commit b0059fdd588e082056da4e737ec2688e6d3d7a2a
parent 19eae5793cabd57144385e49b6cd85f3ac5fedab
Author: MTRNord <mtrnord1@gmail.com>
Date: Wed, 9 Apr 2025 19:22:05 +0200
Prepare mariadb for irc
Diffstat:
12 files changed, 1144 insertions(+), 150 deletions(-)
diff --git a/apps/2024_cluster/namespaces/irc.yaml b/apps/2024_cluster/namespaces/irc.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+ name: irc
diff --git a/apps/2024_cluster/namespaces/kustomization.yaml b/apps/2024_cluster/namespaces/kustomization.yaml
@@ -35,3 +35,4 @@ resources:
#- changedetection.yaml
- xandikos.yaml
- plane.yaml
+ - irc.yaml
diff --git a/apps/2024_cluster/secrets/irc.yaml b/apps/2024_cluster/secrets/irc.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: irc-db
+ namespace: irc
+type: Opaque
+stringData:
+ password: ENC[AES256_GCM,data:JpwnlR+R4O0b7fVyzh51XOggeqvzr2hokerSAgLZWBaZj85O1BGZY/c4jEnqn+g3DxApNd5rrpjuChuaZy7Eqg==,iv:eCwTnJnnCafI17fQlI07vBVI7GcelTwcfOslggzDTqo=,tag:LO6B2mL6/WsAagj1pYzEAg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNRmc3YXh4dEYrTjczMVpZ
+ U0lMeERpVlY3endXRER1S1FtWjBjSEFuaEhJCmZYTk1mMHRhVldidjdIYVdvN1d1
+ dDdzNndWdWJIZlAxSjNvc2RsRUp4dDQKLS0tIHkzbkZpUzZOenB6b0dUSm9XdEtB
+ cm1Cd1lsZGtKa29rMmFGQTcrVmV3U3MKUBCIvT2JDh/38UcwGgFXx7Ow/nqnINmc
+ iOr4cXl8yjU4RP6Cq0L1f/ibRPfGutOFo4SjgSqm7CLckjPmJ7br7Q==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-09T17:03:54Z"
+ mac: ENC[AES256_GCM,data:EiPm13lRimo+691Jc4TuaMBAl+EZVN/TO9QBSDkZo9yeOxgjvhHVXndEzROqj2bOFk2x4eHlSrXuUhlSjp9RSnvJbKIJkc7sE9BGLutqTbwewYcQDe2mqHJ/DzpchmSK8RjzqCANz88VBAf4Hg5BMH5kcWbvEzQzFhcTCPMbn0M=,iv:ZuonCaRnh/TZVpFGns4CXHXKT2tZ+X2hJ1le69US7P8=,tag:Rycco6OrsH3d0wXaZDGrwQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(root_password|pgdb_password|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/2024_cluster/secrets/kustomization.yaml b/apps/2024_cluster/secrets/kustomization.yaml
@@ -20,3 +20,4 @@ resources:
- rundeck.yaml
- hubzilla.yaml
- archivebox.yaml
+ - irc.yaml
diff --git a/apps/2024_cluster/secrets/mariadb-operator.yaml b/apps/2024_cluster/secrets/mariadb-operator.yaml
@@ -1,6 +1,6 @@
apiVersion: v1
stringData:
- password: ENC[AES256_GCM,data:1n57UxVIMT7iqjLdmXJGFrwNoPWQOdjUnNryTxUWgoJg5Cdyp+szCpdcaGckw/PSxwGiZD8AYuJqThyO8GclFQ==,iv:tWK2VP4AMFeGN5pqYsrcf0b7kHjU2q8xLT27hncNupc=,tag:pvUVVG8wk6n5Eyybx3g0XQ==,type:str]
+ password: ENC[AES256_GCM,data:+mlr+JyQLQq9v4MBB2XYSAGQPyV/co/ogItD/06Bd+oegJ9w124tMH1SLwKrY1X8ZbBf9rZavQhnsrBflzweTQ==,iv:U31QA9LHuqADo1KpQ1Pc9xAxDou8gQjFJ8NyztSIg2w=,tag:ft9oVEILSkWNlHOUHCT6pA==,type:str]
kind: Secret
metadata:
name: mariadb-osticket
@@ -14,21 +14,21 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMklRb2pBRk13TWQ0OGgy
- RGF0eWZEYko4eTcxUkhqRjQ4eXRGaE9kcEVBClU5eDFLV1UrbzdJVFBSQ0NIaG5u
- ekpQSllYQXdIclJPeFpkb1BCWUtFQUkKLS0tIElLbCtQNUppT2NDNjBXMHJGTDd2
- dlA2bzBzTE9RZEdpSmIvTEtzWmtSNFEKoh0Ro4Bm3Cx+6fmhxuLHl4kJ3hVMnC7r
- 2ZxZIcDYxvfJa4HNUPPhgvW07GPxcOsFpVY3Rk2eprLIIo/jVGEkwA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5TnBUUnJnTUsza0NEVXMw
+ SUZVRExtdFF6bjlQczN1eXF5RzQwZ2lwM0J3Ck1qOWE0cEZGdEpKOTAxZ3MxeWpz
+ UStrWUhVSFEzRWRrcFJtTFRyYmcra28KLS0tIHdrcEZ5a2xKRE1SZWhrL1c5c0Nk
+ TURid1M2ckV0RUZrM3lHNmxnZnNDcDAKewPFv461u2mJe9VzwApHCQWx7TlorYcE
+ 5ORGnz1BvwK6qudR5rLiK+NyQKSUrxjm3QTUb/6IONzlmdu+SfletQ==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-03-31T14:00:12Z"
- mac: ENC[AES256_GCM,data:VaeS7DrpBcfbRY7waA6pJMq+sARW1qteqJyQvvWf2OsMenii+pZvDkxqeXkccDSnuPBKQskOx1lZRWTBTyUWG5elAo4BhGh2+nok5M/vixGnWCNZwuFrZ9y9wJ22tORPbueHSxOUR1Gs1DktlvEtpaX2/rWQfnMNU00dwnEh8EA=,iv:Qf32meXfuOs9KtQeuCp9KGfHI4HTJrxYszBIMgDGcHY=,tag:LJtSL/uIIuDVB8M/0uDhOg==,type:str]
+ lastmodified: "2025-04-09T17:03:24Z"
+ mac: ENC[AES256_GCM,data:jFEa7eeL+cGwDO1BPjbfYfbpZ9mL5cyIlTrUduf0abMyVQQYTG8xU5pSWWfGe5+jeggHRL0Ji22fAP2yVvCKmHB2QBcuzQykp4q68J389Wj9jlITwBRiVrBg9/iRmuJl2K4bJJpzDm4llAP+AYiTrULnSyst+vrRvSsv3x58k5o=,iv:N6Wx5xc8NRg4/0hiOSH7CZf/oO2nsq/MFkQxFW5IEF0=,tag:ss+PZCGmzZ8ht7SwDtgHbg==,type:str]
pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(root_password|pgdb_password|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
---
apiVersion: v1
stringData:
- password: ENC[AES256_GCM,data:g5PIyg/qjUpxqCD5zPIqJKtqpJh9q0ecCafV2elA3LxqLxAvYKP0MxT8t+Y8f61V2WKPW4xVp0DPLz1pMEc3PA==,iv:fu/ueCNA9EAnQ+cMbCXnaI0QWGLXNB6yq35D2pHFnoc=,tag:O1dETNJVpmT+Ngue7N2tOA==,type:str]
+ password: ENC[AES256_GCM,data:uBjl614oyva46lYb9xNyje0D/rs4F8fGXFYh5vTnrqunOLnxW1ANuW63nQ7sgB32jQ8cz05wrNhc5z2CAsB+Rg==,iv:y/EAFJ4bivZExIJuAa/077qrCKqcKXjLpECKewGqDrM=,tag:G/KnRCAN2DWMZnMgs3hv8A==,type:str]
kind: Secret
metadata:
name: mariadb-hubzilla
@@ -42,21 +42,21 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMklRb2pBRk13TWQ0OGgy
- RGF0eWZEYko4eTcxUkhqRjQ4eXRGaE9kcEVBClU5eDFLV1UrbzdJVFBSQ0NIaG5u
- ekpQSllYQXdIclJPeFpkb1BCWUtFQUkKLS0tIElLbCtQNUppT2NDNjBXMHJGTDd2
- dlA2bzBzTE9RZEdpSmIvTEtzWmtSNFEKoh0Ro4Bm3Cx+6fmhxuLHl4kJ3hVMnC7r
- 2ZxZIcDYxvfJa4HNUPPhgvW07GPxcOsFpVY3Rk2eprLIIo/jVGEkwA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5TnBUUnJnTUsza0NEVXMw
+ SUZVRExtdFF6bjlQczN1eXF5RzQwZ2lwM0J3Ck1qOWE0cEZGdEpKOTAxZ3MxeWpz
+ UStrWUhVSFEzRWRrcFJtTFRyYmcra28KLS0tIHdrcEZ5a2xKRE1SZWhrL1c5c0Nk
+ TURid1M2ckV0RUZrM3lHNmxnZnNDcDAKewPFv461u2mJe9VzwApHCQWx7TlorYcE
+ 5ORGnz1BvwK6qudR5rLiK+NyQKSUrxjm3QTUb/6IONzlmdu+SfletQ==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-03-31T14:00:12Z"
- mac: ENC[AES256_GCM,data:VaeS7DrpBcfbRY7waA6pJMq+sARW1qteqJyQvvWf2OsMenii+pZvDkxqeXkccDSnuPBKQskOx1lZRWTBTyUWG5elAo4BhGh2+nok5M/vixGnWCNZwuFrZ9y9wJ22tORPbueHSxOUR1Gs1DktlvEtpaX2/rWQfnMNU00dwnEh8EA=,iv:Qf32meXfuOs9KtQeuCp9KGfHI4HTJrxYszBIMgDGcHY=,tag:LJtSL/uIIuDVB8M/0uDhOg==,type:str]
+ lastmodified: "2025-04-09T17:03:24Z"
+ mac: ENC[AES256_GCM,data:jFEa7eeL+cGwDO1BPjbfYfbpZ9mL5cyIlTrUduf0abMyVQQYTG8xU5pSWWfGe5+jeggHRL0Ji22fAP2yVvCKmHB2QBcuzQykp4q68J389Wj9jlITwBRiVrBg9/iRmuJl2K4bJJpzDm4llAP+AYiTrULnSyst+vrRvSsv3x58k5o=,iv:N6Wx5xc8NRg4/0hiOSH7CZf/oO2nsq/MFkQxFW5IEF0=,tag:ss+PZCGmzZ8ht7SwDtgHbg==,type:str]
pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(root_password|pgdb_password|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
---
apiVersion: v1
stringData:
