commit 5450f14d9386eb381234a6aaf2e7db159466c95d parent edae426b884d76d8e0cf2fe7a0a8cd33eb1dda0c Author: MTRNord <MTRNord@users.noreply.github.com> Date: Wed, 25 Feb 2026 21:06:08 +0100 fix cleanup Signed-off-by: MTRNord <MTRNord@users.noreply.github.com> Diffstat:
| D | apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml | | | 73 | ------------------------------------------------------------------------- |
| D | apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml | | | 116 | ------------------------------------------------------------------------------- |
| D | apps/talos_cluster/clickstack/kustomization.yaml | | | 10 | ---------- |
| D | apps/talos_cluster/clickstack/release.yaml | | | 73 | ------------------------------------------------------------------------- |
| D | apps/talos_cluster/clickstack/repository.yaml | | | 17 | ----------------- |
| D | apps/talos_cluster/clickstack/route.yaml | | | 32 | -------------------------------- |
| D | apps/talos_cluster/clickstack/secrets.yaml | | | 57 | --------------------------------------------------------- |
| D | apps/talos_cluster/harbor/kustomization.yaml | | | 6 | ------ |
| D | apps/talos_cluster/harbor/release.yaml | | | 77 | ----------------------------------------------------------------------------- |
| D | apps/talos_cluster/harbor/repository.yaml | | | 8 | -------- |
| D | apps/talos_cluster/sentry/kustomization.yaml | | | 7 | ------- |
| D | apps/talos_cluster/sentry/release.yaml | | | 167 | ------------------------------------------------------------------------------- |
| D | apps/talos_cluster/sentry/repository.yaml | | | 8 | -------- |
| D | apps/talos_cluster/sentry/route.yaml | | | 32 | -------------------------------- |
14 files changed, 0 insertions(+), 683 deletions(-)
diff --git a/apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml b/apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml @@ -1,73 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: k8s-events-global-metrics-collector - namespace: clickstack -spec: - releaseName: k8s-events-global-metrics-collector - chart: - spec: - chart: opentelemetry-collector - sourceRef: - kind: HelmRepository - name: open-telemetry - interval: 60m - values: - # deployment.yaml - mode: deployment - - image: - repository: otel/opentelemetry-collector-contrib - tag: 0.145.0 - - # We only want one of these collectors - any more and we'd produce duplicate data - replicaCount: 1 - - presets: - kubernetesAttributes: - enabled: true - # When enabled the processor will extra all labels for an associated pod and add them as resource attributes. - # The label's exact name will be the key. - extractAllPodLabels: true - # When enabled the processor will extra all annotations for an associated pod and add them as resource attributes. - # The annotation's exact name will be the key. - extractAllPodAnnotations: true - # Configures the collector to collect kubernetes events. - # Adds the k8sobject receiver to the logs pipeline and collects kubernetes events by default. - # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-objects-receiver - kubernetesEvents: - enabled: true - # Configures the Kubernetes Cluster Receiver to collect cluster-level metrics. - # Adds the k8s_cluster receiver to the metrics pipeline and adds the necessary rules to ClusteRole. - # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-cluster-receiver - clusterMetrics: - enabled: true - - extraEnvs: - - name: HYPERDX_API_KEY - valueFrom: - secretKeyRef: - name: hyperdx-secret - key: HYPERDX_API_KEY - optional: true - - name: YOUR_OTEL_COLLECTOR_ENDPOINT - valueFrom: - configMapKeyRef: - name: otel-config-vars - key: YOUR_OTEL_COLLECTOR_ENDPOINT - - config: - exporters: - otlphttp: - endpoint: "${env:YOUR_OTEL_COLLECTOR_ENDPOINT}" - compression: gzip - headers: - authorization: "${env:HYPERDX_API_KEY}" - service: - pipelines: - logs: - exporters: - - otlphttp - metrics: - exporters: - - otlphttp diff --git a/apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml b/apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml @@ -1,116 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: k8s-log-metrics-collector - namespace: clickstack -spec: - releaseName: k8s-log-metrics-collector - chart: - spec: - chart: opentelemetry-collector - sourceRef: - kind: HelmRepository - name: open-telemetry - interval: 60m - values: - # daemonset.yaml - mode: daemonset - - image: - repository: otel/opentelemetry-collector-contrib - tag: 0.145.0 - - # Required to use the kubeletstats cpu/memory utilization metrics - clusterRole: - create: true - rules: - - apiGroups: - - "" - resources: - - nodes/proxy - verbs: - - get - - presets: - logsCollection: - enabled: true - hostMetrics: - enabled: true - # Configures the Kubernetes Processor to add Kubernetes metadata. - # Adds the k8sattributes processor to all the pipelines and adds the necessary rules to ClusterRole. - # More info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-attributes-processor - kubernetesAttributes: - enabled: true - # When enabled the processor will extra all labels for an associated pod and add them as resource attributes. - # The label's exact name will be the key. - extractAllPodLabels: true - # When enabled the processor will extra all annotations for an associated pod and add them as resource attributes. - # The annotation's exact name will be the key. - extractAllPodAnnotations: true - # Configures the collector to collect node, pod, and container metrics from the API server on a kubelet.. - # Adds the kubeletstats receiver to the metrics pipeline and adds the necessary rules to ClusterRole. - # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubeletstats-receiver - kubeletMetrics: - enabled: true - - extraEnvs: - - name: HYPERDX_API_KEY - valueFrom: - secretKeyRef: - name: hyperdx-secret - key: HYPERDX_API_KEY - optional: true - - name: YOUR_OTEL_COLLECTOR_ENDPOINT - valueFrom: - configMapKeyRef: - name: otel-config-vars - key: YOUR_OTEL_COLLECTOR_ENDPOINT - config: - receivers: - # Configures additional kubelet metrics - kubeletstats: - collection_interval: 20s - auth_type: "serviceAccount" - #endpoint: "${env:K8S_NODE_NAME}:10250" - #endpoint: "127.0.0.1:10250" - endpoint: "${env:K8S_NODE_IP}:10250" - insecure_skip_verify: true - metrics: - k8s.pod.cpu_limit_utilization: - enabled: true - k8s.pod.cpu_request_utilization: - enabled: true - k8s.pod.memory_limit_utilization: - enabled: true - k8s.pod.memory_request_utilization: - enabled: true - k8s.pod.uptime: - enabled: true - k8s.node.uptime: - enabled: true - k8s.container.cpu_limit_utilization: - enabled: true - k8s.container.cpu_request_utilization: - enabled: true - k8s.container.memory_limit_utilization: - enabled: true - k8s.container.memory_request_utilization: - enabled: true - container.uptime: - enabled: true - - exporters: - otlphttp: - endpoint: "${env:YOUR_OTEL_COLLECTOR_ENDPOINT}" - headers: - authorization: "${env:HYPERDX_API_KEY}" - compression: gzip - - service: - pipelines: - logs: - exporters: - - otlphttp - metrics: - exporters: - - otlphttp diff --git a/apps/talos_cluster/clickstack/kustomization.yaml b/apps/talos_cluster/clickstack/kustomization.yaml @@ -1,10 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: clickstack -resources: - - repository.yaml - - release.yaml - - route.yaml - - secrets.yaml - - k8s_log_metrics_collector.yaml - - k8s_events_global_metrics_collector.yaml diff --git a/apps/talos_cluster/clickstack/release.yaml b/apps/talos_cluster/clickstack/release.yaml @@ -1,73 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: clickstack - namespace: clickstack -spec: - releaseName: clickstack - chart: - spec: - chart: clickstack - sourceRef: - kind: HelmRepository - name: clickstack - interval: 60m - values: - global: - storageClassName: longhorn - hyperdx: - apiKey: ENC[AES256_GCM,data:8kskExN3VStHrMmbw1NTiCBwh6hrEv87EyAyAPR02+z28k25,iv:0QTlYvEYwypMLwicnVAKLFt84bwdUPQouPwFTrX+v0M=,tag:0h063JeXW7uvXgYFokQY/g==,type:str] - appUrl: https://clickstack.midnightthoughts.space - frontendUrl: https://clickstack.midnightthoughts.space - mongodb: - persistence: - enabled: true - size: 10Gi - clickhouse: - persistence: - enabled: true - dataSize: 10Gi - logSize: 5Gi - config: - users: - appUserPassword: ENC[AES256_GCM,data:UZQQ9Yg8yDlC2Hm5z/YYj2xw3fCdbV+2Brnn/UEB0B+wMiyGH9s4GupK0Q4/uvqIGkCjRvZH4DqG+higPyaJ,iv:kipnRldYvL/NaQTDwQuus1Skt2pV8TLXIGoiLrm0iFM=,tag:u+tv9dGEWVPmrnhfOWuStA==,type:str] - otelUserPassword: ENC[AES256_GCM,data:s0QRS+ZMfLg/eLJoqxpkiYxgNheTpj4hZwqdUynRSysSzL5dxVMwSZq/lRhJQ8FqmHP5miGETJNF11Y0kEUb,iv:VCXLiq961D/LJMl0X9/ccFisNXJbE+9RxvlqBcxCAeg=,tag:V7UxUW46qQlrVShZpKiEOw==,type:str] - otelUserName: otelcollector - # otel: - # customConfig: | - # processors: - # batch: - # tail_sampling: - # decission_wait: 30s - # num_traces: 20000 - # expected_new_traces_per_sec: 50 - # policies: - # - name: always_on_error - # type: error - # - name: slow_traces - # type: latency - # latency_threshold: 250ms - # - name: probabilistic_fallback - # type: probabilistic - # sampling_percentage: 5.0 - # # TODO: Unclear how to configure the pipelines as its hardcoded