRef:
+        key: kv/octopusdeploy
+        property: adminpassword
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: octopusdeploy-adminusername
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: octopusdeploy-adminusername
+  data:
+    - secretKey: secret
+      remoteRef:
+        key: kv/octopusdeploy
+        property: adminusername
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: octopusdeploy-connectionstring
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: octopusdeploy-connectionstring
+  data:
+    - secretKey: secret
+      remoteRef:
+        key: kv/octopusdeploy
+        property: connectionstring
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: octopusdeploy-masterkey
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: octopusdeploy-masterkey
+  data:
+    - secretKey: secret
+      remoteRef:
+        key: kv/octopusdeploy
+        property: masterkey
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: octopusdeploy-sapassword
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: octopusdeploy-sapassword
+  data:
+    - secretKey: secret
+      remoteRef:
+        key: kv/octopusdeploy
+        property: sapassword
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: octopusdeploy-licensekey
+spec:
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: octopusdeploy-licensekey
+  data:
+    - secretKey: secret
+      remoteRef:
+        key: kv/octopusdeploy
+        property: licensekey

infra/octopusdeploy/values.yaml

@@ -0,0 +1,10 @@
+octopusdeploy-helm:
+  octopus:
+    image:
+      repository: registry.durp.info/octopusdeploy/octopusdeploy
+      tag: 2025.3
+    createSecrets: false
+    acceptEula: Y
+    replicaCount: 3
+  mssql:
+    enabled: true

infra/portainer/templates/ingress.yaml

@@ -1,30 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: portainer-ingress
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`)
-      kind: Rule
-      services:
-        - name: portainer
-          port: 9000
-  tls:
-    secretName: portainer-tls
-
----
-
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: portainer-tls
-spec:
-  secretName: portainer-tls
-  issuerRef:
-    name: vault-issuer
-    kind: ClusterIssuer
-  commonName: "portainer.internal.durp.info"
-  dnsNames:
-    - "portainer.internal.durp.info"

infra/portainer/values.yaml

@@ -1,78 +0,0 @@
-portainer:
-  replicaCount: 1
-  image:
-    repository: registry.durp.info/portainer/portainer-ce
-    tag: 2.33.5
-    pullPolicy: Always
-
-  imagePullSecrets: []
-
-  nodeSelector: {}
-  tolerations: []
-
-  serviceAccount:
-    annotations: {}
-    name: portainer-sa-clusteradmin
-
-  # This flag provides the ability to enable or disable RBAC-related resources during the deployment of the Portainer application
-  # If you are using Portainer to manage the K8s cluster it is deployed to, this flag must be set to true
-  localMgmt: true
-
-  service:
-    # Set the httpNodePort and edgeNodePort only if the type is NodePort
-    # For Ingress, set the type to be ClusterIP and set ingress.enabled to true
-    # For Cloud Providers, set the type to be LoadBalancer
-    type: NodePort
-    httpPort: 9000
-    httpsPort: 9443
-    httpNodePort: 30777
-    httpsNodePort: 30779
-    edgePort: 8000
-    edgeNodePort: 30776
-    annotations: {}
-
-  tls:
-    # If set, Portainer will be configured to use TLS only
-    force: false
-    # If set, will mount the existing secret into the pod
-    existingSecret: ""
-
-  trusted_origins:
-    # If set, Portainer will be configured to trust the domains specified in domains
-      enabled: false
-        # specify (in a comma-separated list) the domain(s) used to access Portainer when it is behind a reverse proxy
-          # example: portainer.mydomain.com,portainer.example.com
-      domains: ""
-
-  mtls:
-    # If set, Portainer will be configured to use mTLS only
-    enable: false
-    # If set, will mount the existing secret into the pod
-    existingSecret: ""
-
-  feature:
-    flags: []
-
-  ingress:
-    enabled: false
-    ingressClassName: ""
-    annotations: {}
-      # kubernetes.io/ingress.class: nginx
-      # Only use below if tls.force=true
-      # nginx.ingress.kubernetes.io/backend-protocol: HTTPS
-    # Note: Hosts and paths are of type array
-    hosts:
-      - host:
-        paths: []
-        # - path: "/"
-    tls: []
-
-  resources: {}
-
-  persistence:
-    enabled: true
-    size: "10Gi"
-    annotations: {}
-    storageClass: longhorn
-    existingClaim:
-