- password: ENC[AES256_GCM,data:0OI6Avd7zUJLUF7pFWOUEalPFJI5/29PKZjdUyKJYuAbWy8bIk4Qt9/u34k8J/lzd+pM2QOZWs/FBfR+ppYn+w==,iv:6jPq3BLZNEkf/miCk2A6GFHY+X+UozgyV7m3gy8+Gpw=,tag:nu3kRSomYpSps5tq7qPrnw==,type:str]
+ password: ENC[AES256_GCM,data:QpHthgwtTMMKgsD0EYX8qpyaHpTckNJMGTVJCZwls62sR6dFhqgZQeDVTAePdOswm30iSSRaIYR9xi52vfbByg==,iv:w9Yc7l9df3spVBUj6X1vimiPLB/U1Urffwg+/arQ6ko=,tag:CSvX1ORwGUIR9y5QSA6I0w==,type:str]
kind: Secret
metadata:
name: mariadb-bugzilla
@@ -70,14 +70,42 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMklRb2pBRk13TWQ0OGgy
- RGF0eWZEYko4eTcxUkhqRjQ4eXRGaE9kcEVBClU5eDFLV1UrbzdJVFBSQ0NIaG5u
- ekpQSllYQXdIclJPeFpkb1BCWUtFQUkKLS0tIElLbCtQNUppT2NDNjBXMHJGTDd2
- dlA2bzBzTE9RZEdpSmIvTEtzWmtSNFEKoh0Ro4Bm3Cx+6fmhxuLHl4kJ3hVMnC7r
- 2ZxZIcDYxvfJa4HNUPPhgvW07GPxcOsFpVY3Rk2eprLIIo/jVGEkwA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5TnBUUnJnTUsza0NEVXMw
+ SUZVRExtdFF6bjlQczN1eXF5RzQwZ2lwM0J3Ck1qOWE0cEZGdEpKOTAxZ3MxeWpz
+ UStrWUhVSFEzRWRrcFJtTFRyYmcra28KLS0tIHdrcEZ5a2xKRE1SZWhrL1c5c0Nk
+ TURid1M2ckV0RUZrM3lHNmxnZnNDcDAKewPFv461u2mJe9VzwApHCQWx7TlorYcE
+ 5ORGnz1BvwK6qudR5rLiK+NyQKSUrxjm3QTUb/6IONzlmdu+SfletQ==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-03-31T14:00:12Z"
- mac: ENC[AES256_GCM,data:VaeS7DrpBcfbRY7waA6pJMq+sARW1qteqJyQvvWf2OsMenii+pZvDkxqeXkccDSnuPBKQskOx1lZRWTBTyUWG5elAo4BhGh2+nok5M/vixGnWCNZwuFrZ9y9wJ22tORPbueHSxOUR1Gs1DktlvEtpaX2/rWQfnMNU00dwnEh8EA=,iv:Qf32meXfuOs9KtQeuCp9KGfHI4HTJrxYszBIMgDGcHY=,tag:LJtSL/uIIuDVB8M/0uDhOg==,type:str]
+ lastmodified: "2025-04-09T17:03:24Z"
+ mac: ENC[AES256_GCM,data:jFEa7eeL+cGwDO1BPjbfYfbpZ9mL5cyIlTrUduf0abMyVQQYTG8xU5pSWWfGe5+jeggHRL0Ji22fAP2yVvCKmHB2QBcuzQykp4q68J389Wj9jlITwBRiVrBg9/iRmuJl2K4bJJpzDm4llAP+AYiTrULnSyst+vrRvSsv3x58k5o=,iv:N6Wx5xc8NRg4/0hiOSH7CZf/oO2nsq/MFkQxFW5IEF0=,tag:ss+PZCGmzZ8ht7SwDtgHbg==,type:str]
pgp: []
- encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ encrypted_regex: ^(root_password|pgdb_password|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+stringData:
+ password: ENC[AES256_GCM,data:hA2iajmGzfZ2jtDK/g7WaWkFByW9QdbtvwKvOcAIFTxDnZDgR7huxF8ODMKF7TSg3Bgot5g9UmdLNuSwf/WoFA==,iv:i8ixgNWivyLeW3NaXvPapnWIwVM/SvBdWXuWsBIIeJ8=,tag:v4WInC3ZSnsL3xQjkkR7iA==,type:str]
+kind: Secret
+metadata:
+ name: mariadb-irc
+ namespace: mariadb-operator
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5TnBUUnJnTUsza0NEVXMw
+ SUZVRExtdFF6bjlQczN1eXF5RzQwZ2lwM0J3Ck1qOWE0cEZGdEpKOTAxZ3MxeWpz
+ UStrWUhVSFEzRWRrcFJtTFRyYmcra28KLS0tIHdrcEZ5a2xKRE1SZWhrL1c5c0Nk
+ TURid1M2ckV0RUZrM3lHNmxnZnNDcDAKewPFv461u2mJe9VzwApHCQWx7TlorYcE
+ 5ORGnz1BvwK6qudR5rLiK+NyQKSUrxjm3QTUb/6IONzlmdu+SfletQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-04-09T17:03:24Z"
+ mac: ENC[AES256_GCM,data:jFEa7eeL+cGwDO1BPjbfYfbpZ9mL5cyIlTrUduf0abMyVQQYTG8xU5pSWWfGe5+jeggHRL0Ji22fAP2yVvCKmHB2QBcuzQykp4q68J389Wj9jlITwBRiVrBg9/iRmuJl2K4bJJpzDm4llAP+AYiTrULnSyst+vrRvSsv3x58k5o=,iv:N6Wx5xc8NRg4/0hiOSH7CZf/oO2nsq/MFkQxFW5IEF0=,tag:ss+PZCGmzZ8ht7SwDtgHbg==,type:str]
+ pgp: []
+ encrypted_regex: ^(root_password|pgdb_password|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -454,6 +454,18 @@ spec:
certificateRefs:
- kind: Secret
name: plane.midnightthoughts.space
+ - name: https-midnightthoughts-irc
+ protocol: HTTPS
+ hostname: "irc.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: irc.midnightthoughts.space
- name: https-nordgedanken-root
protocol: HTTPS
hostname: "nordgedanken.dev"
@@ -536,6 +548,14 @@ spec:
- kind: TCPRoute
namespaces:
from: All
+ - name: ircs
+ protocol: TCP
+ port: 6697
+ allowedRoutes:
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
diff --git a/apps/base/gerrit/gerrit_cluster.yaml b/apps/base/gerrit/gerrit_cluster.yaml
@@ -38,126 +38,126 @@ spec:
gerrits:
# A primary Gerrit
- metadata:
- name: gerrit
- labels:
- app: gerrit
+ name: gerrit
+ labels:
+ app: gerrit
spec:
- mode: PRIMARY
- serviceAccount: gerrit
- replicas: 2
- resources:
- requests:
- cpu: 1
- memory: 5Gi
- limits:
- cpu: 1
- memory: 6Gi
- service:
- type: NodePort
- httpPort: 80
- sshPort: 29418
- site:
- size: 1Gi
- startupProbe:
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 10
- successThreshold: 1
- failureThreshold: 10
- readinessProbe:
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 10
- successThreshold: 1
- failureThreshold: 10
- livenessProbe:
- initialDelaySeconds: 120
- periodSeconds: 10
- timeoutSeconds: 10
- successThreshold: 1
- failureThreshold: 3
- plugins:
- # This way plugins are installed from the Gerrit-war file
- - name: download-commands
- - name: delete-project
- - name: replication
- - name: checks
- url: https://gerrit-ci.gerritforge.com/job/plugin-checks-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/checks/checks.jar
- sha1: 727c916e7c16ef0e6f2a8b4daec45589003a7906
- - name: oauth
- url: https://gerrit-ci.gerritforge.com/job/plugin-oauth-bazel-master-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/oauth/oauth.jar
- sha1: 2d516d0d0d64a117b4ef5e7b09c0d19aefc1c6be
- - name: branch-network
- url: https://gerrit-ci.gerritforge.com/job/plugin-branch-network-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/branch-network/branch-network.jar
- sha1: 8238b877c1233708b8b64293dbf3e978e61e2d32
- - name: checks-jenkins
- url: https://gerrit-ci.gerritforge.com/job/plugin-checks-jenkins-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/checks-jenkins/checks-jenkins.jar
- sha1: f689cbea071af4fd2416abad482b90ea362920c7
- - name: events-log
- url: https://gerrit-ci.gerritforge.com/job/plugin-events-log-bazel-master-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/events-log/events-log.jar
- sha1: be0b61eaf61b8529b248e829db89b7a732d05afd
- #- name: replication-status
- # url: https://gerrit-ci.gerritforge.com/job/plugin-replication-status-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/replication-status/replication-status.jar
- # sha1: 5eb04d2238ce7d130d8b9cf0cd79f14e68e7ddfd
- configFiles:
- checks-jenkins.config: |-
- [jenkins "main-jenkins"]
- url = "https://jenkins.midnightthoughts.space"
- # Some configuration options are specific to the k8sgerrit setup. These
- # will be set by the Gerrit Operator.
