commit 6bdcd90ff6f63f34be0feb3b5590085e43f8a815
parent 40408097d5d7307652bdbb5a0788be6ab5133b78
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Mon, 20 Oct 2025 20:47:44 +0200
anubis
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
14 files changed, 523 insertions(+), 446 deletions(-)
diff --git a/.gitleaksignore b/.gitleaksignore
@@ -1,2 +1,3 @@
apps/talos_cluster/monitoring-stack/dashboards/connectivity-tester-dashboard.json:generic-api-key:328
apps/talos_cluster/blog/docker/wp-cache-config.php:generic-api-key:9
+apps/talos_cluster/cgit/deployment.yaml:generic-api-key:51
diff --git a/apps/talos_cluster/blog/docker/Dockerfile b/apps/talos_cluster/blog/docker/Dockerfile
@@ -114,9 +114,9 @@ RUN wget -q https://downloads.wordpress.org/plugin/wp-mail-smtp.4.6.0.zip \
&& rm wp-mail-smtp.4.6.0.zip
# Install Simply Gallery Block
-RUN wget -q https://downloads.wordpress.org/plugin/simply-gallery-block.3.2.7.zip \
- && unzip -q simply-gallery-block.3.2.7.zip -d /var/www/html/wordpress/wp-content/plugins/ \
- && rm simply-gallery-block.3.2.7.zip
+RUN wget -q https://downloads.wordpress.org/plugin/simply-gallery-block.3.2.8.zip \
+ && unzip -q simply-gallery-block.3.2.8.zip -d /var/www/html/wordpress/wp-content/plugins/ \
+ && rm simply-gallery-block.3.2.8.zip
# Install Table of Contents Block
RUN wget -q https://downloads.wordpress.org/plugin/table-of-content-block.1.0.6.zip \
diff --git a/apps/talos_cluster/blog/docker/wordpress.conf b/apps/talos_cluster/blog/docker/wordpress.conf
@@ -118,7 +118,7 @@ server {
fastcgi_pass phpfpm;
}
- location ~* \.(ogg|ogv|svg|svgz|eot|otf|woff|woff2|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
+ location ~* \.(avif|ogg|ogv|svg|svgz|eot|otf|woff|woff2|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
expires max;
log_not_found off;
access_log off;
diff --git a/apps/talos_cluster/blog/mysql.yaml b/apps/talos_cluster/blog/mysql.yaml
@@ -18,74 +18,74 @@ spec:
- name: mysql
image: mariadb:12.0
env:
- - name: MARIADB_ROOT_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: admin-password
- - name: MARIADB_USER
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: username
- - name: MARIADB_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: password
- - name: MARIADB_DATABASE
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: db-name
- - name: MYSQL_ROOT_HOST
- value: "%"
+ - name: MARIADB_ROOT_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: admin-password
+ - name: MARIADB_USER
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: username
+ - name: MARIADB_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: password
+ - name: MARIADB_DATABASE
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: db-name
+ - name: MYSQL_ROOT_HOST
+ value: "%"
volumeMounts:
- - name: mysql-volume
- mountPath: /var/lib/mysql
- - name: mysql-configmap
- mountPath: /docker-entrypoint-initdb.d
- - name: mysql-config
- mountPath: /etc/mysql/conf.d
+ - name: mysql-volume
+ mountPath: /var/lib/mysql
+ - name: mysql-configmap
+ mountPath: /docker-entrypoint-initdb.d
+ - name: mysql-config
+ mountPath: /etc/mysql/conf.d
resources:
- requests:
- memory: "256Mi"
- cpu: "100m"
- limits:
- memory: "1024Mi"
- cpu: "600m"
+ requests:
+ memory: "256Mi"
+ cpu: "100m"
+ limits:
+ memory: "1024Mi"
