commit 4215920e9d89887814cc44ba9b1c137e268f2e88
parent 76b417b1736f37f35564f43645b7f219853905a3
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Mon, 4 Aug 2025 13:52:00 +0200
Formatting
Diffstat:
4 files changed, 464 insertions(+), 464 deletions(-)
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -75,42 +75,42 @@ spec:
protocol: TCP
port: 25
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submissions
protocol: TCP
port: 465
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submission
protocol: TCP
port: 587
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imap
protocol: TCP
port: 143
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imaps
protocol: TCP
port: 993
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
@@ -159,49 +159,49 @@ spec:
hostname: "docuseal.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: docuseal.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: docuseal.midnightthoughts.space-tls
- name: https-midnightthoughts-neoboard
protocol: HTTPS
hostname: "miro-export.neoboard.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: miro-export.neoboard.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: miro-export.neoboard.midnightthoughts.space-tls
- name: https-midnightthoughts-certs
protocol: HTTPS
hostname: "certs.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: certs.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: certs.midnightthoughts.space-tls
- name: https-midnightthoughts-capacitor
protocol: HTTPS
hostname: "ui.k8s.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ui.k8s.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ui.k8s.midnightthoughts.space-tls
# - name: https-midnightthoughts-auth
# protocol: HTTPS
# hostname: "auth.midnightthoughts.space"
@@ -219,25 +219,25 @@ spec:
hostname: "ldap.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ldap.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ldap.midnightthoughts.space-tls
- name: https-midnightthoughts-status-webhook
protocol: HTTPS
hostname: "webhook.status.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.status.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.status.midnightthoughts.space-tls
# - name: https-midnightthoughts-budget
# protocol: HTTPS
# hostname: "budget.midnightthoughts.space"
@@ -255,61 +255,61 @@ spec:
hostname: "bugzilla.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: bugzilla.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: bugzilla.midnightthoughts.space-tls
- name: https-midnightthoughts-root
protocol: HTTPS
hostname: "midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: midnightthoughts.space-tls
- name: https-midnightthoughts-status
protocol: HTTPS
hostname: "status.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: status.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: status.midnightthoughts.space-tls
- name: https-midnightthoughts-webhook-kubernetes
protocol: HTTPS
hostname: "webhook.kubernetes.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.kubernetes.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.kubernetes.midnightthoughts.space-tls
- name: https-midnightthoughts-rspamd
protocol: HTTPS
hostname: "rspamd.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rspamd.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rspamd.midnightthoughts.space-tls
# - name: https-midnightthoughts-grafana
# protocol: HTTPS
# hostname: "grafana.midnightthoughts.space"
@@ -327,13 +327,13 @@ spec:
hostname: "osticket.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: osticket.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: osticket.midnightthoughts.space-tls
# - name: https-midnightthoughts-vault
# protocol: HTTPS
# hostname: "vault.midnightthoughts.space"
@@ -351,295 +351,295 @@ spec:
hostname: "rook.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rook.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rook.midnightthoughts.space-tls
- name: https-midnightthoughts-jenkins
protocol: HTTPS
hostname: "jenkins.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: jenkins.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: jenkins.midnightthoughts.space-tls
- name: https-midnightthoughts-gerrit
protocol: HTTPS
hostname: "gerrit.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: gerrit.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: gerrit.midnightthoughts.space-tls
- name: https-midnightthoughts-uptime
protocol: HTTPS
hostname: "uptime.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: uptime.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: uptime.midnightthoughts.space-tls
- name: https-midnightthoughts-element-changes
protocol: HTTPS
hostname: "element-changes.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: element-changes.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: element-changes.midnightthoughts.space
- name: https-midnightthoughts-dav