- gerrit.config: ENC[AES256_GCM,data:/aXn80PMx2idk3GilYPYDjwMsTSDq84BzZVjrW0WZk/kP4RlrCZ6gEl6bN2n8N6g4E8iPL9Xu6U7utcXdaqu+lreSH7NZkhsQh8C/uPOgS3KHw0d7MNzU5MpVyF3y86qtJD7TXiPXCl/IFv0e9vCjTl9+5q4e14Y07h3c1YvLhi7BXK37IIniplIdADfHLKodEQgJWvkY2fye2EQEqlkSAnCJWk6mZUDS6jE4OzqOqIFsXVx6NIQzQAeXO5kB3BMg5cvFCw+Hp/bFUBvR6eGJddZrIHR+/LpFUcyP+Wi/bau/U8vN5BC5udvbL5GLebUSZazRkkJEZLoefByAcWSK0zd6IqeXw3q7VHPu0w0OgDs1VCqn2bSlH+6mCaFfq+WsTf91thUi/4PMCSiiMRZgeaSD5m7McbeLwH4XtzIZh0xHJDtFW0LUjLGlBirAncaySN4A5VG557MOq6NHj8zlEj741XmCaj0mWKqeZ2zS97B4yG8X50tQSkMwbDTbY+UY9dqdE2ON4D0v3lfNmLvyGQEdTPEmcoFkGTPRPyrwd+Zz2x8MiyH9B2imQ3V2eCRN9qe10DU9tzjwzeM0jHJWCfbqrjNh3e3VjqCY6SIRU9GadVWQxaRuUMvci5TRABFzjwy6da4X0VxKHKYsNiLpvl+tVlp/SrCMxo4FNBpyM7pGEOTZEtz3utgf+a8uJatGoD/Se4kpsuoCZdoPH+9p6Oic2cxOIXfHiSmFAhXfeNJG/PaTtO7YxLBOHJ7Z8SHGq/WT4Y4uEhjt3foaUy+qCGVHm6dYbtFJS7RH9/6ReAW1d2gJhPzYuOI5lUJgKDGIgpFYbrEEyosXUyavDE+G4p41GbvwdyBhbXITkNJwBJe570ZIa87/NkqWiayOJjZP5er2p/xx+8R5O2QiXZrNx+LdxeosG4fYtBk5MpibY+zAb46FptGFBRHsSjcSKEA5meonDhBFWAynuPYvNZC3+qwLVkSQuMLUUuKQWYbilrBgzL6EJdfakPqI1T63OgPusCB5ChTutom7Ok6R7VW64eYdxabE2NXN60ehBmGYmj8mCvsp0x1QBQ6tPbAMc5yAsCDBx742aVaEhVmA631TjJa3RR99jPTCktwyuFlFc8eJWpw3jrKYKNbHjaOSJIny/j/MBYGtMpZY/0mksZBW6YbjiZderrlfXQHx7Le0iBll9HwxSGi96PPjqEXuc0J4VpdLk09OFux45Md58DiX6LioheF0HDGkff1ttEHhR8bC5tnKsurWvuV89wl9LGzoOchsJmWQYlfYiHfAHv4QEnBTnPPl8T+Enud/LT1EvxazskP3jZdDLv+lASzw8jLUQwejqe1TqwDG/QUIvqcRnGJJ8zqIEkcadaE+OgmDZgcTD+JzWOV5ciOk0n+LzdBRs0UNfP2Svvhzr5a73YEncPrrVQoxUfMpvJRW9PHtNI8PJCBDwMV+zHyhC5wBEV9rjt6mCN2LVGamcHDvNQB3BANjvBoxhll2g/U4l5jhl4Da8DgigPE0AkMsf/t2hTIM9P/nTr45jMOxgUR9xR5psuf5qSiiai4ULITwQ4MH3H4dVD5IB26E4t8ZYDNnzoJGjnPSDE9CQHN1qWnf3+GeLyXUMk7xXoDK8w+wdofci5Ae+rw3plVh8qFvaek,iv:QXDR0f5R5qdIrs27dRSJPc0ufd7aKTyKHwR5wa2ftEM=,tag:CdUtfP39GX/wboOxQSOowQ==,type:str]
- # Reference by name to the Secret containing secret files to be mounted to
- # $SITE/etc
- secretRef: gerrit-secure-config
+ mode: PRIMARY
+ serviceAccount: gerrit
+ replicas: 2
+ resources:
+ requests:
+ cpu: 1
+ memory: 5Gi
+ limits:
+ cpu: 1
+ memory: 6Gi
+ service:
+ type: NodePort
+ httpPort: 80
+ sshPort: 29418
+ site:
+ size: 1Gi
+ startupProbe:
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 10
+ successThreshold: 1
+ failureThreshold: 10
+ readinessProbe:
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 10
+ successThreshold: 1
+ failureThreshold: 10
+ livenessProbe:
+ initialDelaySeconds: 120
+ periodSeconds: 10
+ timeoutSeconds: 10
+ successThreshold: 1
+ failureThreshold: 3
+ plugins:
+ # This way plugins are installed from the Gerrit-war file
+ - name: download-commands
+ - name: delete-project
+ - name: replication
+ - name: checks
+ url: https://gerrit-ci.gerritforge.com/job/plugin-checks-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/checks/checks.jar
+ sha1: 727c916e7c16ef0e6f2a8b4daec45589003a7906
+ - name: oauth
+ url: https://gerrit-ci.gerritforge.com/job/plugin-oauth-bazel-master-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/oauth/oauth.jar
+ sha1: 2d516d0d0d64a117b4ef5e7b09c0d19aefc1c6be
+ - name: branch-network
+ url: https://gerrit-ci.gerritforge.com/job/plugin-branch-network-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/branch-network/branch-network.jar
+ sha1: 8238b877c1233708b8b64293dbf3e978e61e2d32
+ - name: checks-jenkins
+ url: https://gerrit-ci.gerritforge.com/job/plugin-checks-jenkins-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/checks-jenkins/checks-jenkins.jar
+ sha1: f689cbea071af4fd2416abad482b90ea362920c7
+ - name: events-log
+ url: https://gerrit-ci.gerritforge.com/job/plugin-events-log-bazel-master-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/events-log/events-log.jar
+ sha1: be0b61eaf61b8529b248e829db89b7a732d05afd
+ #- name: replication-status
+ # url: https://gerrit-ci.gerritforge.com/job/plugin-replication-status-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/replication-status/replication-status.jar
+ # sha1: 5eb04d2238ce7d130d8b9cf0cd79f14e68e7ddfd
+ configFiles:
+ checks-jenkins.config: |-
+ [jenkins "main-jenkins"]
+ url = "https://jenkins.midnightthoughts.space"
+ # Some configuration options are specific to the k8sgerrit setup. These
+ # will be set by the Gerrit Operator.