+ cpu: "600m"
livenessProbe:
- tcpSocket:
- port: 3306
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 5
- successThreshold: 1
- failureThreshold: 3
+ tcpSocket:
+ port: 3306
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 5
+ successThreshold: 1
+ failureThreshold: 3
readinessProbe:
- tcpSocket:
- port: 3306
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 5
- successThreshold: 1
- failureThreshold: 3
+ tcpSocket:
+ port: 3306
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 5
+ successThreshold: 1
+ failureThreshold: 3
volumes:
- name: mysql-configmap
configMap:
- name: mysql-configmap
+ name: mysql-configmap
- name: mysql-config
configMap:
- name: mysql-config
+ name: mysql-config
volumeClaimTemplates:
- metadata:
- name: mysql-volume
+ name: mysql-volume
spec:
- accessModes: ["ReadWriteOnce"]
- storageClassName: "longhorn"
- resources:
- requests:
- storage: 2Gi
+ accessModes: ["ReadWriteOnce"]
+ storageClassName: "longhorn"
+ resources:
+ requests:
+ storage: 2Gi
---
apiVersion: v1
kind: Service
diff --git a/apps/talos_cluster/blog/wordpress.yaml b/apps/talos_cluster/blog/wordpress.yaml
@@ -32,77 +32,77 @@ spec:
- name: wordpress
image: ghcr.io/mtrnord/blog:latest
env:
- - name: DB_HOST
- value: mysql-service.blog.svc.cluster.local
- - name: DB_USER
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: username
- - name: DB_PASSWORD
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: password
- - name: DB_NAME
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: db-name
- - name: AUTH_KEY
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: auth-key
- - name: SECURE_AUTH_KEY
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: secure-auth-key
- - name: LOGGED_IN_KEY
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: logged-in-key
- - name: NONCE_KEY
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: nonce-key
- - name: AUTH_SALT
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: auth-salt
- - name: SECURE_AUTH_SALT
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: secure-auth-salt
- - name: LOGGED_IN_SALT
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: logged-in-salt
- - name: NONCE_SALT
- valueFrom:
- secretKeyRef:
- name: mysql-cred
- key: nonce-salt
+ - name: DB_HOST
+ value: mysql-service.blog.svc.cluster.local
+ - name: DB_USER
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: username
+ - name: DB_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: password
+ - name: DB_NAME
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: db-name
+ - name: AUTH_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: auth-key
+ - name: SECURE_AUTH_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: secure-auth-key
+ - name: LOGGED_IN_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: logged-in-key
+ - name: NONCE_KEY
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: nonce-key
+ - name: AUTH_SALT
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: auth-salt
+ - name: SECURE_AUTH_SALT
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: secure-auth-salt
+ - name: LOGGED_IN_SALT
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: logged-in-salt
+ - name: NONCE_SALT
+ valueFrom:
+ secretKeyRef:
+ name: mysql-cred
+ key: nonce-salt