over at https://github.com/hyperdxio/hyperdx/blob/af3bbcf1a0f3d31a0a74b4f4fe3073af229a8df7/packages/api/src/opamp/controllers/opampController.ts#L4 possibly? -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbXJpK0Q0cjdXNFhwRWpP - Zzl5NmNGZzE5Sk5zeC9lVk9mMEdVUmQxNkRFCld6MVN3VEtLWlM4RW1Va3VocWpU - Ly9Ld2Q3Q0I1NGx2bEdHRkgvMXF4UEEKLS0tIGhmR2IwV0I3Z1lsRFZGek4vdzZC - RlNWRVQ1aDlCTmFDNkhHNlRJVEFZeGcKx+4o4lJK1ttkMTqf9WphCyp+454FEvcH - KMoTJYzYDFr3Ol/jwvOX3J+rwyn3of0GPNW+T6si9iBLd0dXegkWOQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-05T18:20:57Z" - mac: ENC[AES256_GCM,data:ijOmWUKboiCUFSKY1KfctWWyfS39bCGg06RwVrWU+ndO0AHV2Fgc++73/iVhQf+kcmAv+Bpp46aAVwVpcEWAiiGI1Bglu8aUWaehwPcE9ZDWJwqN+NIyXjT1PFOcQ4e8P+qihaPbbXkGafo31FbHJlKgaig8PsjwhqAKlD50MW8=,iv:QrmnkqoHdJRGwDOvYYukGI2vjid47J36q+MTR7RrJk0=,tag:lduLOK+lo/naVVHI266RaQ==,type:str] - pgp: [] - encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 diff --git a/apps/talos_cluster/clickstack/repository.yaml b/apps/talos_cluster/clickstack/repository.yaml @@ -1,17 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: clickstack - namespace: clickstack -spec: - interval: 60m - url: https://hyperdxio.github.io/helm-charts ---- -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: open-telemetry - namespace: clickstack -spec: - interval: 60m - url: https://open-telemetry.github.io/opentelemetry-helm-charts diff --git a/apps/talos_cluster/clickstack/route.yaml b/apps/talos_cluster/clickstack/route.yaml @@ -1,32 +0,0 @@ -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: clickstack - namespace: clickstack -spec: - parentRefs: - - name: envoy-gateway - namespace: envoy-gateway - hostnames: - - clickstack.midnightthoughts.space - rules: - - backendRefs: - - name: clickstack-app - port: 3000 - timeouts: - request: 240s - backendRequest: 0s ---- -apiVersion: gateway.envoyproxy.io/v1alpha1 -kind: BackendTrafficPolicy -metadata: - name: clickstack-compression - namespace: clickstack -spec: - targetRef: - group: gateway.networking.k8s.io - kind: HTTPRoute - name: clickstack - compression: - - type: Gzip - - type: Brotli diff --git a/apps/talos_cluster/clickstack/secrets.yaml b/apps/talos_cluster/clickstack/secrets.yaml @@ -1,57 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: hyperdx-secret - namespace: clickstack -type: Opaque -stringData: - HYPERDX_API_KEY: ENC[AES256_GCM,data:A+gj3fg/FMVjRuqMVUoYWqJWl25L4hZrw6YiQNlbtKKeMb5C,iv:hOFqFn2vV+mSNTZAu5OG/NVgPvAugSaSPJ2NG/9Tpj4=,tag:U4/K9zHnpGSpKnc+zIUhTQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ - VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5 - MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl - amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh - u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-07T08:48:49Z" - mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str] - pgp: [] - encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 ---- -# Configmap for the otel collector endpoint -apiVersion: v1 -kind: ConfigMap -metadata: - name: otel-config-vars - namespace: clickstack -data: - YOUR_OTEL_COLLECTOR_ENDPOINT: ENC[AES256_GCM,data:jKOaxrj5Fb+wNMZcybCMD/+eP2E+Wz0hOe8H6ctGq8mW/FD601kX2IP6azbfobz8NbgwvQc5RQrao05FuYDOY9Jq,iv:Bu71B4EPiwT+3nh5xO2J3u50Fmb1KduivEYPi8sS+Ak=,tag:evJx/AUSJzLiKvW9D92L5Q==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ - VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5 - MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl - amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh - u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-07T08:48:49Z" - mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str] - pgp: [] - encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 diff --git a/apps/talos_cluster/harbor/kustomization.yaml b/apps/talos_cluster/harbor/kustomization.yaml @@ -1,6 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: harbor -resources: - - repository.yaml - - release.yaml diff --git a/apps/talos_cluster/harbor/release.yaml b/apps/talos_cluster/harbor/release.yaml @@ -1,77 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: harbor - namespace: harbor -spec: - releaseName: harbor - chart: - spec: - chart: harbor - sourceRef: - kind: HelmRepository - name: harbor - interval: 60m - values: - database: - type: external - external: - host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local - port: "5432" - username: harbor - password: ENC[AES256_GCM,data:4pfuY9GLClsTuNh2ydjB/emvjBjjM3WZqa/ReZV9GxdDGKDkDkamVCw+DFjFUoOlK66bkzX9pM2bPwg2W0nCVw==,iv:1cXS9OVhan1lGr0MBPlPcYX+gi8sRulIZURte8qUKFM=,tag:sk1eFeZgNRl8HG3hrmXM7g==,type:str] - coreDatabase: harbor - maxIdleConns: 10 - maxOpenConns: 10 - expose: - type: route - route: - parentRefs: - - name: envoy-gateway - namespace: envoy-gateway - hosts: - - harbor.midnightthoughts.space - externalURL: https://harbor.midnightthoughts.space - persistence: - enabled: true - resourcePolicy: keep - persistentVolumeClaim: - registry: - size: 5Gi - storageClass: longhorn - accessMode: ReadWriteMany - jobservice: - size: 1Gi - storageClass: longhorn - accessMode: ReadWriteMany - redis: - size: 1Gi - storageClass: longhorn - accessMode: ReadWriteMany - trivy: - size: 5Gi - storageClass: longhorn - accessMode: ReadWriteMany - existingSecretAdminPassword: "" - existingSecretAdminPasswordKey: HARBOR_ADMIN_PASSWORD - harborAdminPassword: ENC[AES256_GCM,data:lq+6px3PfJVlrta67RW7h6LN3IAtnCz7ybtNjuYvIjyNo5/sc3cxS5/CEZ/7wZ+oQk2ioqp/Bg3xX1vQrxQKIA==,iv:FSy2lGEG+Lgp8UZAJI5b54ROv+jmBLMZ8vHFlZbhXj0=,tag:gwbfRq6OKfkXF3e4auoi/w==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwQUhYQmxtZVQ2TGZYeENq - MnQxWm5lY3o0Y2FWNjRmQlgvbEpSYTZXb1djCnFubkpBcklOcnJGeE5PWXF3TDNK - N0F5cVowK1R5MnhHek9RUWpydDFYT0kKLS0tIDRpVTd3SnFIS0hBRUZ5Wkw2bUY5 - Ykk4QmphS0tzNEFUSFl2dWZzTEhDamsKBLeUNe4qlBr1yH2o+rKQj1hqLBHleW7F - 9xpGSvJ8IOBdHOvhmgw1eDPinzAg7sFBG1U9yOD7Hvx2hrtBez7oqQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-09-19T09:41:26Z" - mac: ENC[AES256_GCM,data:UWAN84oBJigxTYQrbQziWLOxjBYA6y5a00NTm144/oqC0LIlJPiqDVCZtloOiGmO74cxiHNBaJVqMNz7SaNA4hofa6zVOey9NCNjgjLtdIt0A0cAip/pZOSmgI8S/DlPURL1m7c3V1/abL3+J2aZRVevGTWLNGpiKvwBG0459Dw=,iv:Xx0SgHuYblWVrRBdG27egRveQH+8oNIot48h2SRWIUM=,tag:Dmz5K+KB2Jy3BtqFI83CsA==,type:str] - pgp: [] - encrypted_regex: ^(harborAdminPassword|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$ - version: 3.9.1 diff --git a/apps/talos_cluster/harbor/repository.yaml b/apps/talos_cluster/harbor/repository.yaml @@ -1,8 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: external-dns - namespace: kube-system -spec: - interval: 50m - url: https://kubernetes-sigs.github.io/external-dns/ diff --git a/apps/talos_cluster/sentry/kustomization.yaml b/apps/talos_cluster/sentry/kustomization.yaml @@ -1,7 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: sentry -resources: - - repository.yaml - - release.yaml - - route.yaml diff --git a/apps/talos_cluster/sentry/release.yaml b/apps/talos_cluster/sentry/release.yaml @@ -1,167 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: sentry - namespace: sentry -spec: - releaseName: sentry - chart: - spec: - chart: sentry - version: 28.1.x - sourceRef: - kind: HelmRepository - name: sentry - interval: 60m - timeout: 240m0s - values: - ipv6: true - user: - create: true - email: mtrnord@nordgedanken.dev - password: ENC[AES256_GCM,data:WTwV6ujtww48,iv:jqWkKwcQYBVmVbrMNWelAPdM99HxeLoKH01wr8HMELM=,tag:79lhm3xMAYWJgDSPp2g6XA==,type:str] - # this is required on the first installation, as sentry has to be initialized first - # recommended to set false for updating the helm chart afterwards, - # as you will have some downtime on each update if it's a hook - # deploys relay & snuba consumers as post hooks - asHook: false - hooks: - dbCheck: - image: - repository: toolbelt/netcat - tag: latest - pullPolicy: Always - vroom: - persistence: - enabled: true - size: 5Gi - accessMode: ReadWriteMany - storageClass: longhorn - geodata: - persistence: - storageClass: longhorn - sentry: - singleOrganization: true - web: - enabled: true - features: - orgSubdomains: false - enableProfiling: false - enableSessionReplay: true - enableFeedback: true - enableSpan: true - enableUptime: false - ingestFeedback: - enabled: true - system: - url: https://sentry.mtrnord.blog - adminEmail: ENC[AES256_GCM,data:FZctGNse1Ruv7krqJxAu2k36/2cBkaS/7/UGqjKZ,iv:DGhUqYRIYcWQAOTTmFd1B8R4+MCYP16Crndfv2i7Tbk=,tag:TdVeCP6gsTCDwmcZMBswqg==,type:str] - public: false - secretKey: ENC[AES256_GCM,data:25IVzNtqa8GMGbAcvt52UtmkgA1oQcm1qLudb0O4Nf3fmZFGzW3rgmhH3Xy6n0wBrZA+21n0s0buRsvDaF2Nxg==,iv:I6GpOFvrOcyuY+sczCqWpfNCwdZxt4Rk+svKBEGmhv0=,tag:xHaP5EHDcJrH+XqN0dXRgw==,type:str] - mail: - backend: smtp - host: mail.midnightthoughts.space - useTls: "true" - useSsl: "false" - port: "587" - username: support@midnightthoughts.space - password: ENC[AES256_GCM,data:jBgw6wgU8wHO22oHOjigdDD0jfr1ZN4vhSQxoDa/YFgAoFferHEYc724gamTuoEOTSB8oBkIQduNm65PemRnrw==,iv:Iq8fpC0SuMnXN19AePDzU564oyvGTdZDJb3UYrl0mlE=,tag:prH26pGX0bpOBMvRUr/RwA==,type:str] - from: support@midnightthoughts.space - github: - appId: ENC[AES256_GCM,data:9Nh2OIzQzw==,iv:ESWCjcEsDV4lILIpyp+MRDJHMJ4lxghhAB8TTRHADcw=,tag:03Y10Q6RuwxUOBMN7wFeUw==,type:str] - appName: Sentry Midnightthoughts - clientId: ENC[AES256_GCM,data:IV3fzL3qUSyWS5FFG5//GOprtJs=,iv:c/8aWMMcqnePEDLTF9et1pUbwcoXa39+on+TqUl6F7A=,tag:TCGyxJkWzfCM88Su16wCKA==,type:str] - clientSecret: ENC[AES256_GCM,data:Zp4uu9L5Hc7zqlORkPoQVeW5GPj1Ho/S1fjaw/PTuHQXPeBzC+qpEA==,iv:ILXi9XL7+FYskjv5OEk64Y8E+6motfARONM7XKH36Jw=,tag:MRB8KFpkdwua4XH2WcIfMg==,type:str] - privateKey: ENC[AES256_GCM,data:cb9g6j3UrDc93Yo7u+6OOmay10ES3Uy/Y6iLyR1t4jTOrCh1Ws1ArwvqFHWuEa7cd5NxEpkGUorglxgSLr8QXOsvM+mJwcSUtoS9cLHxK8PYOlF8oP0C6lUzYYqYeboCOLltCftV+4VKxYQt6jhWo+I44Tcd6ftVCOEESg68YlHmO6tn/wDYdAVvN0F/V7doRDjLoNs1iA+RyPoipWuJOayDtuLbN+POWLHoNPGuhgw38fVNaAtv3vp+fwxfU00mhGkw6u5+BkeEBOlf9dmwz1krETqw5HWNyHufboC+wMRBpyG4EYS8/Z6Ms4zfy6pm+SIr1EfCozYam5mlzJszAlH8YHFKpGUSH2n0pOYsmO+KEgMg40xiwR65pOkQNLzlFCfP3gu1+y1GtAC7nnRTHE1puE9LiflNR6eONW5vcvjWaJOxrnmoVJRkcGQnkIOCzs2PTQg4VMGgIuhNTyAKRGvsoeXQEEdCK3WUCA5KrwdxRGqORKlORV8qtbunVxXtazIbE9Ze82tHPB2jAS24IdxjHAg29zuKasPJT/TFeKxmNfB6qnLXDKn3KZ6sBq3hh2Fa6vP3xn2kXg+UBkeqY34ana9tX0o+oLtNHUB7UhGkOCEvggJ1BtbvvhTQ5fkCpp479AzeZq2bBwnvKNXTqLuJP4MEjit04VLP1Nrss0uDcShSxnWASAzeA+mkFucweFNJy4zcL2P0VdM4wzX3nZcR5AbfnS/gPA+yyPGrPkHQiTDuKLIxPcvFxvuLVr1Oe80HXpeDULyV6PXXuW7ojHHGEAXwyIwx1H74i1GafQxNm5MRP291ljaandFNZQxxYb8BcP5WKBPBA8910aXzuK13rt/54mznkwc0YOlhRPq+S9z2RUbw8skORb7xGbducabVJTxBpjxmSDQ/73Co+ffEwaOQY3XOmJGIpe8IUP6+iBGuXL3E3cThWS/sydFzkhiv58TjqxhO6i9dLh6nEP9n5sSpbLi283qD2H2xBag/QWUM1j6pgXFzF/IaaygmGx4/r+Aez//Ti1soWq7vqY9koZyDrBE7IYdGYdi9OWEuTGMhQlyB3bwsZ/Syya8WH10X2IyPrDbn3+679NhM9/Oq4RuA9p4zli5iJ6TAvGN3v0ybIIVWab+AcTTqd5e6dbHVxEyMIc3d+aoBjCZT60XIfP1/NwDxY66Dlo1svZvwc44yBIvKdYvqRUhOjDrLGI/Vw2SgLD9xsfY1yLqpxhGRhEoqgL88h5IIeOzs+XWD2O5Z0n7X2hoLOGLAuqCs00A/ovsFE3jtWPb2GOC9GjN4siTtL0Dcnm6M+sIXIAmiV9JRM67wjtAqrfxA9RCspKTeNE5kVT0B3tNXT5IJSCe/XRUISJrya6fbWVphQoEbT3UQJpEMXIez5zux0Xp24vPv6YDFzIV5he8LWDPKAmL48X32cuKf/8fJlencdY6IPr/2rrEo/mLsvwuT7YP1aORWy+nJ55sdWP9/gWU7MMnSaBfcY+3q+pe1l8rbYhgKoKZaXmwrw5D2XeZiurZ+Acyda7FLmYjoisd0oAXr8PMxEPionFYJhawiMqtkXY7fZSRq2IfiCp51qjXYZn+7lKvAR8ktTPQf+uF6udSPWaRdd/gXiNpBdy5q5eNXJouoBxkqMJZaeVr4eVVqMv0AiRApKXLSXQ0jZdfLii7l8D4RD4OoqASJO3NgKCbb477sAYvfmfbxhjKCzIptBkK55s82gA34PboCmqPwSNQPaKa6eKwRKICVDfL0Uoa8igvp2Y8D5uMmVBQDPJBlXV+AsGwDM6ExA+GxK36bn6Uu+h5csDPc1ej8NfifpbVfnxkKNayA10OEKUr1Wdk42ch4UOnPAfUmG0Qw3NLVy1qM+nUZxqv+DLrvatDj6yLaVBumNx3NVseslRvQoIsBbq4xgpBGuvsUf9enPiSTO1+Mz+iQ940DutMPZGjdIc25JUwMhUxm+3rEfFHNfhTKEdTjiHOQiz0rzlfbTNsIXj/AvQ7DdHcI6IUBXgVy3uTJ0fQM2Cv7y+rcCa7iewT2ErGNG02Z2pedgc4dWpWDvprUOgHAcM/sUxFD1RpeV27D2CkDsiWvxtvH8+uUSOc+YI4rCu6eWa3Btf8Em6H5xSVhdA136DTpg60uFtnR1dY1BtlVIwWt1bh/RG9CGcVv8rh9dOVdiIuRUS1G6lWnH2UmuQ3IAzp7gLyMJPyNbI3O88bFtmVsq2TW8vXr9OZM32Q=,iv:td50Un7ITMuMeamp2xI1ZirEfueVLy7riN9eLYAb0Ic=,tag:qa762/Nkwx82V8IBAeDwzg==,type:str] - webhookSecret: ENC[AES256_GCM,data:PfkiR6C2T+GdkeDjKm4d8walePHqqWYrLCPLDyKejjqrwX9RLFQPIfkHw66d0rxA9Q3/LjXXx1++8cT+J3Ie6w==,iv:5MJqZdTdgYBZt53MXwE6jgCiBc43AvyT8BTruhz+9w4=,tag:DvmVrko9Omq1dwS9L4Izdg==,type:str] - auth: - register: false - ingress: - enabled: false - filestore: - backend: filesystem - filesystem: - persistence: - enabled: true - size: 5Gi - accessMode: ReadWriteMany - storageClass: longhorn - persistentWorkers: true - clickhouse: - clickhouse: - persistentVolumeClaim: - enabled: true - dataPersistentVolume: - storage: 20Gi - storageClassName: longhorn - accessModes: - - ReadWriteMany - - ReadWriteOnce - zookeeper: - persistence: - enabled: true - size: 8Gi - accessModes: - - ReadWriteMany - - ReadWriteOnce - storageClass: longhorn - redis: - master: - persistence: - enabled: true - size: 5Gi - accessModes: - - ReadWriteOnce - - ReadWriteMany - storageClass: longhorn - replica: - persistence: - enabled: true - size: 5Gi - accessModes: - - ReadWriteOnce - - ReadWriteMany - storageClass: longhorn - postgresql: - enabled: false - externalPostgresql: - port: 5432 - username: sentry - password: ENC[AES256_GCM,data:poj0izLlXR7y6xZI8CHrXV/COL6q8kUvNNs5hEr2/LXveA4YKF1zlQMELUOzMyUwHvovjTBoKXEy9UQ2Rrf/WQ==,iv:U/c72XqWoeKflHx5sWKP/iz1ZMLdS1SmjW0fQKr/jlo=,tag:Mnu9FLOjXcIYQoX0eJQmHA==,type:str] - database: sentry - connMaxAge: 600 - host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local - sslMode: require - rabbitmq: - enabled: false - kafka: - controller: - persistence: - enabled: true - size: 10Gi - accessModes: - - ReadWriteMany - - ReadWriteOnce - storageClass: longhorn - logPersistence: - enabled: false -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhQXBKUG1SWmliSUU2Z1Rn - dWdlTTVkbUllcXVxbzhQMnVBNzhHNzJETEdnCjdVZ1crSjROT1lnM0cweWcrUzZF - cThwQW44TGNQUDkrdU5PNTZIc3laTzQKLS0tIEkzQnFUdTZteGxpNElHYXlxbjdZ - Y3BhYXZ4RmpHcUpEQ2ZSK3NZUEtwekEKfudmrfTPHxLJtILnz3B7/uWKwBgrIE3W - lchyeAAESQ9KFFnYuCaKuIvxM48x1KLN4LkrWnV4BPWCsx6wryV6fA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-12-16T11:05:34Z" - mac: ENC[AES256_GCM,data:hxsmpfgd4CQs7eY9iYyn066NXd0nqdm/WRNuNV9LdgoBR2gdyI9t/a3JOoc5gNXC+qQyIG86VUpVkMUiiHZBFkgMqk65DAeoupat1d6pZ7+4G0YJWRTRWNmNrQe0eSdLx0Bg1xyxuN8tkYZnmg/yWPvj/EDzHOdcUQCUMthz02A=,iv:tNoFVh1X0OsiW9yMTsJauekxEl7R9RBxQgQ4t6HiB3M=,tag:DBYh6FgHcG9EtEx2JiPhdA==,type:str] - pgp: [] - encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ - version: 3.9.1 diff --git a/apps/talos_cluster/sentry/repository.yaml b/apps/talos_cluster/sentry/repository.yaml @@ -1,8 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: sentry - namespace: sentry -spec: - interval: 60m - url: https://sentry-kubernetes.github.io/charts diff --git a/apps/talos_cluster/sentry/route.yaml b/apps/talos_cluster/sentry/route.yaml @@ -1,32 +0,0 @@ -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: sentry - namespace: sentry -spec: - parentRefs: - - name: envoy-gateway - namespace: envoy-gateway - hostnames: - - sentry.mtrnord.blog - rules: - - backendRefs: - - name: sentry-nginx - port: 80 - timeouts: - request: 240s - backendRequest: 0s ---- -apiVersion: gateway.envoyproxy.io/v1alpha1 -kind: BackendTrafficPolicy -metadata: - name: sentry-compression - namespace: sentry -spec: - targetRef: - group: gateway.networking.k8s.io - kind: HTTPRoute - name: sentry - compression: - - type: Gzip - - type: Brotli