+ gerrit.config: ENC[AES256_GCM,data:/aXn80PMx2idk3GilYPYDjwMsTSDq84BzZVjrW0WZk/kP4RlrCZ6gEl6bN2n8N6g4E8iPL9Xu6U7utcXdaqu+lreSH7NZkhsQh8C/uPOgS3KHw0d7MNzU5MpVyF3y86qtJD7TXiPXCl/IFv0e9vCjTl9+5q4e14Y07h3c1YvLhi7BXK37IIniplIdADfHLKodEQgJWvkY2fye2EQEqlkSAnCJWk6mZUDS6jE4OzqOqIFsXVx6NIQzQAeXO5kB3BMg5cvFCw+Hp/bFUBvR6eGJddZrIHR+/LpFUcyP+Wi/bau/U8vN5BC5udvbL5GLebUSZazRkkJEZLoefByAcWSK0zd6IqeXw3q7VHPu0w0OgDs1VCqn2bSlH+6mCaFfq+WsTf91thUi/4PMCSiiMRZgeaSD5m7McbeLwH4XtzIZh0xHJDtFW0LUjLGlBirAncaySN4A5VG557MOq6NHj8zlEj741XmCaj0mWKqeZ2zS97B4yG8X50tQSkMwbDTbY+UY9dqdE2ON4D0v3lfNmLvyGQEdTPEmcoFkGTPRPyrwd+Zz2x8MiyH9B2imQ3V2eCRN9qe10DU9tzjwzeM0jHJWCfbqrjNh3e3VjqCY6SIRU9GadVWQxaRuUMvci5TRABFzjwy6da4X0VxKHKYsNiLpvl+tVlp/SrCMxo4FNBpyM7pGEOTZEtz3utgf+a8uJatGoD/Se4kpsuoCZdoPH+9p6Oic2cxOIXfHiSmFAhXfeNJG/PaTtO7YxLBOHJ7Z8SHGq/WT4Y4uEhjt3foaUy+qCGVHm6dYbtFJS7RH9/6ReAW1d2gJhPzYuOI5lUJgKDGIgpFYbrEEyosXUyavDE+G4p41GbvwdyBhbXITkNJwBJe570ZIa87/NkqWiayOJjZP5er2p/xx+8R5O2QiXZrNx+LdxeosG4fYtBk5MpibY+zAb46FptGFBRHsSjcSKEA5meonDhBFWAynuPYvNZC3+qwLVkSQuMLUUuKQWYbilrBgzL6EJdfakPqI1T63OgPusCB5ChTutom7Ok6R7VW64eYdxabE2NXN60ehBmGYmj8mCvsp0x1QBQ6tPbAMc5yAsCDBx742aVaEhVmA631TjJa3RR99jPTCktwyuFlFc8eJWpw3jrKYKNbHjaOSJIny/j/MBYGtMpZY/0mksZBW6YbjiZderrlfXQHx7Le0iBll9HwxSGi96PPjqEXuc0J4VpdLk09OFux45Md58DiX6LioheF0HDGkff1ttEHhR8bC5tnKsurWvuV89wl9LGzoOchsJmWQYlfYiHfAHv4QEnBTnPPl8T+Enud/LT1EvxazskP3jZdDLv+lASzw8jLUQwejqe1TqwDG/QUIvqcRnGJJ8zqIEkcadaE+OgmDZgcTD+JzWOV5ciOk0n+LzdBRs0UNfP2Svvhzr5a73YEncPrrVQoxUfMpvJRW9PHtNI8PJCBDwMV+zHyhC5wBEV9rjt6mCN2LVGamcHDvNQB3BANjvBoxhll2g/U4l5jhl4Da8DgigPE0AkMsf/t2hTIM9P/nTr45jMOxgUR9xR5psuf5qSiiai4ULITwQ4MH3H4dVD5IB26E4t8ZYDNnzoJGjnPSDE9CQHN1qWnf3+GeLyXUMk7xXoDK8w+wdofci5Ae+rw3plVh8qFvaek,iv:QXDR0f5R5qdIrs27dRSJPc0ufd7aKTyKHwR5wa2ftEM=,tag:CdUtfP39GX/wboOxQSOowQ==,type:str]
+ # Reference by name to the Secret containing secret files to be mounted to
+ # $SITE/etc
+ secretRef: gerrit-secure-config
# Gerrit Replica
- metadata:
- name: gerrit-replica
- labels:
- app: gerrit-replica
+ name: gerrit-replica
+ labels:
+ app: gerrit-replica
spec:
- mode: REPLICA
- replicas: 2
- resources:
- requests:
- cpu: 1
- memory: 5Gi
- limits:
- cpu: 1
- memory: 6Gi
- service:
- type: NodePort
- httpPort: 80
- sshPort: 29418
- site:
- size: 1Gi
- plugins:
- - name: oauth
- url: https://gerrit-ci.gerritforge.com/job/plugin-oauth-bazel-master-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/oauth/oauth.jar
- sha1: 2d516d0d0d64a117b4ef5e7b09c0d19aefc1c6be
- startupProbe:
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 10
- successThreshold: 1
- failureThreshold: 10
- readinessProbe:
- initialDelaySeconds: 30
- periodSeconds: 10
- timeoutSeconds: 10
- successThreshold: 1
- failureThreshold: 10
- livenessProbe:
- initialDelaySeconds: 120
- periodSeconds: 10
- timeoutSeconds: 10
- successThreshold: 1
- failureThreshold: 3
- configFiles:
- gerrit.config: ENC[AES256_GCM,data:ONWBaGukHdMcTz50F1R5MjIWWHg1Omqfaae5PvPAxCBRaODGRVdj9WzMR74kZchbAVn7GrnZ+QCrjE2sq2JpCdSbdd6GV4quubtYYK8Ot2EDiJwZvSLVSgXXECYLOAgOcKhPhxopvyhilAWJ7w06TVZ08p6AwqF5w7F8sO+b2FJsq7jJfl12b0xcgFmOCbyRe9e4kidParaw232tne8m6QmBl7pMStXJ6JHtaek8NUymn6b9htad7aJW9IdDdx5j+35oPDIbHla/4lIZ9fAJQlxsSKcXhp22nUXBpfwn0cuiq+38u+HAMIo/bmPSJ2eWdfDyl84VeucrlYNZdVJRv6JRsU6cQ2+fTfjAgeLCOdDXT58nCZFEcH5xWboNkqSfYRA8Oql9xOuOLgSxZQ75jJrFZZzwU9KSD5XwuaD4R6F1Ts3jW2AuqrVM5s7vAJqpi81GzS9ql/cHl7ySoAACGcbXJcPfRR/Kwm/4GimB+ewCOZNxhqSivdbaxMEfe/oRgoIrS9iTobHWQKKWUDzWbQT9B6Bocnud1YnwdytcfWJ5VPVj008f07uSb5R1XuYAtHAhjO28Knv/yFWt6qq41Gz6gOsTVEk5Sbk8WLZbmYbM4uNGZQqxIx6Oq7GbrYNlPN2gEuWnnnbiDroZjYMa1kxHwFd2FmxjjfXZTd8TLKb8vbOFbUPNkZK0FpzDI7qwCFQxOZ3F9iIuJPv47nKG0jQ/36/R7ec/1zC/RMTBQZBsyRZeglrUorMSlNDmvSpzbekkWDXQl2Y2WkUIbJ+AVCdrhGRJtunIx67kkaTismOxEAXCHa2mO3BGnflj2cP3rTcGAB97b5FsDHqEoph3gSMDwDFDNLPjECKGCgvq3Zdg6SDT6XXE0fLeL8Ap3DACE8Cz8mI3UUQbftgdZK4P6S5YvjBMCPRcmrozdPPiwjhjvdKEyq1w/m1DI4pdzWXMkCCaBsnsW059aDPP3y+0Uw/25bHu73HD7mQu1VdaEQTx7pjy2VHCb1cTw2maOy6vErARiA0T0dCaL1c+Ww54H2SI0Y6zQvG6Ms6A2Cqn3PwBZOPiz6BOy82yAH8CnQj36PSXMuYfmPB3JJDxyE5LURvs9p6XfEsS+oZtiE1Iu7QjPHUGgwhqOlxheI+C9ne92r7XbdxAJH58IT7BZPiJlLVjtyP89qm4BN5XBktTbmchRBxsNmgzHLC0bgRlLkC8kJKkWeEsmB4DYWj6im0P4Q0uKobB6VyAk5ZCggl6X8IqfGjL0qWylxA2rfXdRWvlVZO+mNUzABJq10T2dkjxgP6wmfnQE4ZpQeq2aF43B/0DyYFVmw+v0Z7Gwa58ZK1BtUWDDRtQwREAwB/2/VBza1MP6J6CI0xJjxhzmWhuZQMJshidCl9KMkZCYhVvCv/tzL/QDeMcrvwgYZui7wIjDhKhk8g20qOUjKyGF1OPGbY3So3WGthCUMOBV0exHB22QM1qEhsPHc/lRKYW7j34C86r4sE3eXTj36QqCz2K7yRubuNbsYFMCXPCDFyTRRKB8sIAfT+Cif6esdmj08Wu/hvTJusaagTzo8odalav04xrKfprhFMs1TVlgzZ6cTAcoejvAGTWHe1YId5aTx7E6XOAbeCyIcKASsR4v+Lh0gDPWDejNLLUcVW7kqu3,iv:1PLzFCQ8LpS0IR7e3aesXvl/IvOExkvuhM7SxlB3lcg=,tag:+fLag80GzG/akf4Fo8U3TQ==,type:str]
- healthcheck.config: |-
- [healthcheck "auth"]
- enabled = false
- secretRef: gerrit-secure-config
+ mode: REPLICA
+ replicas: 2
+ resources:
+ requests:
+ cpu: 1
+ memory: 5Gi
+ limits:
+ cpu: 1
+ memory: 6Gi
+ service:
+ type: NodePort
+ httpPort: 80
+ sshPort: 29418
+ site:
+ size: 1Gi
+ plugins:
+ - name: oauth
+ url: https://gerrit-ci.gerritforge.com/job/plugin-oauth-bazel-master-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/oauth/oauth.jar
+ sha1: 2d516d0d0d64a117b4ef5e7b09c0d19aefc1c6be