ports:
- - containerPort: 8080
- name: wordpress
+ - containerPort: 8080
+ name: wordpress
resources:
- requests:
- memory: "256Mi"
- cpu: "100m"
- limits:
- memory: "2048Mi"
- cpu: "2000m"
+ requests:
+ memory: "256Mi"
+ cpu: "100m"
+ limits:
+ memory: "2048Mi"
+ cpu: "2000m"
volumeMounts:
- - name: wordpress-persistent-storage
- mountPath: /var/www/html/wordpress/wp-content/uploads
- subPath: uploads
+ - name: wordpress-persistent-storage
+ mountPath: /var/www/html/wordpress/wp-content/uploads
+ subPath: uploads
#- name: wordpress-persistent-storage
# mountPath: /var/www/html/wordpress/wp-content/plugins
# subPath: plugins
@@ -110,29 +110,29 @@ spec:
# mountPath: /var/www/html/wordpress/wp-content/themes
# subPath: themes
readinessProbe:
- httpGet:
- path: /wp-login.php
- port: 8080
- scheme: "HTTP"
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 15
- successThreshold: 1
- failureThreshold: 3
+ httpGet:
+ path: /wp-login.php
+ port: 8080
+ scheme: "HTTP"
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 15
+ successThreshold: 1
+ failureThreshold: 3
livenessProbe:
- httpGet:
- path: /wp-login.php
- port: 8080
- scheme: "HTTP"
- initialDelaySeconds: 60
- periodSeconds: 10
- timeoutSeconds: 15
- successThreshold: 1
- failureThreshold: 3
+ httpGet:
+ path: /wp-login.php
+ port: 8080
+ scheme: "HTTP"
+ initialDelaySeconds: 60
+ periodSeconds: 10
+ timeoutSeconds: 15
+ successThreshold: 1
+ failureThreshold: 3
volumes:
- name: wordpress-persistent-storage
persistentVolumeClaim:
- claimName: wordpress-pvc
+ claimName: wordpress-pvc
---
kind: Service
apiVersion: v1
@@ -162,8 +162,8 @@ spec:
- mtrnord.blog
rules:
- backendRefs:
- - name: wordpress-service
- port: 8080
+ - name: wordpress-service
+ port: 8080
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
diff --git a/apps/talos_cluster/cgit/anubis-secret.yaml b/apps/talos_cluster/cgit/anubis-secret.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: anubis-key
+ namespace: git
+type: Opaque
+stringData:
+ ED25519_PRIVATE_KEY_HEX: ENC[AES256_GCM,data:JIaos5kgzi1MBUW2b+MGEY8otBbcYGVS00tkWWmBkCH1TnmRbAYbg5YIJvUBB5GPwDbd7i8VPiyMCaDp5HGvHQ==,iv:Ew/4sC5eIPTU/w3kk/Ny2Qj55D5S09zWETdeb1NfQtA=,tag:xLyROMmANbXupQwnG5s+CA==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTDlGd1RzSjQyRlhIWmdR
+ T00ycnNJbkNoaSswTjhQaCs0V25mRkdRUUVZCkJ3VnUvK1ZQd2Q5U3BhNE15L1BJ
+ ZUlEV3I1ZGlydlV0SkU2NUZRelZndTAKLS0tIGdva1B2Qk1WWTVkL2NweWpOLzVH
+ ZW05QUNvODFndnVNZHdRZjZPTHZBWDQKuJpxyObJLh7o9cOkUYwFEiYE+E+9nSE3
+ 1nRWG84+UOPQjko62JtIsWJ3xLHLpJb0BHrZk/HkAqciOiTk8dJy/A==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-10-20T18:47:40Z"
+ mac: ENC[AES256_GCM,data:qXtxTMT9hOooEUPMR1u5OPN3qFD18MUNnK+GrqaoBB5g87EzwL346HQKLMbtVjfx1z/m4xKCggPKyOpLZZddYwOBQoNgeYuDy7U4gy2lqlaWzRqp6WohZEDvkEYwux1s5iwcI7Wm396hXqQSgqTCwLdmEzoC4RaaACGfNzPib0Y=,iv:C9thmSKNHEc4O1dnrQNglOnRS0jTlIhjA70JD/2yGkI=,tag:lYk7/XPg/vFyFvlgBB/CeA==,type:str]
+ pgp: []
+ encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/cgit/deployment.yaml b/apps/talos_cluster/cgit/deployment.yaml
@@ -36,6 +36,50 @@ spec:
imagePullSecrets:
- name: ghcr-pull
containers:
+ - name: anubis
+ image: ghcr.io/techarohq/anubis:latest
+ imagePullPolicy: Always
+ env:
+ - name: "BIND"
+ value: ":8081"
+ - name: "DIFFICULTY"
+ value: "4"
