commit 76010828e212ff25cdd7588648517dd2f8bed596
parent cba557e3014cb4d08b016a0f3748eb890a320b6e
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 13 Aug 2025 15:07:05 +0200
Deploy kimai
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
8 files changed, 126 insertions(+), 1 deletion(-)
diff --git a/apps/talos_cluster/envoy-gateway/gateway_settings.yaml b/apps/talos_cluster/envoy-gateway/gateway_settings.yaml
@@ -363,6 +363,18 @@ spec:
certificateRefs:
- kind: Secret
name: plane.midnightthoughts.space
+ - name: https-midnightthoughts-kimai
+ protocol: HTTPS
+ hostname: "kimai.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: kimai.midnightthoughts.space
- name: http
protocol: HTTP
port: 80
diff --git a/apps/talos_cluster/kimai/kustomization.yaml b/apps/talos_cluster/kimai/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kimai
+resources:
+ - repository.yaml
+ - release.yaml
diff --git a/apps/talos_cluster/kimai/release.yaml b/apps/talos_cluster/kimai/release.yaml
@@ -0,0 +1,94 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta2
+kind: HelmRelease
+metadata:
+ name: kimai
+ namespace: kimai
+spec:
+ releaseName: kimai
+ chart:
+ spec:
+ chart: kimai2
+ sourceRef:
+ kind: HelmRepository
+ name: kimai
+ values:
+ kimaiAppSecret: ENC[AES256_GCM,data:GrQrVTqmVIUyryPaMnV8Dy8E2aJKaLuKDNq0Ukz4BN6vL8BK1IhTZyegMwPc07x1t6Zg3d/CoGJSBteLnMI58Q==,iv:GV4EnVZ3af70ByOkQCiOv2jIpVub5IwyX8WicpLvW5g=,tag:IkOPWvrKTKc7TAFtBrEBZg==,type:str]
+ kimaiAdminEmail: noreply@midnightthoughts.space
+ kimaiAdminPassword: ENC[AES256_GCM,data:l9OAms9NdQA3,iv:0Pqvr7v61ocDcDfAnwI96DgWB6DDlhHSqeNaRFcer7w=,tag:6+9Di44hmmjMkj/htPPq3g==,type:str]
+ kimaiMailerFrom: noreply@midnightthoughts.space
+ # TODO
+ kimaiMailerUrl: null://localhost
+ kimaiTrustedProxies: ""
+ # TODO?
+ kimaiRedisCache: true
+ service:
+ type: ClusterIP
+ ingress:
+ enabled: false
+ persistence:
+ enabled: true
+ storageClass: longhorn
+ size: 4Gi
+ accessModes:
+ - ReadWriteOnce
+ extraVolumeMounts:
+ - mountPath: /opt/kimai/var/plugins
+ name: kimai-data
+ subPath: plugins
+ volumePermissions:
+ enabled: true
+ mariadb:
+ enabled: true
+ architecture: standalone
+ auth:
+ rootPassword: ENC[AES256_GCM,data:NfYUj+y4/YGrdDGbEVxIFw8Wiqs0cws7dSyPrDCag29qY0iBNMmZYbhA8T2HkyPaYPrMzbaXnbFrnUmV6xBnJA==,iv:z0JcqWnLOns9NMPlBomdQMC7pA+ENWQzpt/1kaMDLR4=,tag:Wl4uB6w+6sfF8hmHT6/08w==,type:str]
+ password: ENC[AES256_GCM,data:FBQon1kmxTI0zWCY3ltdcbaC/WfUwxlJWAlxbaL8YssnN1iGGSlEPSnq2TI+Y7ncKsr0nLOs4cZRQjGZ4apsEA==,iv:H0FA42rQ7oFCYTZTMlgfgfaXi9FFEulavw43igzdZXc=,tag:7lOS/MX272wB6dZz1sogsQ==,type:str]
+ primary:
+ persistence:
+ enabled: true
+ storageClass: longhorn
+ size: 4Gi
+ accessModes:
+ - ReadWriteOnce
+ redis:
+ enabled: true
+ architecture: standalone
+# ---
+# apiVersion: gateway.networking.k8s.io/v1
+# kind: HTTPRoute
+# metadata:
+# name: kimai
+# namespace: kimai
+# spec:
+# parentRefs:
+# - name: envoy-gateway
+# namespace: envoy-gateway
+# hostnames:
+# - kimai.midnightthoughts.space
+# rules:
+# - backendRefs:
+# - name: kimai-service
+# port: 8080
+# timeouts:
+# request: 240s
+# backendRequest: 0s
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRXE0OWtNS0cvQUV5eVJU
+ UC9BcHVWdFBpUEU5cDlBTGZ2QkhsYWR2ZmlRCjBvR1QvRGhFSlR6UnE2RWdsSmpm
+ cFBLVHc2dGhpVkRiWUc1aFB0ZUVZdE0KLS0tIFVlVWl3VEdYbHdxeTQ0MTkzZEJL
+ ekRWMkQzbTRCK2YzTSt3M01FZFlTbUkKD8v4HQXBCIiSwOl/YDEL8kY3k5C2cfwI
+ wF+Qip6CYBbce2tx88mnzdJqD1ZhRuNGJLrhe5Df/ojinSIQnFmKdw==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-08-13T13:06:54Z"
+ mac: ENC[AES256_GCM,data:JD6+ppLM3xI5rnXcY8ch1DEmGq29lkqMxK5Gr5+ZC4403aSf3TUr93dvGxfRTO+AP5oHc2d0eqZISDDPsg59VpK8m7fwbn9/kohv93MZGKjtMJ00diGRhnCak4AHNA+SfatpU/wkYxxDTAJWqCx+e8inoopqhcK1NJMF5g8cESA=,iv:OR+OC5L8hhsphOchWDEw+NADpAh0ltFAt1HnwakS2gA=,tag:Rqw8JvtJCtFbUpXFHEUmNw==,type:str]
+ pgp: []
+ encrypted_regex: ^(kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/kimai/repository.yaml b/apps/talos_cluster/kimai/repository.yaml
@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+ name: kimai
+ namespace: kimai
+spec:
+ url: https://robjuz.github.io/helm-charts/
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -18,3 +18,4 @@ resources:
- ./ntfy
- ./mailserver
- ./plane
+ - ./kimai
diff --git a/apps/talos_cluster/namespaces/kimai.yaml b/apps/talos_cluster/namespaces/kimai.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: kimai
diff --git a/apps/talos_cluster/namespaces/kustomization.yaml b/apps/talos_cluster/namespaces/kustomization.yaml
@@ -15,3 +15,4 @@ resources:
- ntfy.yaml
- mailserver.yaml
- plane.yaml
+ - kimai.yaml
diff --git a/encrypt.sh b/encrypt.sh
@@ -2,5 +2,5 @@
sops --age=age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh \
--encrypt \
- --encrypted-regex '^(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
+ --encrypted-regex '^(kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$' \
--in-place "$1"