+ startupProbe:
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 10
+ successThreshold: 1
+ failureThreshold: 10
+ readinessProbe:
+ initialDelaySeconds: 30
+ periodSeconds: 10
+ timeoutSeconds: 10
+ successThreshold: 1
+ failureThreshold: 10
+ livenessProbe:
+ initialDelaySeconds: 120
+ periodSeconds: 10
+ timeoutSeconds: 10
+ successThreshold: 1
+ failureThreshold: 3
+ configFiles:
+ gerrit.config: ENC[AES256_GCM,data:ONWBaGukHdMcTz50F1R5MjIWWHg1Omqfaae5PvPAxCBRaODGRVdj9WzMR74kZchbAVn7GrnZ+QCrjE2sq2JpCdSbdd6GV4quubtYYK8Ot2EDiJwZvSLVSgXXECYLOAgOcKhPhxopvyhilAWJ7w06TVZ08p6AwqF5w7F8sO+b2FJsq7jJfl12b0xcgFmOCbyRe9e4kidParaw232tne8m6QmBl7pMStXJ6JHtaek8NUymn6b9htad7aJW9IdDdx5j+35oPDIbHla/4lIZ9fAJQlxsSKcXhp22nUXBpfwn0cuiq+38u+HAMIo/bmPSJ2eWdfDyl84VeucrlYNZdVJRv6JRsU6cQ2+fTfjAgeLCOdDXT58nCZFEcH5xWboNkqSfYRA8Oql9xOuOLgSxZQ75jJrFZZzwU9KSD5XwuaD4R6F1Ts3jW2AuqrVM5s7vAJqpi81GzS9ql/cHl7ySoAACGcbXJcPfRR/Kwm/4GimB+ewCOZNxhqSivdbaxMEfe/oRgoIrS9iTobHWQKKWUDzWbQT9B6Bocnud1YnwdytcfWJ5VPVj008f07uSb5R1XuYAtHAhjO28Knv/yFWt6qq41Gz6gOsTVEk5Sbk8WLZbmYbM4uNGZQqxIx6Oq7GbrYNlPN2gEuWnnnbiDroZjYMa1kxHwFd2FmxjjfXZTd8TLKb8vbOFbUPNkZK0FpzDI7qwCFQxOZ3F9iIuJPv47nKG0jQ/36/R7ec/1zC/RMTBQZBsyRZeglrUorMSlNDmvSpzbekkWDXQl2Y2WkUIbJ+AVCdrhGRJtunIx67kkaTismOxEAXCHa2mO3BGnflj2cP3rTcGAB97b5FsDHqEoph3gSMDwDFDNLPjECKGCgvq3Zdg6SDT6XXE0fLeL8Ap3DACE8Cz8mI3UUQbftgdZK4P6S5YvjBMCPRcmrozdPPiwjhjvdKEyq1w/m1DI4pdzWXMkCCaBsnsW059aDPP3y+0Uw/25bHu73HD7mQu1VdaEQTx7pjy2VHCb1cTw2maOy6vErARiA0T0dCaL1c+Ww54H2SI0Y6zQvG6Ms6A2Cqn3PwBZOPiz6BOy82yAH8CnQj36PSXMuYfmPB3JJDxyE5LURvs9p6XfEsS+oZtiE1Iu7QjPHUGgwhqOlxheI+C9ne92r7XbdxAJH58IT7BZPiJlLVjtyP89qm4BN5XBktTbmchRBxsNmgzHLC0bgRlLkC8kJKkWeEsmB4DYWj6im0P4Q0uKobB6VyAk5ZCggl6X8IqfGjL0qWylxA2rfXdRWvlVZO+mNUzABJq10T2dkjxgP6wmfnQE4ZpQeq2aF43B/0DyYFVmw+v0Z7Gwa58ZK1BtUWDDRtQwREAwB/2/VBza1MP6J6CI0xJjxhzmWhuZQMJshidCl9KMkZCYhVvCv/tzL/QDeMcrvwgYZui7wIjDhKhk8g20qOUjKyGF1OPGbY3So3WGthCUMOBV0exHB22QM1qEhsPHc/lRKYW7j34C86r4sE3eXTj36QqCz2K7yRubuNbsYFMCXPCDFyTRRKB8sIAfT+Cif6esdmj08Wu/hvTJusaagTzo8odalav04xrKfprhFMs1TVlgzZ6cTAcoejvAGTWHe1YId5aTx7E6XOAbeCyIcKASsR4v+Lh0gDPWDejNLLUcVW7kqu3,iv:1PLzFCQ8LpS0IR7e3aesXvl/IvOExkvuhM7SxlB3lcg=,tag:+fLag80GzG/akf4Fo8U3TQ==,type:str]
+ healthcheck.config: |-
+ [healthcheck "auth"]
+ enabled = false
+ secretRef: gerrit-secure-config
sops:
kms: []
gcp_kms: []
@@ -166,13 +166,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvelB4eDFRWHRKOExTbWMy
- eG8zdXpiMVU4UDB4OHROeXpTNXhWdEpVUFV3CkFMTURNNm9vdEZZS2MzSURFSit3
- b29iRHRYd2NnVU05cDdsajcwNmFqTFkKLS0tIE9CalFEWkcwSHRpNm1sVUhEVFhM
- QjU5alNnRUE4aTNXRkRTd3lNbW52bTgKekBBurjQx7iKWOhWDV+TYUH+L5tjSM7r
- KcakagouQFRGd3Ymchl3yOY8O3OBN5gd1wCGwUYruphgfG5/sDm7Cw==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvelB4eDFRWHRKOExTbWMy
+ eG8zdXpiMVU4UDB4OHROeXpTNXhWdEpVUFV3CkFMTURNNm9vdEZZS2MzSURFSit3
+ b29iRHRYd2NnVU05cDdsajcwNmFqTFkKLS0tIE9CalFEWkcwSHRpNm1sVUhEVFhM
+ QjU5alNnRUE4aTNXRkRTd3lNbW52bTgKekBBurjQx7iKWOhWDV+TYUH+L5tjSM7r
+ KcakagouQFRGd3Ymchl3yOY8O3OBN5gd1wCGwUYruphgfG5/sDm7Cw==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-12-22T02:54:18Z"
mac: ENC[AES256_GCM,data:mXJxz/vHrQQYkuanhK89xF40WpMGhoPdLaXJVZxEXnH8cch/IIPF9M2ZDKaWL5MbMuUOYgLmfHR5h838tNlS5lzhPfoLbjf13+VoaGfs3qKVEITrgJrJmXLIWm1KufW9r21lfbAgJgJCVfIynTc5wp1eI4lOB28fbwlfEeK0YAA=,iv:O7yc3i5VrhBbAKJKDvear2l8ZmmBpmODg5Ua+BYYEXg=,tag:bXT+G1RCi3mmNBpjRbs4YA==,type:str]
pgp: []
diff --git a/apps/base/irc/files/ircd.motd b/apps/base/irc/files/ircd.motd
@@ -0,0 +1,14 @@
+ _ _ __
+ _| || |_ | | Welcome to #!. This network has three rules:
+|_ __ _|| |
+ _| || |_ | | 1. When people need help, teach. Don't do it for them
+|_ __ _||__| 2. Don't use our resources for closed source projects
+ |_||_| (__) 3. Be excellent to each other
+
+-----------------------------------------------------------------------------
+ Server: irc.midnightthoughts.space - Port: 6697 - SSL: Required
+-----------------------------------------------------------------------------
+
+Please register your nick: /msg nickserv register somepassword some@email.com
+
+-----------------------------------------------------------------------------
diff --git a/apps/base/irc/files/ircd.yaml b/apps/base/irc/files/ircd.yaml
@@ -0,0 +1,648 @@
+# ergo IRCd config
+
+# network configuration
+network:
+ # name of the network
+ name: midnightthoughts.space
+# server configuration
+server:
+ # server name
+ name: irc.midnightthoughts.space
+ # addresses to listen on
+ listeners:
+ # The standard plaintext port for IRC is 6667. This will listen on all interfaces:
+ ":6667":
+ sts-only: true
+ # Allowing plaintext over the public Internet poses security and privacy issues,
+ # so if possible, we recommend that you comment out the above line and replace
+ # it with these two, which listen only on local interfaces:
+ #"127.0.0.1:6667": # (loopback ipv4, localhost-only)
+ #"[::1]:6667": # (loopback ipv6, localhost-only)
+ # Alternately, if you have a TLS certificate issued by a recognized CA,
+ # you can configure port 6667 as an STS-only listener that only serves
+ # "redirects" to the TLS port, but doesn't allow chat. See the manual
+ # for details.
