commit 32641587be2032e9c06723ab85d1b643faefd13e parent 9f5ca36254b67ae6fcc94d483edc2bb68845646e Author: MTRNord <MTRNord@users.noreply.github.com> Date: Wed, 25 Feb 2026 21:01:48 +0100 cleanup Signed-off-by: MTRNord <MTRNord@users.noreply.github.com> Diffstat:
| D | apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml | | | 73 | ------------------------------------------------------------------------- |
| D | apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml | | | 116 | ------------------------------------------------------------------------------- |
| D | apps/talos_cluster/clickstack/kustomization.yaml | | | 10 | ---------- |
| D | apps/talos_cluster/clickstack/release.yaml | | | 73 | ------------------------------------------------------------------------- |
| D | apps/talos_cluster/clickstack/repository.yaml | | | 17 | ----------------- |
| D | apps/talos_cluster/clickstack/route.yaml | | | 32 | -------------------------------- |
| D | apps/talos_cluster/clickstack/secrets.yaml | | | 57 | --------------------------------------------------------- |
| D | apps/talos_cluster/immich/database-credentials.yaml | | | 32 | -------------------------------- |
| D | apps/talos_cluster/immich/kustomization.yaml | | | 8 | -------- |
| D | apps/talos_cluster/immich/release.yaml | | | 74 | -------------------------------------------------------------------------- |
| D | apps/talos_cluster/immich/repository.yaml | | | 13 | ------------- |
| D | apps/talos_cluster/immich/route.yaml | | | 32 | -------------------------------- |
| D | apps/talos_cluster/sentry/kustomization.yaml | | | 7 | ------- |
| D | apps/talos_cluster/sentry/release.yaml | | | 167 | ------------------------------------------------------------------------------- |
| D | apps/talos_cluster/sentry/repository.yaml | | | 8 | -------- |
| D | apps/talos_cluster/sentry/route.yaml | | | 32 | -------------------------------- |
16 files changed, 0 insertions(+), 751 deletions(-)
diff --git a/apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml b/apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml @@ -1,73 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: k8s-events-global-metrics-collector - namespace: clickstack -spec: - releaseName: k8s-events-global-metrics-collector - chart: - spec: - chart: opentelemetry-collector - sourceRef: - kind: HelmRepository - name: open-telemetry - interval: 60m - values: - # deployment.yaml - mode: deployment - - image: - repository: otel/opentelemetry-collector-contrib - tag: 0.145.0 - - # We only want one of these collectors - any more and we'd produce duplicate data - replicaCount: 1 - - presets: - kubernetesAttributes: - enabled: true - # When enabled the processor will extra all labels for an associated pod and add them as resource attributes. - # The label's exact name will be the key. - extractAllPodLabels: true - # When enabled the processor will extra all annotations for an associated pod and add them as resource attributes. - # The annotation's exact name will be the key. - extractAllPodAnnotations: true - # Configures the collector to collect kubernetes events. - # Adds the k8sobject receiver to the logs pipeline and collects kubernetes events by default. - # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-objects-receiver - kubernetesEvents: - enabled: true - # Configures the Kubernetes Cluster Receiver to collect cluster-level metrics. - # Adds the k8s_cluster receiver to the metrics pipeline and adds the necessary rules to ClusteRole. - # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-cluster-receiver - clusterMetrics: - enabled: true - - extraEnvs: - - name: HYPERDX_API_KEY - valueFrom: - secretKeyRef: - name: hyperdx-secret - key: HYPERDX_API_KEY - optional: true - - name: YOUR_OTEL_COLLECTOR_ENDPOINT - valueFrom: - configMapKeyRef: - name: otel-config-vars - key: YOUR_OTEL_COLLECTOR_ENDPOINT - - config: - exporters: - otlphttp: - endpoint: "${env:YOUR_OTEL_COLLECTOR_ENDPOINT}" - compression: gzip - headers: - authorization: "${env:HYPERDX_API_KEY}" - service: - pipelines: - logs: - exporters: - - otlphttp - metrics: - exporters: - - otlphttp diff --git a/apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml b/apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml @@ -1,116 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: k8s-log-metrics-collector - namespace: clickstack -spec: - releaseName: k8s-log-metrics-collector - chart: - spec: - chart: opentelemetry-collector - sourceRef: - kind: HelmRepository - name: open-telemetry - interval: 60m - values: - # daemonset.yaml - mode: daemonset - - image: - repository: otel/opentelemetry-collector-contrib - tag: 0.145.0 - - # Required to use the kubeletstats cpu/memory utilization metrics - clusterRole: - create: true - rules: - - apiGroups: - - "" - resources: - - nodes/proxy - verbs: - - get - - presets: - logsCollection: - enabled: true - hostMetrics: - enabled: true - # Configures the Kubernetes Processor to add Kubernetes metadata. - # Adds the k8sattributes processor to all the pipelines and adds the necessary rules to ClusterRole. - # More info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-attributes-processor - kubernetesAttributes: - enabled: true - # When enabled the processor will extra all labels for an associated pod and add them as resource attributes. - # The label's exact name will be the key. - extractAllPodLabels: true - # When enabled the processor will extra all annotations for an associated pod and add them as resource attributes. - # The annotation's exact name will be the key. - extractAllPodAnnotations: true - # Configures the collector to collect node, pod, and container metrics from the API server on a kubelet.. - # Adds the kubeletstats receiver to the metrics pipeline and adds the necessary rules to ClusterRole. - # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubeletstats-receiver - kubeletMetrics: - enabled: true - - extraEnvs: - - name: HYPERDX_API_KEY - valueFrom: - secretKeyRef: - name: hyperdx-secret - key: HYPERDX_API_KEY - optional: true - - name: YOUR_OTEL_COLLECTOR_ENDPOINT - valueFrom: - configMapKeyRef: - name: otel-config-vars - key: YOUR_OTEL_COLLECTOR_ENDPOINT - config: - receivers: - # Configures additional kubelet metrics - kubeletstats: - collection_interval: 20s - auth_type: "serviceAccount" - #endpoint: "${env:K8S_NODE_NAME}:10250" - #endpoint: "127.0.0.1:10250" - endpoint: "${env:K8S_NODE_IP}:10250" - insecure_skip_verify: true - metrics: - k8s.pod.cpu_limit_utilization: - enabled: true - k8s.pod.cpu_request_utilization: - enabled: true - k8s.pod.memory_limit_utilization: - enabled: true - k8s.pod.memory_request_utilization: - enabled: true - k8s.pod.uptime: - enabled: true - k8s.node.uptime: - enabled: true - k8s.container.cpu_limit_utilization: - enabled: true - k8s.container.cpu_request_utilization: - enabled: true - k8s.container.memory_limit_utilization: - enabled: true - k8s.container.memory_request_utilization: - enabled: true - container.uptime: - enabled: true - - exporters: - otlphttp: - endpoint: "${env:YOUR_OTEL_COLLECTOR_ENDPOINT}" - headers: - authorization: "${env:HYPERDX_API_KEY}" - compression: gzip - - service: - pipelines: - logs: - exporters: - - otlphttp - metrics: - exporters: - - otlphttp diff --git a/apps/talos_cluster/clickstack/kustomization.yaml b/apps/talos_cluster/clickstack/kustomization.yaml @@ -1,10 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: clickstack -resources: - - repository.yaml - - release.yaml - - route.yaml - - secrets.yaml - - k8s_log_metrics_collector.yaml - - k8s_events_global_metrics_collector.yaml diff --git a/apps/talos_cluster/clickstack/release.yaml b/apps/talos_cluster/clickstack/release.yaml @@ -1,73 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: clickstack - namespace: clickstack -spec: - releaseName: clickstack - chart: - spec: - chart: clickstack - sourceRef: - kind: HelmRepository - name: clickstack - interval: 60m - values: - global: - storageClassName: longhorn - hyperdx: - apiKey: ENC[AES256_GCM,data:8kskExN3VStHrMmbw1NTiCBwh6hrEv87EyAyAPR02+z28k25,iv:0QTlYvEYwypMLwicnVAKLFt84bwdUPQouPwFTrX+v0M=,tag:0h063JeXW7uvXgYFokQY/g==,type:str] - appUrl: https://clickstack.midnightthoughts.space - frontendUrl: https://clickstack.midnightthoughts.space - mongodb: - persistence: - enabled: true - size: 10Gi - clickhouse: - persistence: - enabled: true - dataSize: 10Gi - logSize: 5Gi - config: - users: - appUserPassword: ENC[AES256_GCM,data:UZQQ9Yg8yDlC2Hm5z/YYj2xw3fCdbV+2Brnn/UEB0B+wMiyGH9s4GupK0Q4/uvqIGkCjRvZH4DqG+higPyaJ,iv:kipnRldYvL/NaQTDwQuus1Skt2pV8TLXIGoiLrm0iFM=,tag:u+tv9dGEWVPmrnhfOWuStA==,type:str] - otelUserPassword: ENC[AES256_GCM,data:s0QRS+ZMfLg/eLJoqxpkiYxgNheTpj4hZwqdUynRSysSzL5dxVMwSZq/lRhJQ8FqmHP5miGETJNF11Y0kEUb,iv:VCXLiq961D/LJMl0X9/ccFisNXJbE+9RxvlqBcxCAeg=,tag:V7UxUW46qQlrVShZpKiEOw==,type:str] - otelUserName: otelcollector - # otel: - # customConfig: | - # processors: - # batch: - # tail_sampling: - # decission_wait: 30s - # num_traces: 20000 - # expected_new_traces_per_sec: 50 - # policies: - # - name: always_on_error - # type: error - # - name: slow_traces - # type: latency - # latency_threshold: 250ms - # - name: probabilistic_fallback - # type: probabilistic - # sampling_percentage: 5.0 - # # TODO: Unclear how to configure the pipelines as its hardcoded over at https://github.com/hyperdxio/hyperdx/blob/af3bbcf1a0f3d31a0a74b4f4fe3073af229a8df7/packages/api/src/opamp/controllers/opampController.ts#L4 possibly? -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbXJpK0Q0cjdXNFhwRWpP - Zzl5NmNGZzE5Sk5zeC9lVk9mMEdVUmQxNkRFCld6MVN3VEtLWlM4RW1Va3VocWpU - Ly9Ld2Q3Q0I1NGx2bEdHRkgvMXF4UEEKLS0tIGhmR2IwV0I3Z1lsRFZGek4vdzZC - RlNWRVQ1aDlCTmFDNkhHNlRJVEFZeGcKx+4o4lJK1ttkMTqf9WphCyp+454FEvcH - KMoTJYzYDFr3Ol/jwvOX3J+rwyn3of0GPNW+T6si9iBLd0dXegkWOQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-05T18:20:57Z" - mac: ENC[AES256_GCM,data:ijOmWUKboiCUFSKY1KfctWWyfS39bCGg06RwVrWU+ndO0AHV2Fgc++73/iVhQf+kcmAv+Bpp46aAVwVpcEWAiiGI1Bglu8aUWaehwPcE9ZDWJwqN+NIyXjT1PFOcQ4e8P+qihaPbbXkGafo31FbHJlKgaig8PsjwhqAKlD50MW8=,iv:QrmnkqoHdJRGwDOvYYukGI2vjid47J36q+MTR7RrJk0=,tag:lduLOK+lo/naVVHI266RaQ==,type:str] - pgp: [] - encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 diff --git a/apps/talos_cluster/clickstack/repository.yaml b/apps/talos_cluster/clickstack/repository.yaml @@ -1,17 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: clickstack - namespace: clickstack -spec: - interval: 60m - url: https://hyperdxio.github.io/helm-charts ---- -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: open-telemetry - namespace: clickstack -spec: - interval: 60m - url: https://open-telemetry.github.io/opentelemetry-helm-charts diff --git a/apps/talos_cluster/clickstack/route.yaml b/apps/talos_cluster/clickstack/route.yaml @@ -1,32 +0,0 @@ -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: clickstack - namespace: clickstack -spec: - parentRefs: - - name: envoy-gateway - namespace: envoy-gateway - hostnames: - - clickstack.midnightthoughts.space - rules: - - backendRefs: - - name: clickstack-app - port: 3000 - timeouts: - request: 240s - backendRequest: 0s ---- -apiVersion: gateway.envoyproxy.io/v1alpha1 -kind: BackendTrafficPolicy -metadata: - name: clickstack-compression - namespace: clickstack -spec: - targetRef: - group: gateway.networking.k8s.io - kind: HTTPRoute - name: clickstack - compression: - - type: Gzip - - type: Brotli diff --git a/apps/talos_cluster/clickstack/secrets.yaml b/apps/talos_cluster/clickstack/secrets.yaml @@ -1,57 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: hyperdx-secret - namespace: clickstack -type: Opaque -stringData: - HYPERDX_API_KEY: ENC[AES256_GCM,data:A+gj3fg/FMVjRuqMVUoYWqJWl25L4hZrw6YiQNlbtKKeMb5C,iv:hOFqFn2vV+mSNTZAu5OG/NVgPvAugSaSPJ2NG/9Tpj4=,tag:U4/K9zHnpGSpKnc+zIUhTQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ - VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5 - MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl - amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh - u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-07T08:48:49Z" - mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str] - pgp: [] - encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 ---- -# Configmap for the otel collector endpoint -apiVersion: v1 -kind: ConfigMap -metadata: - name: otel-config-vars - namespace: clickstack -data: - YOUR_OTEL_COLLECTOR_ENDPOINT: ENC[AES256_GCM,data:jKOaxrj5Fb+wNMZcybCMD/+eP2E+Wz0hOe8H6ctGq8mW/FD601kX2IP6azbfobz8NbgwvQc5RQrao05FuYDOY9Jq,iv:Bu71B4EPiwT+3nh5xO2J3u50Fmb1KduivEYPi8sS+Ak=,tag:evJx/AUSJzLiKvW9D92L5Q==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ - VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5 - MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl - amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh - u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-07T08:48:49Z" - mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str] - pgp: [] - encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 diff --git a/apps/talos_cluster/immich/database-credentials.yaml b/apps/talos_cluster/immich/database-credentials.yaml @@ -1,32 +0,0 @@ -# Secret -apiVersion: v1 -kind: Secret -metadata: - name: immich-database - namespace: immich -type: Opaque -stringData: - host: ENC[AES256_GCM,data:ReseNUa2mc2Cf7C17/rxjYh5K+EZkZzKBe03vMqIBcKv1seGnP5Nqzk2SG5Svgxyh/8b,iv:anQMpD9bLkyOSQeKWfIQvsVEiOUz8aW/jzXV4yJrs7g=,tag:OdFmwjnoKp5Jb1xERMTQ5A==,type:str] - username: ENC[AES256_GCM,data:i4xsvTHL,iv:l5Mfr9/oLlP3hqfIpDqhz8Z1KtmvgD2OxewEZChcCC8=,tag:AVOWSu1IjhzpfvtE/xTNKQ==,type:str] - password: ENC[AES256_GCM,data:oJuJ7ulDQoreyuML5en4UOrhwRiNBqUCgaMsxE8EDtKgZQGFmtH8O1FFiU2IUWKvYCf3/4hLAr0KPNhNbXqQWQ==,iv:Bcu4WnbNIs8QCoqIxUO0VhdCOrsYkk9g0+YE7yeVHB8=,tag:bKNZ4nQbZL/YDlEx8d11Ug==,type:str] - dbname: ENC[AES256_GCM,data:NYj7qrNm,iv:K867td+2mraT2ne7ga8zEsO7kRG35MCKAEZ9xdrpGbw=,tag:vURQGZYVxC4Buvk8z3D42A==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsU2doMSt0cWhSd2M2L3BN - VEp5UktUSWRGUWh6OHNUTlpxbThkTVBEaGlBCjFrait6N3o0RFJkVGFpSEg0VlI4 - TFYvb1htTHVaUmNES3pMTTN3bWRJUk0KLS0tIGFVY1RxdTZtMjNNZk1lNVJxNTRz - WUlrOGIrRWVOSFloTnlWMFdkQXpPWm8KwmzW87pNLHUEafGJG3tDyJv1aGgqv+5X - U86qdfLwxtg220rm6sq1+x0qdWRlAmmg1mij920dDL9lMZ2PqRT+TA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-12-20T22:26:54Z" - mac: ENC[AES256_GCM,data:Xf1XzBBgz4rPJqvrvpTmamE3f1pVLh9QYAxtQRqA0qKsauFiTXx2T+gjz91RDZozhI5dVu8rq+qfVEzIMCslwi3brBASeOIDZhozdkbS3PkCWNP5a/YaL727QZ7uViIIu+SoxyBZMYIMPyUSHG3Q3H77Ad6ICvE2PmNBMv3roeo=,iv:ToqbvhLxbeikmioryuJUs2ptc2MSPMrNT0h1hA9frSE=,tag:susZLm6jz8D6iqGq9uvTFw==,type:str] - pgp: [] - encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 diff --git a/apps/talos_cluster/immich/kustomization.yaml b/apps/talos_cluster/immich/kustomization.yaml @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: immich -resources: - - repository.yaml - - database-credentials.yaml - - release.yaml - - route.yaml diff --git a/apps/talos_cluster/immich/release.yaml b/apps/talos_cluster/immich/release.yaml @@ -1,74 +0,0 @@ -# PVC for immich -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: immmich-pvc - namespace: immich -spec: - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi - storageClassName: longhorn ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: immich - namespace: immich -spec: - releaseName: immich - chartRef: - kind: OCIRepository - name: immich - namespace: immich - interval: 60m - values: - controllers: - main: - containers: - main: - image: - tag: "v2.5.6" - server: - controllers: - main: - containers: - main: - env: - DB_HOSTNAME: - valueFrom: - secretKeyRef: - name: immich-database - key: host - DB_USERNAME: - valueFrom: - secretKeyRef: - name: immich-database - key: username - DB_PASSWORD: - valueFrom: - secretKeyRef: - name: immich-database - key: password - DB_DATABASE_NAME: - valueFrom: - secretKeyRef: - name: immich-database - key: dbname - immich: - persistence: - library: - existingClaim: immmich-pvc - configuration: {} - configurationKind: ConfigMap - valkey: - enabled: true - persistence: - data: - enabled: true - size: 1Gi - type: emptyDir - accessMode: ReadWriteOnce - storageClass: longhorn diff --git a/apps/talos_cluster/immich/repository.yaml b/apps/talos_cluster/immich/repository.yaml @@ -1,13 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: OCIRepository -metadata: - name: immich - namespace: immich -spec: - interval: 60m - url: oci://ghcr.io/immich-app/immich-charts/immich - layerSelector: - mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip" - operation: copy - ref: - semver: "^0.10.3" diff --git a/apps/talos_cluster/immich/route.yaml b/apps/talos_cluster/immich/route.yaml @@ -1,32 +0,0 @@ -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: immich - namespace: immich -spec: - parentRefs: - - name: envoy-gateway - namespace: envoy-gateway - hostnames: - - immich.mtrnord.blog - rules: - - backendRefs: - - name: immich-server - port: 2283 - timeouts: - request: 240s - backendRequest: 0s ---- -apiVersion: gateway.envoyproxy.io/v1alpha1 -kind: BackendTrafficPolicy -metadata: - name: immich-compression - namespace: immich -spec: - targetRef: - group: gateway.networking.k8s.io - kind: HTTPRoute - name: immich - compression: - - type: Gzip - - type: Brotli diff --git a/apps/talos_cluster/sentry/kustomization.yaml b/apps/talos_cluster/sentry/kustomization.yaml @@ -1,7 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: sentry -resources: - - repository.yaml - - release.yaml - - route.yaml diff --git a/apps/talos_cluster/sentry/release.yaml b/apps/talos_cluster/sentry/release.yaml @@ -1,167 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: sentry - namespace: sentry -spec: - releaseName: sentry - chart: - spec: - chart: sentry - version: 28.1.x - sourceRef: - kind: HelmRepository - name: sentry - interval: 60m - timeout: 240m0s - values: - ipv6: true - user: - create: true - email: mtrnord@nordgedanken.dev - password: ENC[AES256_GCM,data:WTwV6ujtww48,iv:jqWkKwcQYBVmVbrMNWelAPdM99HxeLoKH01wr8HMELM=,tag:79lhm3xMAYWJgDSPp2g6XA==,type:str] - # this is required on the first installation, as sentry has to be initialized first - # recommended to set false for updating the helm chart afterwards, - # as you will have some downtime on each update if it's a hook - # deploys relay & snuba consumers as post hooks - asHook: false - hooks: - dbCheck: - image: - repository: toolbelt/netcat - tag: latest - pullPolicy: Always - vroom: - persistence: - enabled: true - size: 5Gi - accessMode: ReadWriteMany - storageClass: longhorn - geodata: - persistence: - storageClass: longhorn - sentry: - singleOrganization: true - web: - enabled: true - features: - orgSubdomains: false - enableProfiling: false - enableSessionReplay: true - enableFeedback: true - enableSpan: true - enableUptime: false - ingestFeedback: - enabled: true - system: - url: https://sentry.mtrnord.blog - adminEmail: ENC[AES256_GCM,data:FZctGNse1Ruv7krqJxAu2k36/2cBkaS/7/UGqjKZ,iv:DGhUqYRIYcWQAOTTmFd1B8R4+MCYP16Crndfv2i7Tbk=,tag:TdVeCP6gsTCDwmcZMBswqg==,type:str] - public: false - secretKey: ENC[AES256_GCM,data:25IVzNtqa8GMGbAcvt52UtmkgA1oQcm1qLudb0O4Nf3fmZFGzW3rgmhH3Xy6n0wBrZA+21n0s0buRsvDaF2Nxg==,iv:I6GpOFvrOcyuY+sczCqWpfNCwdZxt4Rk+svKBEGmhv0=,tag:xHaP5EHDcJrH+XqN0dXRgw==,type:str] - mail: - backend: smtp - host: mail.midnightthoughts.space - useTls: "true" - useSsl: "false" - port: "587" - username: support@midnightthoughts.space - password: ENC[AES256_GCM,data:jBgw6wgU8wHO22oHOjigdDD0jfr1ZN4vhSQxoDa/YFgAoFferHEYc724gamTuoEOTSB8oBkIQduNm65PemRnrw==,iv:Iq8fpC0SuMnXN19AePDzU564oyvGTdZDJb3UYrl0mlE=,tag:prH26pGX0bpOBMvRUr/RwA==,type:str] - from: support@midnightthoughts.space - github: - appId: ENC[AES256_GCM,data:9Nh2OIzQzw==,iv:ESWCjcEsDV4lILIpyp+MRDJHMJ4lxghhAB8TTRHADcw=,tag:03Y10Q6RuwxUOBMN7wFeUw==,type:str] - appName: Sentry Midnightthoughts - clientId: ENC[AES256_GCM,data:IV3fzL3qUSyWS5FFG5//GOprtJs=,iv:c/8aWMMcqnePEDLTF9et1pUbwcoXa39+on+TqUl6F7A=,tag:TCGyxJkWzfCM88Su16wCKA==,type:str] - clientSecret: ENC[AES256_GCM,data:Zp4uu9L5Hc7zqlORkPoQVeW5GPj1Ho/S1fjaw/PTuHQXPeBzC+qpEA==,iv:ILXi9XL7+FYskjv5OEk64Y8E+6motfARONM7XKH36Jw=,tag:MRB8KFpkdwua4XH2WcIfMg==,type:str] - privateKey: ENC[AES256_GCM,data:cb9g6j3UrDc93Yo7u+6OOmay10ES3Uy/Y6iLyR1t4jTOrCh1Ws1ArwvqFHWuEa7cd5NxEpkGUorglxgSLr8QXOsvM+mJwcSUtoS9cLHxK8PYOlF8oP0C6lUzYYqYeboCOLltCftV+4VKxYQt6jhWo+I44Tcd6ftVCOEESg68YlHmO6tn/wDYdAVvN0F/V7doRDjLoNs1iA+RyPoipWuJOayDtuLbN+POWLHoNPGuhgw38fVNaAtv3vp+fwxfU00mhGkw6u5+BkeEBOlf9dmwz1krETqw5HWNyHufboC+wMRBpyG4EYS8/Z6Ms4zfy6pm+SIr1EfCozYam5mlzJszAlH8YHFKpGUSH2n0pOYsmO+KEgMg40xiwR65pOkQNLzlFCfP3gu1+y1GtAC7nnRTHE1puE9LiflNR6eONW5vcvjWaJOxrnmoVJRkcGQnkIOCzs2PTQg4VMGgIuhNTyAKRGvsoeXQEEdCK3WUCA5KrwdxRGqORKlORV8qtbunVxXtazIbE9Ze82tHPB2jAS24IdxjHAg29zuKasPJT/TFeKxmNfB6qnLXDKn3KZ6sBq3hh2Fa6vP3xn2kXg+UBkeqY34ana9tX0o+oLtNHUB7UhGkOCEvggJ1BtbvvhTQ5fkCpp479AzeZq2bBwnvKNXTqLuJP4MEjit04VLP1Nrss0uDcShSxnWASAzeA+mkFucweFNJy4zcL2P0VdM4wzX3nZcR5AbfnS/gPA+yyPGrPkHQiTDuKLIxPcvFxvuLVr1Oe80HXpeDULyV6PXXuW7ojHHGEAXwyIwx1H74i1GafQxNm5MRP291ljaandFNZQxxYb8BcP5WKBPBA8910aXzuK13rt/54mznkwc0YOlhRPq+S9z2RUbw8skORb7xGbducabVJTxBpjxmSDQ/73Co+ffEwaOQY3XOmJGIpe8IUP6+iBGuXL3E3cThWS/sydFzkhiv58TjqxhO6i9dLh6nEP9n5sSpbLi283qD2H2xBag/QWUM1j6pgXFzF/IaaygmGx4/r+Aez//Ti1soWq7vqY9koZyDrBE7IYdGYdi9OWEuTGMhQlyB3bwsZ/Syya8WH10X2IyPrDbn3+679NhM9/Oq4RuA9p4zli5iJ6TAvGN3v0ybIIVWab+AcTTqd5e6dbHVxEyMIc3d+aoBjCZT60XIfP1/NwDxY66Dlo1svZvwc44yBIvKdYvqRUhOjDrLGI/Vw2SgLD9xsfY1yLqpxhGRhEoqgL88h5IIeOzs+XWD2O5Z0n7X2hoLOGLAuqCs00A/ovsFE3jtWPb2GOC9GjN4siTtL0Dcnm6M+sIXIAmiV9JRM67wjtAqrfxA9RCspKTeNE5kVT0B3tNXT5IJSCe/XRUISJrya6fbWVphQoEbT3UQJpEMXIez5zux0Xp24vPv6YDFzIV5he8LWDPKAmL48X32cuKf/8fJlencdY6IPr/2rrEo/mLsvwuT7YP1aORWy+nJ55sdWP9/gWU7MMnSaBfcY+3q+pe1l8rbYhgKoKZaXmwrw5D2XeZiurZ+Acyda7FLmYjoisd0oAXr8PMxEPionFYJhawiMqtkXY7fZSRq2IfiCp51qjXYZn+7lKvAR8ktTPQf+uF6udSPWaRdd/gXiNpBdy5q5eNXJouoBxkqMJZaeVr4eVVqMv0AiRApKXLSXQ0jZdfLii7l8D4RD4OoqASJO3NgKCbb477sAYvfmfbxhjKCzIptBkK55s82gA34PboCmqPwSNQPaKa6eKwRKICVDfL0Uoa8igvp2Y8D5uMmVBQDPJBlXV+AsGwDM6ExA+GxK36bn6Uu+h5csDPc1ej8NfifpbVfnxkKNayA10OEKUr1Wdk42ch4UOnPAfUmG0Qw3NLVy1qM+nUZxqv+DLrvatDj6yLaVBumNx3NVseslRvQoIsBbq4xgpBGuvsUf9enPiSTO1+Mz+iQ940DutMPZGjdIc25JUwMhUxm+3rEfFHNfhTKEdTjiHOQiz0rzlfbTNsIXj/AvQ7DdHcI6IUBXgVy3uTJ0fQM2Cv7y+rcCa7iewT2ErGNG02Z2pedgc4dWpWDvprUOgHAcM/sUxFD1RpeV27D2CkDsiWvxtvH8+uUSOc+YI4rCu6eWa3Btf8Em6H5xSVhdA136DTpg60uFtnR1dY1BtlVIwWt1bh/RG9CGcVv8rh9dOVdiIuRUS1G6lWnH2UmuQ3IAzp7gLyMJPyNbI3O88bFtmVsq2TW8vXr9OZM32Q=,iv:td50Un7ITMuMeamp2xI1ZirEfueVLy7riN9eLYAb0Ic=,tag:qa762/Nkwx82V8IBAeDwzg==,type:str] - webhookSecret: ENC[AES256_GCM,data:PfkiR6C2T+GdkeDjKm4d8walePHqqWYrLCPLDyKejjqrwX9RLFQPIfkHw66d0rxA9Q3/LjXXx1++8cT+J3Ie6w==,iv:5MJqZdTdgYBZt53MXwE6jgCiBc43AvyT8BTruhz+9w4=,tag:DvmVrko9Omq1dwS9L4Izdg==,type:str] - auth: - register: false - ingress: - enabled: false - filestore: - backend: filesystem - filesystem: - persistence: - enabled: true - size: 5Gi - accessMode: ReadWriteMany - storageClass: longhorn - persistentWorkers: true - clickhouse: - clickhouse: - persistentVolumeClaim: - enabled: true - dataPersistentVolume: - storage: 20Gi - storageClassName: longhorn - accessModes: - - ReadWriteMany - - ReadWriteOnce - zookeeper: - persistence: - enabled: true - size: 8Gi - accessModes: - - ReadWriteMany - - ReadWriteOnce - storageClass: longhorn - redis: - master: - persistence: - enabled: true - size: 5Gi - accessModes: - - ReadWriteOnce - - ReadWriteMany - storageClass: longhorn - replica: - persistence: - enabled: true - size: 5Gi - accessModes: - - ReadWriteOnce - - ReadWriteMany - storageClass: longhorn - postgresql: - enabled: false - externalPostgresql: - port: 5432 - username: sentry - password: ENC[AES256_GCM,data:poj0izLlXR7y6xZI8CHrXV/COL6q8kUvNNs5hEr2/LXveA4YKF1zlQMELUOzMyUwHvovjTBoKXEy9UQ2Rrf/WQ==,iv:U/c72XqWoeKflHx5sWKP/iz1ZMLdS1SmjW0fQKr/jlo=,tag:Mnu9FLOjXcIYQoX0eJQmHA==,type:str] - database: sentry - connMaxAge: 600 - host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local - sslMode: require - rabbitmq: - enabled: false - kafka: - controller: - persistence: - enabled: true - size: 10Gi - accessModes: - - ReadWriteMany - - ReadWriteOnce - storageClass: longhorn - logPersistence: - enabled: false -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhQXBKUG1SWmliSUU2Z1Rn - dWdlTTVkbUllcXVxbzhQMnVBNzhHNzJETEdnCjdVZ1crSjROT1lnM0cweWcrUzZF - cThwQW44TGNQUDkrdU5PNTZIc3laTzQKLS0tIEkzQnFUdTZteGxpNElHYXlxbjdZ - Y3BhYXZ4RmpHcUpEQ2ZSK3NZUEtwekEKfudmrfTPHxLJtILnz3B7/uWKwBgrIE3W - lchyeAAESQ9KFFnYuCaKuIvxM48x1KLN4LkrWnV4BPWCsx6wryV6fA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-12-16T11:05:34Z" - mac: ENC[AES256_GCM,data:hxsmpfgd4CQs7eY9iYyn066NXd0nqdm/WRNuNV9LdgoBR2gdyI9t/a3JOoc5gNXC+qQyIG86VUpVkMUiiHZBFkgMqk65DAeoupat1d6pZ7+4G0YJWRTRWNmNrQe0eSdLx0Bg1xyxuN8tkYZnmg/yWPvj/EDzHOdcUQCUMthz02A=,iv:tNoFVh1X0OsiW9yMTsJauekxEl7R9RBxQgQ4t6HiB3M=,tag:DBYh6FgHcG9EtEx2JiPhdA==,type:str] - pgp: [] - encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 diff --git a/apps/talos_cluster/sentry/repository.yaml b/apps/talos_cluster/sentry/repository.yaml @@ -1,8 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: sentry - namespace: sentry -spec: - interval: 60m - url: https://sentry-kubernetes.github.io/charts diff --git a/apps/talos_cluster/sentry/route.yaml b/apps/talos_cluster/sentry/route.yaml @@ -1,32 +0,0 @@ -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: sentry - namespace: sentry -spec: - parentRefs: - - name: envoy-gateway - namespace: envoy-gateway - hostnames: - - sentry.mtrnord.blog - rules: - - backendRefs: - - name: sentry-nginx - port: 80 - timeouts: - request: 240s - backendRequest: 0s ---- -apiVersion: gateway.envoyproxy.io/v1alpha1 -kind: BackendTrafficPolicy -metadata: - name: sentry-compression - namespace: sentry -spec: - targetRef: - group: gateway.networking.k8s.io - kind: HTTPRoute - name: sentry - compression: - - type: Gzip - - type: Brotli