protocol: HTTPS
hostname: "dav.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: dav.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: dav.midnightthoughts.space
- name: https-midnightthoughts-plane
protocol: HTTPS
hostname: "plane.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: plane.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: plane.midnightthoughts.space
- name: https-midnightthoughts-irc
protocol: HTTPS
hostname: "irc.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: irc.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: irc.midnightthoughts.space
- name: https-midnightthoughts-rspamd-matrix
protocol: HTTPS
hostname: "rspamd.matrix.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rspamd.matrix.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rspamd.matrix.midnightthoughts.space
- name: https-midnightthoughts-collabora
protocol: HTTPS
hostname: "collabora.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: collabora.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: collabora.midnightthoughts.space
- name: https-nordgedanken-root
protocol: HTTPS
hostname: "nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-nordgedanken
protocol: HTTPS
hostname: "*.nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-mtrnord-blog-root
protocol: HTTPS
hostname: "mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mtrnord.blog-tls
- name: https-mtrnord-blog-matrix
protocol: HTTPS
hostname: "matrix.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.mtrnord.blog-tls
- name: https-mtrnord-blog-hubzilla
protocol: HTTPS
hostname: "hub.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: hub.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: hub.mtrnord.blog-tls
- name: https-mtrnord-blog-mastodon
protocol: HTTPS
hostname: "mastodon.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mastodon.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mastodon.mtrnord.blog-tls
- name: https-api-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "api.connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: api.connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: api.connectivity-tester.mtrnord.blog-tls
- name: https-stage-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "stage.connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: stage.connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: stage.connectivity-tester.mtrnord.blog-tls
- name: https-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: connectivity-tester.mtrnord.blog-tls
- name: https-federationtester-mtrnord-blog
protocol: HTTPS
hostname: "federationtester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: federationtester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: federationtester.mtrnord.blog-tls
- name: https-notify-mtrnord-blog
protocol: HTTPS
hostname: "notify.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: notify.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: notify.mtrnord.blog-tls
- name: https-rss-mtrnord-blog
protocol: HTTPS
hostname: "rss.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rss.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rss.mtrnord.blog-tls
- name: http
protocol: HTTP
port: 80
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
- name: ldap
protocol: TCP
port: 389
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: gerrit-ssh
protocol: TCP
port: 29418
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: ircs
protocol: TCP
port: 6697
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
diff --git a/apps/talos_cluster/collabora/release.yaml b/apps/talos_cluster/collabora/release.yaml
@@ -45,13 +45,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
- a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
- NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
- bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
- JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
+ a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
+ NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
+ bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
+ JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-05-06T20:29:10Z"
mac: ENC[AES256_GCM,data:dMajaAWAzF/vZITich+V0pENWfhM9HV9T3+JD6YNPg/FcpCni2oirgXZvp66oPk/oWRsfq9l4zQmX9Td62Hws4kEtXwUIIMMgSAgugzVLrJ2clkqApRdBAV7UP8dOLCdVn3j7zgRLYujrHKnOV4j9CIX9eU4jKtIgpsY+iEA12A=,iv:K4H82oJi0ecMB1gS4xzLv5A2EeEEXgeaSGmDTuIRzG4=,tag:BxPn0YaHraPF3pRclwka8g==,type:str]
pgp: []
@@ -78,13 +78,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
- a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
- NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
- bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
- JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
+ a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
+ NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
+ bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
+ JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-05-06T20:29:10Z"
mac: ENC[AES256_GCM,data:dMajaAWAzF/vZITich+V0pENWfhM9HV9T3+JD6YNPg/FcpCni2oirgXZvp66oPk/oWRsfq9l4zQmX9Td62Hws4kEtXwUIIMMgSAgugzVLrJ2clkqApRdBAV7UP8dOLCdVn3j7zgRLYujrHKnOV4j9CIX9eU4jKtIgpsY+iEA12A=,iv:K4H82oJi0ecMB1gS4xzLv5A2EeEEXgeaSGmDTuIRzG4=,tag:BxPn0YaHraPF3pRclwka8g==,type:str]
pgp: []
@@ -104,63 +104,63 @@ spec:
- collabora.midnightthoughts.space
rules:
- matches:
- - path:
- value: /
- type: PathPrefix
+ - path:
+ value: /
+ type: PathPrefix
backendRefs:
- - name: collabora-online
- port: 9980
+ - name: collabora-online
+ port: 9980
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
- matches:
- - path:
- value: /cool/getMetrics
- type: PathPrefix
+ - path:
+ value: /cool/getMetrics
+ type: PathPrefix
backendRefs:
- - name: collabora-online
- port: 9980
+ - name: collabora-online
+ port: 9980
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
filters:
- - type: ExtensionRef
- extensionRef:
- group: gateway.envoyproxy.io
- kind: HTTPRouteFilter
- name: deny
+ - type: ExtensionRef
+ extensionRef:
+ group: gateway.envoyproxy.io
+ kind: HTTPRouteFilter
+ name: deny
- matches:
- - path:
- value: /cool/adminws
- type: PathPrefix
+ - path:
+ value: /cool/adminws
+ type: PathPrefix
backendRefs:
- - name: collabora-online
- port: 9980
+ - name: collabora-online
+ port: 9980
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
filters:
- - type: ExtensionRef
- extensionRef:
- group: gateway.envoyproxy.io
- kind: HTTPRouteFilter
- name: deny
+ - type: ExtensionRef
+ extensionRef:
+ group: gateway.envoyproxy.io
+ kind: HTTPRouteFilter
+ name: deny
- matches:
- - path:
- value: /browser/dist/admin/admin.html
- type: Exact
+ - path:
+ value: /browser/dist/admin/admin.html
+ type: Exact
backendRefs:
- - name: collabora-online
- port: 9980
+ - name: collabora-online
+ port: 9980
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
filters:
- - type: ExtensionRef
- extensionRef:
- group: gateway.envoyproxy.io
- kind: HTTPRouteFilter
- name: deny
+ - type: ExtensionRef
+ extensionRef:
+ group: gateway.envoyproxy.io
+ kind: HTTPRouteFilter
+ name: deny
sops:
kms: []
gcp_kms: []
@@ -169,13 +169,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
- a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
- NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
- bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
- JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UStLR1RNZzErZ0VaNTRw
+ a0VETXVqaG5YMzNOOTRrRHhFYXBBNnVIcVNFCmp5RnNja3VMZGxvcnRMNkpFQ21w
+ NHNkdzl3VGY4b1oxVWdtNzM1Y0NVWFUKLS0tIGd2NSttbVFRSnBxSFlzSFgyaVhH
+ bnJ0cVFJZS9MOGdlSlFrZVRrODlKazgKv9LSpwR009/fBUM1PopiVPmUbAWQtNlT
+ JZNZWONdbuKCLy0YzETiL+eUbUu7/G9KMQVXIV/z5qaLdSmWkVlJwQ==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-05-06T20:29:10Z"
mac: ENC[AES256_GCM,data:dMajaAWAzF/vZITich+V0pENWfhM9HV9T3+JD6YNPg/FcpCni2oirgXZvp66oPk/oWRsfq9l4zQmX9Td62Hws4kEtXwUIIMMgSAgugzVLrJ2clkqApRdBAV7UP8dOLCdVn3j7zgRLYujrHKnOV4j9CIX9eU4jKtIgpsY+iEA12A=,iv:K4H82oJi0ecMB1gS4xzLv5A2EeEEXgeaSGmDTuIRzG4=,tag:BxPn0YaHraPF3pRclwka8g==,type:str]
pgp: []
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -48,42 +48,42 @@ spec:
protocol: TCP
port: 25
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submissions
protocol: TCP
port: 465
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submission
protocol: TCP
port: 587
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imap
protocol: TCP
port: 143
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imaps
protocol: TCP
port: 993
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
@@ -108,141 +108,141 @@ spec:
hostname: "talos.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: talos.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: talos.midnightthoughts.space-tls
- name: https-midnightthoughts-auth
protocol: HTTPS
hostname: "auth.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: auth.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: auth.midnightthoughts.space-tls
- name: https-midnightthoughts-grafana
protocol: HTTPS
hostname: "grafana.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: grafana.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: grafana.midnightthoughts.space-tls
- name: https-draupnir-midnightthoughts
protocol: HTTPS
hostname: "draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: draupnir.midnightthoughts.space-tls
- name: https-matrix-draupnir-midnightthoughts
protocol: HTTPS
hostname: "matrix.draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.draupnir.midnightthoughts.space-tls
- name: https-midnightthoughts-vault
protocol: HTTPS
hostname: "vault.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: vault.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: vault.midnightthoughts.space-tls