+ - name: ED25519_PRIVATE_KEY_HEX
+ valueFrom:
+ secretKeyRef:
+ name: anubis-key
+ key: ED25519_PRIVATE_KEY_HEX
+ - name: "METRICS_BIND"
+ value: ":9090"
+ - name: "SERVE_ROBOTS_TXT"
+ value: "true"
+ - name: "TARGET"
+ value: "http://localhost:8080"
+ - name: "OG_PASSTHROUGH"
+ value: "false"
+ - name: "OG_EXPIRY_TIME"
+ value: "24h"
+ resources:
+ limits:
+ cpu: 750m
+ memory: 256Mi
+ requests:
+ cpu: 250m
+ memory: 256Mi
+ ports:
+ - containerPort: 8081
+ name: anubis
+ protocol: TCP
+ securityContext:
+ runAsUser: 1000
+ runAsGroup: 1000
+ runAsNonRoot: true
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ seccompProfile:
+ type: RuntimeDefault
- name: cgit
image: ghcr.io/mtrnord/cgit-docker:main
imagePullPolicy: Always
diff --git a/apps/talos_cluster/cgit/kustomization.yaml b/apps/talos_cluster/cgit/kustomization.yaml
@@ -3,5 +3,6 @@ kind: Kustomization
namespace: git
resources:
- ssh-keys.yaml
+ - anubis-secret.yaml
- deployment.yaml
- service.yaml
diff --git a/apps/talos_cluster/cgit/service.yaml b/apps/talos_cluster/cgit/service.yaml
@@ -13,6 +13,10 @@ spec:
targetPort: http
protocol: TCP
name: http
+ - port: 8081
+ targetPort: anubis
+ protocol: TCP
+ name: anubis
- port: 2222
targetPort: ssh
protocol: TCP
@@ -32,7 +36,7 @@ spec:
rules:
- backendRefs:
- name: cgit
- port: 8080
+ port: 8081
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
diff --git a/apps/talos_cluster/continuwuity/deployment.yaml b/apps/talos_cluster/continuwuity/deployment.yaml
@@ -18,45 +18,45 @@ spec:
containers:
- name: continuwuity
resources:
- limits: {}
- requests:
- memory: "100Mi"
- cpu: "28m"
+ limits: {}
+ requests:
+ memory: "100Mi"
+ cpu: "28m"
image: forgejo.ellis.link/continuwuation/continuwuity:main
#image: forgejo.ellis.link/continuwuation/continuwuity:pr-1099-head
imagePullPolicy: Always
ports:
- - containerPort: 8448
+ - containerPort: 8448
# Mount the continuwuity config which is stored in the continuwuity-config secret at the config path and should go to /config.yaml
volumeMounts:
- - name: continuwuity-config
- mountPath: /etc/conduwuit
- readOnly: true
- - name: continuwuity-data
- mountPath: /var/lib/continuwuity
+ - name: continuwuity-config
+ mountPath: /etc/conduwuit
+ readOnly: true
+ - name: continuwuity-data
+ mountPath: /var/lib/continuwuity
env:
- - name: CONTINUWUITY_CONFIG
- value: /etc/conduwuit/conduwuit.toml
+ - name: CONTINUWUITY_CONFIG
+ value: /etc/conduwuit/conduwuit.toml
livenessProbe:
- httpGet:
- path: /_matrix/client/versions
- port: 8448
- initialDelaySeconds: 50
- timeoutSeconds: 5
+ httpGet:
+ path: /_matrix/client/versions
+ port: 8448
+ initialDelaySeconds: 50
+ timeoutSeconds: 5
readinessProbe:
- httpGet:
- path: /_matrix/client/versions
- port: 8448
- initialDelaySeconds: 20
- timeoutSeconds: 5
+ httpGet:
+ path: /_matrix/client/versions
+ port: 8448
+ initialDelaySeconds: 20
+ timeoutSeconds: 5
# Mount the continuwuity config which is stored in the continuwuity-config secret at the config path and should go to /config.yaml
volumes:
- name: continuwuity-config
secret:
- secretName: continuwuity-config
+ secretName: continuwuity-config
- name: continuwuity-data
persistentVolumeClaim:
- claimName: continuwuity
+ claimName: continuwuity
---
apiVersion: v1
kind: Service
@@ -86,40 +86,40 @@ spec:
# Client traffic (sync, login, media, etc.)
- name: client-traffic
matches:
- - path:
- type: PathPrefix
- value: /_matrix/client
+ - path:
+ type: PathPrefix
+ value: /_matrix/client
backendRefs:
- - name: continuwuity
- port: 8448
+ - name: continuwuity
+ port: 8448
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
- name: media-traffic
matches:
- - path:
- type: PathPrefix
- value: /_matrix/media
+ - path:
+ type: PathPrefix
+ value: /_matrix/media
backendRefs:
- - name: continuwuity
- port: 8448
+ - name: continuwuity
+ port: 8448
# Federation traffic
- name: federation-traffic
matches:
- - path:
- type: PathPrefix
- value: /_matrix/federation
+ - path:
+ type: PathPrefix
+ value: /_matrix/federation
backendRefs:
- - name: continuwuity
- port: 8448
+ - name: continuwuity
+ port: 8448
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
# Fallback (anything else Matrix-y)
- name: fallback
backendRefs:
- - name: continuwuity
- port: 8448
+ - name: continuwuity
+ port: 8448
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -48,42 +48,42 @@ spec:
protocol: TCP
port: 25
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submissions
protocol: TCP
port: 465
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submission
protocol: TCP
port: 587
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imap
protocol: TCP
port: 143
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imaps
protocol: TCP
port: 993
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
@@ -107,384 +107,384 @@ spec:
protocol: TCP
port: 22
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: https-talos-midnightthoughts
protocol: HTTPS
hostname: "talos.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: talos.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: talos.midnightthoughts.space-tls
- name: https-nordgedanken.dev
protocol: HTTPS
hostname: "nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-openpgpkey.nordgedanken.dev
protocol: HTTPS
hostname: "openpgpkey.nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: openpgpkey.nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: openpgpkey.nordgedanken.dev-tls
- name: https-midnightthoughts-auth
protocol: HTTPS
hostname: "auth.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: auth.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: auth.midnightthoughts.space-tls
- name: https-midnightthoughts-grafana
protocol: HTTPS
hostname: "grafana.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: grafana.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: grafana.midnightthoughts.space-tls
- name: https-draupnir-midnightthoughts
protocol: HTTPS
hostname: "draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: draupnir.midnightthoughts.space-tls
- name: https-matrix-draupnir-midnightthoughts
protocol: HTTPS
hostname: "matrix.draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.draupnir.midnightthoughts.space-tls
- name: https-midnightthoughts-vault
protocol: HTTPS
hostname: "vault.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: vault.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: vault.midnightthoughts.space-tls
- name: https-midnightthoughts-budget
protocol: HTTPS
hostname: "budget.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: budget.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: budget.midnightthoughts.space-tls
- name: https-midnightthoughts-ldap
protocol: HTTPS
hostname: "ldap.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ldap.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ldap.midnightthoughts.space-tls
- name: ldap
protocol: TCP
port: 389
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: https-mtrnord-blog-gts
protocol: HTTPS
hostname: "gts.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: gts.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: gts.mtrnord.blog-tls
- name: https-midnightthoughts-collabora
protocol: HTTPS
hostname: "collabora.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: collabora.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: collabora.midnightthoughts.space
- name: https-midnightthoughts-webhook-kubernetes
protocol: HTTPS
hostname: "webhook.kubernetes.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.kubernetes.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.kubernetes.midnightthoughts.space-tls