+
+ # The standard SSL/TLS port for IRC is 6697. This will listen on all interfaces:
+ ":6697":
+ proxy: true
+ # No tls here as we have a reverse proxy
+
+ # Add another SSL/TLS port for internal traffic on port 16697.
+ ":16697":
+ tls:
+ key: /ircd/tls/tls.key
+ cert: /ircd/tls/tls.crt
+ proxy: true
+ # 'proxy' is false here because internal traffic won't be routed through
+ # the Kubernetes LoadBalancer. Relevant links:
+ # https://github.com/kubernetes/kubernetes/issues/66607
+ # https://github.com/kubernetes/kubernetes/pull/92312
+ # Native websockets over TLS:
+ ":443":
+ websocket: true
+ proxy: true
+ # No tls here as we have a reverse proxy
+ # Example of a Unix domain socket for proxying:
+ # "/tmp/ergo_sock":
+ # Example of a Tor listener: any connection that comes in on this listener will
+ # be considered a Tor connection. It is strongly recommended that this listener
+ # *not* be on a public interface --- it should be on 127.0.0.0/8 or unix domain:
+ # "/hidden_service_sockets/ergo_tor_sock":
+ # tor: true
+
+ # sets the permissions for Unix listen sockets. on a typical Linux system,
+ # the default is 0775 or 0755, which prevents other users/groups from connecting
+ # to the socket. With 0777, it behaves like a normal TCP socket
+ # where anyone can connect.
+ unix-bind-mode: 0777
+ # configure the behavior of Tor listeners (ignored if you didn't enable any):
+ tor-listeners:
+ # if this is true, connections from Tor must authenticate with SASL
+ require-sasl: false
+ # what hostname should be displayed for Tor connections?
+ vhost: "tor-network.onion"
+ # allow at most this many connections at once (0 for no limit):
+ max-connections: 64
+ # connection throttling (limit how many connection attempts are allowed at once):
+ throttle-duration: 10m
+ # set to 0 to disable throttling:
+ max-connections-per-duration: 64
+ # strict transport security, to get clients to automagically use TLS
+ sts:
+ # whether to advertise STS
+ #
+ # to stop advertising STS, leave this enabled and set 'duration' below to "0". this will
+ # advertise to connecting users that the STS policy they have saved is no longer valid
+ enabled: true
+ # how long clients should be forced to use TLS for.
+ # setting this to a too-long time will mean bad things if you later remove your TLS.
+ # the default duration below is 1 month, 2 days and 5 minutes.
+ duration: 1mo2d5m
+ # tls port - you should be listening on this port above
+ port: 6697
+ # should clients include this STS policy when they ship their inbuilt preload lists?
+ preload: true
+ websockets:
+ # Restrict the origin of WebSocket connections by matching the "Origin" HTTP
+ # header. This setting makes ergo reject every WebSocket connection,
+ # except when it originates from one of the hosts in this list. Use this to
+ # prevent malicious websites from making their visitors connect to ergo
+ # without their knowledge. An empty list means that there are no restrictions.
+ allowed-origins:
+ - "https://midnightthoughts.space"
+ - "https://*.midnightthoughts.space"
+ # casemapping controls what kinds of strings are permitted as identifiers (nicknames,
+ # channel names, account names, etc.), and how they are normalized for case.
+ # with the recommended default of 'precis', utf-8 identifiers that are "sane"
+ # (according to RFC 8265) are allowed, and the server additionally tries to protect
+ # against confusable characters ("homoglyph attacks").
+ # the other options are 'ascii' (traditional ASCII-only identifiers), and 'permissive',
+ # which allows identifiers to contain unusual characters like emoji, but makes users
+ # vulnerable to homoglyph attacks. unless you're really confident in your decision,
+ # we recommend leaving this value at its default (changing it once the network is
+ # already up and running is problematic).
+ casemapping: "precis"
+ # enforce-utf8 controls whether the server allows non-UTF8 bytes in messages
+ # (as in traditional IRC) or preemptively discards non-UTF8 messages (since
+ # they cannot be relayed to websocket clients).
+ enforce-utf8: true
+ # whether to look up user hostnames with reverse DNS
+ # (to suppress this for privacy purposes, use the ip-cloaking options below)
+ lookup-hostnames: false
+ # whether to confirm hostname lookups using "forward-confirmed reverse DNS", i.e., for
+ # any hostname returned from reverse DNS, resolve it back to an IP address and reject it
+ # unless it matches the connecting IP
+ forward-confirm-hostnames: true
+ # use ident protocol to get usernames
+ check-ident: false
+ # ignore the supplied user/ident string from the USER command; always set the value to
+ # `~user` (literally) instead. this can potentially reduce confusion and simplify bans.
+ coerce-ident: "~u"
+ # password to login to the server
+ # generated using "ergo genpasswd"
+ #password: ""
+
+ # motd filename
+ # if you change the motd, you should move it to ircd.motd
+ motd: ircd.motd
+ # motd formatting codes
+ # if this is true, the motd is escaped using formatting codes like $c, $b, and $i
+ motd-formatting: true
+ # relaying using the RELAYMSG command
+ relaymsg:
+ # is relaymsg enabled at all?
+ enabled: true
+ # which character(s) are reserved for relayed nicks?
+ separators: "/"
+ # can channel operators use RELAYMSG in their channels?
+ # our implementation of RELAYMSG makes it safe for chanops to use without the
+ # possibility of real users being silently spoofed
+ available-to-chanops: true
+ # addresses/CIDRs the PROXY command can be used from
+ # this should be restricted to 127.0.0.1/8 and ::1/128 (unless you have a good reason)
+ # you should also add these addresses to the connection limits and throttling exemption lists
+ proxy-allowed-from:
+ - 0.0.0.0/0
+ # controls the use of the WEBIRC command (by IRC<->web interfaces, bouncers and similar)
+ # webirc:
+ # # one webirc block -- should correspond to one set of gateways
+ # -
+ # # SHA-256 fingerprint of the TLS certificate the gateway must use to connect
+ # # (comment this out to use passwords only)
+ # fingerprint: "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789"
+
+ # # password the gateway uses to connect, made with ergo genpasswd
+ # password: "$2a$04$sLEFDpIOyUp55e6gTMKbOeroT6tMXTjPFvA0eGvwvImVR9pkwv7ee"
+
+ # # addresses/CIDRs that can use this webirc command
+ # # you should also add these addresses to the connection limits and throttling exemption lists
+ # hosts:
+ # # - localhost
+ # # - "192.168.1.1"
+ # # - "192.168.10.1/24"
+
+ # allow use of the RESUME extension over plaintext connections:
+ # do not enable this unless the ircd is only accessible over internal networks
+ allow-plaintext-resume: false
+ # maximum length of clients' sendQ in bytes
+ # this should be big enough to hold bursts of channel/direct messages
+ max-sendq: 96k
+ # compatibility with legacy clients
+ compatibility:
+ # many clients require that the final parameter of certain messages be an
+ # RFC1459 trailing parameter, i.e., prefixed with :, whether or not this is
+ # actually required. this forces Oragono to send those parameters
+ # as trailings. this is recommended unless you're testing clients for conformance;
+ # defaults to true when unset for that reason.
+ force-trailing: true
+ # some clients (ZNC 1.6.x and lower, Pidgin 2.12 and lower) do not
+ # respond correctly to SASL messages with the server name as a prefix:
+ # https://github.com/znc/znc/issues/1212
+ # this works around that bug, allowing them to use SASL.
+ send-unprefixed-sasl: true
+ # IP-based DoS protection
+ ip-limits:
+ # whether to limit the total number of concurrent connections per IP/CIDR
+ count: true
+ # maximum concurrent connections per IP/CIDR
+ max-concurrent-connections: 64
+ # whether to restrict the rate of new connections per IP/CIDR
+ throttle: true
+ # how long to keep track of connections for
+ window: 10m
+ # maximum number of new connections per IP/CIDR within the given duration
+ max-connections-per-window: 64
+ # how long to ban offenders for. after banning them, the number of connections is
+ # reset, which lets you use /UNDLINE to unban people
+ throttle-ban-duration: 10m
+ # how wide the CIDR should be for IPv4 (a /32 is a fully specified IPv4 address)
+ cidr-len-ipv4: 32
+ # how wide the CIDR should be for IPv6 (a /64 is the typical prefix assigned
+ # by an ISP to an individual customer for their LAN)
+ cidr-len-ipv6: 64
+ # IPs/networks which are exempted from connection limits
+ exempted:
+ - "localhost"
+ - "10.0.0.0/8"
+ # custom connection limits for certain IPs/networks. note that CIDR
+ # widths defined here override the default CIDR width --- the limit
+ # will apply to the entire CIDR no matter how large or small it is
+ custom-limits:
+ # "8.8.0.0/16":
+ # max-concurrent-connections: 128
+ # max-connections-per-window: 1024
+ # IP cloaking hides users' IP addresses from other users and from channel admins
+ # (but not from server admins), while still allowing channel admins to ban
+ # offending IP addresses or networks. In place of hostnames derived from reverse
+ # DNS, users see fake domain names like pwbs2ui4377257x8.irc. These names are
+ # generated deterministically from the underlying IP address, but if the underlying
+ # IP is not already known, it is infeasible to recover it from the cloaked name.