- name: https-midnightthoughts-budget
protocol: HTTPS
hostname: "budget.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: budget.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: budget.midnightthoughts.space-tls
- name: https-midnightthoughts-ldap
protocol: HTTPS
hostname: "ldap.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ldap.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ldap.midnightthoughts.space-tls
- name: ldap
protocol: TCP
port: 389
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: https-mtrnord-blog-gts
protocol: HTTPS
hostname: "gts.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: gts.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: gts.mtrnord.blog-tls
- name: https-midnightthoughts-collabora
protocol: HTTPS
hostname: "collabora.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: collabora.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: collabora.midnightthoughts.space
- name: https-midnightthoughts-webhook-kubernetes
protocol: HTTPS
hostname: "webhook.kubernetes.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.kubernetes.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.kubernetes.midnightthoughts.space-tls
# - name: https-docuseal-midnightthoughts
# protocol: HTTPS
# hostname: "docuseal.midnightthoughts.space"
diff --git a/apps/talos_cluster/gotosocial/release.yaml b/apps/talos_cluster/gotosocial/release.yaml
@@ -18,82 +18,82 @@ spec:
image: docker.io/superseriousbusiness/gotosocial:latest
imagePullPolicy: Always
resources:
- limits:
- cpu: 1000m
- memory: 1Gi
- requests:
- cpu: 100m
- memory: 128Mi
+ limits:
+ cpu: 1000m
+ memory: 1Gi
+ requests:
+ cpu: 100m
+ memory: 128Mi
env:
- - name: GTS_HOST
- value: gts.mtrnord.blog
- - name: GTS_ACCOUNT_DOMAIN
- value: mtrnord.blog
- - name: GTS_DB_TYPE
- value: postgres
- - name: GTS_DB_ADDRESS
- value: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local
- - name: GTS_DB_USER
- value: gotosocial
- - name: GTS_DB_PASSWORD
- valueFrom:
- secretKeyRef:
- name: gotosocial-secret
- key: db_password
- - name: GTS_DB_TLS_MODE
- value: enable
- - name: GTS_LETSENCRYPT_ENABLED
- value: "false"
- - name: GTS_WAZERO_COMPILATION_CACHE
- value: /gotosocial/.cache
- - name: GTS_TRUSTED_PROXIES
- value: 10.0.0.0/8
- - name: TZ
- value: Europe/Berlin
- - name: GTS_SMTP_HOST
- value: mail.midnightthoughts.space
- - name: GTS_SMTP_PORT
- value: "587"
- - name: GTS_SMTP_USERNAME
- value: "ops@midnightthoughts.space"
- - name: GTS_SMTP_PASSWORD
- valueFrom:
- secretKeyRef:
- name: gotosocial-secret
- key: smtp_password
- - name: GTS_SMTP_FROM
- value: "noreply@midnightthoughts.space"
+ - name: GTS_HOST
+ value: gts.mtrnord.blog
+ - name: GTS_ACCOUNT_DOMAIN
+ value: mtrnord.blog
+ - name: GTS_DB_TYPE
+ value: postgres
+ - name: GTS_DB_ADDRESS
+ value: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local
+ - name: GTS_DB_USER
+ value: gotosocial
+ - name: GTS_DB_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: gotosocial-secret
+ key: db_password
+ - name: GTS_DB_TLS_MODE
+ value: enable
+ - name: GTS_LETSENCRYPT_ENABLED
+ value: "false"
+ - name: GTS_WAZERO_COMPILATION_CACHE
+ value: /gotosocial/.cache
+ - name: GTS_TRUSTED_PROXIES
+ value: 10.0.0.0/8
+ - name: TZ
+ value: Europe/Berlin
+ - name: GTS_SMTP_HOST
+ value: mail.midnightthoughts.space
+ - name: GTS_SMTP_PORT
+ value: "587"
+ - name: GTS_SMTP_USERNAME
+ value: "ops@midnightthoughts.space"
+ - name: GTS_SMTP_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: gotosocial-secret
+ key: smtp_password
+ - name: GTS_SMTP_FROM
+ value: "noreply@midnightthoughts.space"
ports:
- - containerPort: 8080
+ - containerPort: 8080
livenessProbe:
- httpGet:
- path: /livez
- port: 8080
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 5
- successThreshold: 1
- failureThreshold: 3
+ httpGet:
+ path: /livez
+ port: 8080
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 5
+ successThreshold: 1
+ failureThreshold: 3
readinessProbe:
- httpGet:
- path: /readyz
- port: 8080
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 5
- successThreshold: 1
- failureThreshold: 3
+ httpGet:
+ path: /readyz
+ port: 8080
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 5
+ successThreshold: 1
+ failureThreshold: 3
volumeMounts:
- - name: gotosocial
- mountPath: /gotosocial/storage
- subPath: storage
- - name: gotosocial
- mountPath: /gotosocial/.cache
- subPath: .cache
+ - name: gotosocial
+ mountPath: /gotosocial/storage
+ subPath: storage
+ - name: gotosocial
+ mountPath: /gotosocial/.cache
+ subPath: .cache
volumes:
- name: gotosocial
persistentVolumeClaim:
- claimName: gotosocial
+ claimName: gotosocial
---
apiVersion: v1
kind: Service
@@ -121,8 +121,8 @@ spec:
- gts.mtrnord.blog
rules:
- backendRefs:
- - name: gotosocial-service
- port: 8080
+ - name: gotosocial-service
+ port: 8080
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