- name: https-api-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "api.connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: api.connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: api.connectivity-tester.mtrnord.blog-tls
- name: https-stage-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "stage.connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: stage.connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: stage.connectivity-tester.mtrnord.blog-tls
- name: https-connectivity-tester-mtrnord-blog
protocol: HTTPS
hostname: "connectivity-tester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: connectivity-tester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: connectivity-tester.mtrnord.blog-tls
- name: https-federationtester-mtrnord-blog
protocol: HTTPS
hostname: "federationtester.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: federationtester.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: federationtester.mtrnord.blog-tls
- name: https-mtrnord-blog-root
protocol: HTTPS
hostname: "mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mtrnord.blog-tls
- name: https-mtrnord-blog-matrix
protocol: HTTPS
hostname: "matrix.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.mtrnord.blog-tls
- name: https-rss-mtrnord-blog
protocol: HTTPS
hostname: "rss.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rss.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rss.mtrnord.blog-tls
- name: https-notify-mtrnord-blog
protocol: HTTPS
hostname: "notify.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: notify.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: notify.mtrnord.blog-tls
- name: https-midnightthoughts-rspamd
protocol: HTTPS
hostname: "rspamd.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rspamd.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rspamd.midnightthoughts.space-tls
- name: https-midnightthoughts-plane
protocol: HTTPS
hostname: "plane.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: plane.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: plane.midnightthoughts.space
- name: https-midnightthoughts-kimai
protocol: HTTPS
hostname: "kimai.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: kimai.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: kimai.midnightthoughts.space
- name: https-midnightthoughts-morg-statistics
protocol: HTTPS
hostname: "morg-statistics.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: morg-statistics.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: morg-statistics.midnightthoughts.space
- name: https-midnightthoughts-mta-sts
protocol: HTTPS
hostname: "mta-sts.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mta-sts.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mta-sts.midnightthoughts.space
- name: https-midnightthoughts-lists
protocol: HTTPS
hostname: "lists.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: lists.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: lists.midnightthoughts.space
- name: https-midnightthoughts-git
protocol: HTTPS
hostname: "git.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: git.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: git.midnightthoughts.space
- name: https-midnightthoughts-plausible
protocol: HTTPS
hostname: "plausible.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: plausible.midnightthoughts.space
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: plausible.midnightthoughts.space
- name: http
protocol: HTTP
port: 80
allowedRoutes:
- namespaces:
- from: "All"
- # - name: https-midnightthoughts-capacitor
- # protocol: HTTPS
- # hostname: "ui.k8s.midnightthoughts.space"
- # port: 443
- # allowedRoutes:
- # namespaces:
- # from: "All"
- # tls:
- # mode: Terminate
- # certificateRefs:
- # - kind: Secret
- # name: ui.k8s.midnightthoughts.space-tls
+ namespaces:
+ from: "All"
+ # - name: https-midnightthoughts-capacitor
+ # protocol: HTTPS
+ # hostname: "ui.k8s.midnightthoughts.space"
+ # port: 443
+ # allowedRoutes:
+ # namespaces:
+ # from: "All"
+ # tls:
+ # mode: Terminate
+ # certificateRefs:
+ # - kind: Secret
+ # name: ui.k8s.midnightthoughts.space-tls
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
diff --git a/apps/talos_cluster/plausible/release.yaml b/apps/talos_cluster/plausible/release.yaml
@@ -53,7 +53,7 @@ spec:
tls:
- secretName: plausible.midnightthoughts.space-tls
hosts:
- - plausible.midnightthoughts.space