+ ip-cloaking:
+ # whether to enable IP cloaking
+ enabled: true
+ enabled-for-always-on: true
+ # fake TLD at the end of the hostname, e.g., pwbs2ui4377257x8.irc
+ netname: "irc"
+ # the cloaked hostname is derived only from the CIDR (most significant bits
+ # of the IP address), up to a configurable number of bits. this is the
+ # granularity at which bans will take effect for IPv4. Note that changing
+ # this value will invalidate any stored bans.
+ cidr-len-ipv4: 32
+ # analogous granularity for IPv6
+ cidr-len-ipv6: 64
+ # number of bits of hash output to include in the cloaked hostname.
+ # more bits means less likelihood of distinct IPs colliding,
+ # at the cost of a longer cloaked hostname. if this value is set to 0,
+ # all users will receive simply `netname` as their cloaked hostname.
+ num-bits: 64
+# account options
+accounts:
+ # is account authentication enabled, i.e., can users log into existing accounts?
+ authentication-enabled: true
+ # account registration
+ registration:
+ # can users register new accounts for themselves? if this is false, operators with
+ # the `accreg` capability can still create accounts with `/NICKSERV SAREGISTER`
+ enabled: true
+ # can users use the REGISTER command to register before fully connecting?
+ allow-before-connect: true
+ # this is the bcrypt cost we'll use for account passwords
+ bcrypt-cost: 9
+ # length of time a user has to verify their account before it can be re-registered
+ verify-timeout: "32h"
+ # callbacks to allow
+ enabled-callbacks:
+ - none # no verification needed, will instantly register successfully
+ # example configuration for sending verification emails via a local mail relay
+ # callbacks:
+ # mailto:
+ # server: localhost
+ # port: 25
+ # tls:
+ # enabled: false
+ # username: ""
+ # password: ""
+ # sender: "admin@my.network"
+ # throttle account login attempts (to prevent either password guessing, or DoS
+ # attacks on the server aimed at forcing repeated expensive bcrypt computations)
+ login-throttling:
+ enabled: true
+ # window
+ duration: 1m
+ # number of attempts allowed within the window
+ max-attempts: 3
+ # some clients (notably Pidgin and Hexchat) offer only a single password field,
+ # which makes it impossible to specify a separate server password (for the PASS
+ # command) and SASL password. if this option is set to true, a client that
+ # successfully authenticates with SASL will not be required to send
+ # PASS as well, so it can be configured to authenticate with SASL only.
+ skip-server-password: false
+ # enable login to accounts via the PASS command, e.g., PASS account:password
+ # this is sometimes useful for compatibility with old clients that don't support SASL
+ login-via-pass-command: true
+ # require-sasl controls whether clients are required to have accounts
+ # (and sign into them using SASL) to connect to the server
+ require-sasl:
+ # if this is enabled, all clients must authenticate with SASL while connecting
+ enabled: false
+ # IPs/CIDRs which are exempted from the account requirement
+ exempted:
+ - "localhost"
+ # - '10.10.0.0/16'
+ # nick-reservation controls how, and whether, nicknames are linked to accounts
+ nick-reservation:
+ # is there any enforcement of reserved nicknames?
+ enabled: true
+ # how many nicknames, in addition to the account name, can be reserved?
+ additional-nick-limit: 2
+ # method describes how nickname reservation is handled
+ # timeout: let the user change to the registered nickname, give them X seconds
+ # to login and then rename them if they haven't done so
+ # strict: don't let the user change to the registered nickname unless they're
+ # already logged-in using SASL or NickServ
+ # optional: no enforcement by default, but allow users to opt in to
+ # the enforcement level of their choice
+ #
+ # 'optional' matches the behavior of other NickServs, but 'strict' is
+ # preferable if all your users can enable SASL.
+ method: strict
+ # allow users to set their own nickname enforcement status, e.g.,
+ # to opt in to strict enforcement
+ allow-custom-enforcement: false
+ # rename-timeout - this is how long users have 'til they're renamed
+ rename-timeout: 30s
+ # rename-prefix - this is the prefix to use when renaming clients (e.g. Guest-AB54U31)
+ rename-prefix: Guest-
+ # when enabled, forces users logged into an account to use the
+ # account name as their nickname. when combined with strict nickname
+ # enforcement, this lets users treat nicknames and account names
+ # as equivalent for the purpose of ban/invite/exception lists.
+ force-nick-equals-account: true
+ # bouncer controls whether ergo can act as a bouncer, i.e., allowing
+ # multiple connections to attach to the same client/nickname identity
+ multiclient:
+ # when disabled, each connection must use a separate nickname (as is the
+ # typical behavior of IRC servers). when enabled, a new connection that
+ # has authenticated with SASL can associate itself with an existing
+ # client
+ enabled: true
+ # clients can opt in to bouncer functionality using the cap system, or
+ # via nickserv. if this is enabled, then they have to opt out instead
+ allowed-by-default: true
+ # whether to allow clients that remain on the server even
+ # when they have no active connections. The possible values are:
+ # "disabled", "opt-in", "opt-out", or "mandatory".
+ always-on: "opt-in"
+ # whether to mark always-on clients away when they have no active connections:
+ auto-away: "opt-in"
+ # vhosts controls the assignment of vhosts (strings displayed in place of the user's
+ # hostname/IP) by the HostServ service
+ vhosts:
+ # are vhosts enabled at all?
+ enabled: true
+ # maximum length of a vhost
+ max-length: 64
+ # regexp for testing the validity of a vhost
+ # (make sure any changes you make here are RFC-compliant)
+ valid-regexp: '^[0-9A-Za-z.\-_/]+$'
+ # options controlling users requesting vhosts:
+ user-requests:
+ # can users request vhosts at all? if this is false, operators with the
+ # 'vhosts' capability can still assign vhosts manually
+ enabled: false
+ # if uncommented, all new vhost requests will be dumped into the given
+ # channel, so opers can review them as they are sent in. ensure that you
+ # have registered and restricted the channel appropriately before you
+ # uncomment this.
+ #channel: "#vhosts"
+
+ # after a user's vhost has been approved or rejected, they need to wait
+ # this long (starting from the time of their original request)
+ # before they can request a new one.
+ cooldown: 168h
+# channel options
+channels:
+ # modes that are set when new channels are created
+ # +n is no-external-messages and +t is op-only-topic
+ # see /QUOTE HELP cmodes for more channel modes
+ default-modes: +nt
+ # how many channels can a client be in at once?
+ max-channels-per-client: 100
+ # if this is true, new channels can only be created by operators with the
+ # `chanreg` operator capability
+ operator-only-creation: false
+ # channel registration - requires an account
+ registration:
+ # can users register new channels?
+ enabled: true
+ # how many channels can each account register?
+ max-channels-per-account: 15
+ # as a crude countermeasure against spambots, anonymous connections younger
+ # than this value will get an empty response to /LIST (a time period of 0 disables)
+ list-delay: 0s
+ # INVITE to an invite-only channel expires after this amount of time
+ # (0 or omit for no expiration):
+ invite-expiration: 24h
+# operator classes
+oper-classes:
+ # local operator
+ "local-oper":
+ # title shown in WHOIS
+ title: Local Operator
+ # capability names
+ capabilities:
+ - "kill"
+ - "ban"
+ - "nofakelag"
+ - "relaymsg"
+ # server admin
+ "server-admin":
+ # title shown in WHOIS
+ title: Server Admin
+ # oper class this extends from
+ extends: "local-oper"
+ # capability names
+ capabilities:
+ - "rehash"
+ - "die"
+ - "accreg"
+ - "sajoin"
+ - "samode"
+ - "vhosts"
+ - "chanreg"
+ - "history"
+ - "defcon"
+# ircd operators
+opers:
+ mtrnord:
+ class: "server-admin"
+ whois-line: "is a person"
+ vhost: "staff.midnightthoughts.space"
+ modes: +is acdjknoqtuxv
+ password: "$2a$04$vRolgPGXPw8qpPb/0FHvjeCl9c.9GTtux/MzDiqAmaq3imUw1B13C"
+ auto: true
+# logging, takes inspiration from Insp
+logging:
+ - # how to log these messages
+ #
+ # file log to given target filename
+ # stdout log to stdout
+ # stderr log to stderr
+ # (you can specify multiple methods, e.g., to log to both stderr and a file)
+ method: stderr
+ # filename to log to, if file method is selected
+ # filename: ircd.log
+
+ # type(s) of logs to keep here. you can use - to exclude those types
+ #
+ # exclusions take precedent over inclusions, so if you exclude a type it will NEVER
+ # be logged, even if you explicitly include it
+ #
+ # useful types include:
+ # * everything (usually used with exclusing some types below)
+ # server server startup, rehash, and shutdown events
+ # accounts account registration and authentication
+ # channels channel creation and operations
+ # commands command calling and operations
+ # opers oper actions, authentication, etc
+ # services actions related to NickServ, ChanServ, etc.