+ - plausible.midnightthoughts.space
sops:
kms: []
gcp_kms: []
@@ -62,13 +62,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsMTlGbFBDRHRKTStDem9P
- YzkyMkpCU0dUY3JxcVh5U0pNQ0c1Nk51QWxFCkpaREg3VmFzZUpDWWx1aWx4S3ph
- R0xFZW5mZmdrYVNUTkZ5cmR6OGZVekUKLS0tIEpQcGZwdlBpU2ZzM3RyOFg2cEEr
- WmsxdDBKazdGU1prc0J3Sm5KNkFIZ2cKmLPkcujA43iuZKbztxKccV5jLLSrkh9D
- kySjfHTy9HHCEJLxGfZ+iEpeMEF4x91GF6wIPXTyD4XqamsbvYdlcA==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsMTlGbFBDRHRKTStDem9P
+ YzkyMkpCU0dUY3JxcVh5U0pNQ0c1Nk51QWxFCkpaREg3VmFzZUpDWWx1aWx4S3ph
+ R0xFZW5mZmdrYVNUTkZ5cmR6OGZVekUKLS0tIEpQcGZwdlBpU2ZzM3RyOFg2cEEr
+ WmsxdDBKazdGU1prc0J3Sm5KNkFIZ2cKmLPkcujA43iuZKbztxKccV5jLLSrkh9D
+ kySjfHTy9HHCEJLxGfZ+iEpeMEF4x91GF6wIPXTyD4XqamsbvYdlcA==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-10-16T21:00:15Z"
mac: ENC[AES256_GCM,data:qsQNsaocKZ1DTIGjgK0uD2T5kpE+odfSXKD2dxB5QhpREIeORJIIB3kHPr7JYJMFPFbpfNzUXnqQymjPEbU8FfsMKtB4RhkdSzxGiLEztjnw65MufTTBF4Suur1874O7XgVcJAIOniw1Cpgj2pqBw89V1hwg+kK2uph1iSfS45U=,iv:4xWH8uaaF6Uckg7oDUyJkBFm9OeA86XWvwQDObwc5yE=,tag:6Q5rJrTs8EPlQ5VDyVUmkg==,type:str]
pgp: []
diff --git a/apps/talos_cluster/plausible/route.yaml b/apps/talos_cluster/plausible/route.yaml
@@ -1,4 +1,3 @@
----
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
@@ -12,8 +11,8 @@ spec:
- plausible.midnightthoughts.space
rules:
- backendRefs:
- - name: plausible-plausible-analytics
- port: 80
+ - name: plausible-plausible-analytics
+ port: 80
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
diff --git a/infrastructure_talos/configs/cnpg-cluster.yaml b/infrastructure_talos/configs/cnpg-cluster.yaml
@@ -112,7 +112,7 @@ spec:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
- barmanObjectName: hetzner-base-backup
+ barmanObjectName: hetzner-base-backup
managed:
roles:
- name: freshrss
@@ -120,128 +120,128 @@ spec:
login: true
superuser: false
passwordSecret:
- name: freshrss
+ name: freshrss
- name: meowlnir
ensure: present
login: true
comment: Read Only Access for synapse required but RW to meowlnir db
superuser: false
passwordSecret:
- name: meowlnir
+ name: meowlnir
- name: connectivity-tester-stage
ensure: present
login: true
superuser: false
passwordSecret:
- name: connectivity-tester-stage
+ name: connectivity-tester-stage
- name: connectivity-tester
ensure: present
login: true
superuser: false
passwordSecret:
- name: connectivity-tester
+ name: connectivity-tester
- name: draupnir_synapse
ensure: present
login: true
superuser: false
passwordSecret:
- name: draupnir-synapse
+ name: draupnir-synapse
- name: authentik
ensure: present
login: true
superuser: false
passwordSecret:
- name: authentik
+ name: authentik
- name: ejabberd
ensure: present
login: true
superuser: false
passwordSecret:
- name: ejabberd
+ name: ejabberd
- name: vaultwarden
ensure: present
login: true
superuser: false
passwordSecret:
- name: vaultwarden
+ name: vaultwarden
- name: mastodon
ensure: present
login: true
superuser: false
passwordSecret:
- name: mastodon
+ name: mastodon
- name: openproject
ensure: present
login: true
superuser: false
passwordSecret:
- name: openproject
+ name: openproject
- name: plausible
ensure: present
login: true
superuser: false
passwordSecret:
- name: plausible
+ name: plausible
- name: coder
ensure: present
login: true
superuser: false
passwordSecret:
- name: coder
+ name: coder
- name: matrix_auth
ensure: present
login: true
superuser: false
passwordSecret:
- name: matrix-auth
+ name: matrix-auth
- name: cachet
ensure: present
login: true
superuser: false
passwordSecret:
- name: cachet
+ name: cachet
- name: docuseal
ensure: present
login: true
superuser: false
passwordSecret:
- name: docuseal
+ name: docuseal
- name: bugzilla
ensure: present
login: true
superuser: false
passwordSecret:
- name: bugzilla
+ name: bugzilla
- name: rundeck
ensure: present
login: true
superuser: false
passwordSecret:
- name: rundeck
+ name: rundeck
- name: plane
ensure: present
login: true
superuser: false
passwordSecret:
- name: plane
+ name: plane
- name: gotosocial
ensure: present
login: true
superuser: false
passwordSecret:
- name: gotosocial
+ name: gotosocial
- name: grafana-ro
ensure: present
login: true
superuser: false
passwordSecret:
- name: grafana-ro
+ name: grafana-ro
- name: mailman
ensure: present
login: true
superuser: false
passwordSecret:
- name: mailman
+ name: mailman
storage:
storageClass: hcloud-volumes
size: 15Gi