+ # internal unexpected runtime behavior, including potential bugs
+ # userinput raw lines sent by users
+ # useroutput raw lines sent to users
+ type: "server listeners connect connect-ip quit internal"
+ # one of: debug info warn error
+ level: debug
+#-
+# # example of a file log that avoids logging IP addresses
+# method: file
+# filename: ircd.log
+# type: "* -userinput -useroutput -localconnect -localconnect-ip"
+# level: debug
+
+# debug options
+debug:
+ # when enabled, ergo will attempt to recover from certain kinds of
+ # client-triggered runtime errors that would normally crash the server.
+ # this makes the server more resilient to DoS, but could result in incorrect
+ # behavior. deployments that would prefer to "start from scratch", e.g., by
+ # letting the process crash and auto-restarting it with systemd, can set
+ # this to false.
+ recover-from-errors: true
+ # optionally expose a pprof http endpoint: https://golang.org/pkg/net/http/pprof/
+ # it is strongly recommended that you don't expose this on a public interface;
+ # if you need to access it remotely, you can use an SSH tunnel.
+ # set to `null`, "", leave blank, or omit to disable
+ # pprof-listener: "localhost:6060"
+# datastore configuration
+datastore:
+ # path to the datastore
+ path: /ircd/db/ircd.db
+ # if the database schema requires an upgrade, `autoupgrade` will attempt to
+ # perform it automatically on startup. the database will be backed
+ # up, and if the upgrade fails, the original database will be restored.
+ autoupgrade: true
+ # connection information for MySQL (currently only used for persistent history):
+ mysql:
+ enabled: true
+ host: "mariadb-maxscale.mariadb-operator.svc.cluster.local"
+ port: 3306
+ user: "irc"
+ history-database: "irc"
+ timeout: 3s
+ max-conns: 4
+ # this may be necessary to prevent middleware from closing your connections:
+ #conn-max-lifetime: 180s
+# languages config
+languages:
+ # whether to load languages
+ enabled: false
+ # default language to use for new clients
+ # 'en' is the default English language in the code
+ default: en
+ # which directory contains our language files
+ path: languages
+# limits - these need to be the same across the network
+limits:
+ # nicklen is the max nick length allowed
+ nicklen: 32
+ # identlen is the max ident length allowed
+ identlen: 20
+ # channellen is the max channel length allowed
+ channellen: 64
+ # awaylen is the maximum length of an away message
+ awaylen: 500
+ # kicklen is the maximum length of a kick message
+ kicklen: 1000
+ # topiclen is the maximum length of a channel topic
+ topiclen: 1000
+ # maximum number of monitor entries a client can have
+ monitor-entries: 100
+ # whowas entries to store
+ whowas-entries: 100
+ # maximum length of channel lists (beI modes)
+ chan-list-modes: 60
+ # maximum length of IRC lines
+ # this should generally be 1024-2048, and will only apply when negotiated by clients
+ linelen:
+ # ratified version of the message-tags cap fixes the max tag length at 8191 bytes
+ # configurable length for the rest of the message:
+ rest: 2048
+ # maximum number of messages to accept during registration (prevents
+ # DoS / resource exhaustion attacks):
+ registration-messages: 1024
+ # message length limits for the new multiline cap
+ multiline:
+ max-bytes: 4096 # 0 means disabled
+ max-lines: 24 # 0 means no limit
+# fakelag: prevents clients from spamming commands too rapidly
+fakelag:
+ # whether to enforce fakelag
+ enabled: true
+ # time unit for counting command rates
+ window: 1s
+ # clients can send this many commands without fakelag being imposed
+ burst-limit: 5
+ # once clients have exceeded their burst allowance, they can send only
+ # this many commands per `window`:
+ messages-per-window: 2
+ # client status resets to the default state if they go this long without
+ # sending any commands:
+ cooldown: 2s
+ # exempt a certain number of command invocations per session from fakelag;
+ # this is to speed up "resynchronization" of client state during reattach
+ command-budgets:
+ "CHATHISTORY": 16
+ "MARKREAD": 16
+ "MONITOR": 1
+ "WHO": 4
+# the roleplay commands are semi-standardized extensions to IRC that allow
+# sending and receiving messages from pseudo-nicknames. this can be used either
+# for actual roleplaying, or for bridging IRC with other protocols.
+roleplay:
+ # are roleplay commands enabled at all? (channels and clients still have to
+ # opt in individually with the +E mode)
+ enabled: false
+ # require the "roleplay" oper capability to send roleplay messages?
+ require-oper: false
+ # require channel operator permissions to send roleplay messages?
+ require-chanops: false
+ # add the real nickname, in parentheses, to the end of every roleplay message?
+ add-suffix: true
+# message history tracking, for the RESUME extension and possibly other uses in future
+history:
+ # should we store messages for later playback?
+ # the current implementation stores messages in RAM only; they do not persist
+ # across server restarts. however, you should not enable this unless you understand
+ # how it interacts with the GDPR and/or any data privacy laws that apply
+ # in your country and the countries of your users.
+ enabled: true
+ # how many channel-specific events (messages, joins, parts) should be tracked per channel?
+ channel-length: 4096
+ # how many direct messages and notices should be tracked per user?
+ client-length: 512
+ # how long should we try to preserve messages?
+ # if `autoresize-window` is 0, the in-memory message buffers are preallocated to
+ # their maximum length. if it is nonzero, the buffers are initially small and
+ # are dynamically expanded up to the maximum length. if the buffer is full
+ # and the oldest message is older than `autoresize-window`, then it will overwrite
+ # the oldest message rather than resize; otherwise, it will expand if possible.
+ autoresize-window: 2w
+ # number of messages to automatically play back on channel join (0 to disable):
+ autoreplay-on-join: 0
+ # maximum number of CHATHISTORY messages that can be
+ # requested at once (0 disables support for CHATHISTORY)
+ chathistory-maxmessages: 100
+ # maximum number of messages that can be replayed at once during znc emulation
+ # (znc.in/playback, or automatic replay on initial reattach to a persistent client):
+ znc-maxmessages: 2048
+ # options to delete old messages, or prevent them from being retrieved
+ restrictions:
+ # if this is set, messages older than this cannot be retrieved by anyone
+ # (and will eventually be deleted from persistent storage, if that's enabled)
+ expire-time: 2w
+ # if this is set, logged-in users cannot retrieve messages older than their
+ # account registration date, and logged-out users cannot retrieve messages
+ # older than their sign-on time (modulo grace-period, see below):
+ enforce-registration-date: true
+ # but if this is set, you can retrieve messages that are up to `grace-period`
+ # older than the above cutoff time. this is recommended to allow logged-out
+ # users to do session resumption / query history after disconnections.
+ grace-period: 1h
+ # options to store history messages in a persistent database (currently only MySQL):
+ persistent:
+ enabled: true
+ # store unregistered channel messages in the persistent database?
+ unregistered-channels: false
+ # for a registered channel, the channel owner can potentially customize
+ # the history storage setting. as the server operator, your options are
+ # 'disabled' (no persistent storage, regardless of per-channel setting),
+ # 'opt-in', 'opt-out', and 'mandatory' (force persistent storage, ignoring
+ # per-channel setting):
+ registered-channels: "opt-out"
+ # direct messages are only stored in the database for persistent clients;
+ # you can control how they are stored here (same options as above)
+ direct-messages: "opt-in"
+ # options to control how messages are stored and deleted:
+ retention:
+ # allow users to delete their own messages from history?
+ allow-individual-delete: true
+ # if persistent history is enabled, create additional index tables,
+ # allowing deletion of JSON export of an account's messages. this
+ # may be needed for compliance with data privacy regulations.
+ enable-account-indexing: true
+ # options to control storage of TAGMSG
+ tagmsg-storage:
+ # by default, should TAGMSG be stored?
+ default: false
+ # if `default` is false, store TAGMSG containing any of these tags:
+ whitelist:
+ - "+draft/react"
+ - "+react"
+ # if `default` is true, don't store TAGMSG containing any of these tags:
+ #blacklist:
+ # - "+draft/typing"
+ # - "typing"
+# whether to allow customization of the config at runtime using environment variables,
+# e.g., ORAGONO__SERVER__MAX_SENDQ=128k. see the manual for more details.
+allow-environment-overrides: true
diff --git a/apps/base/irc/kustomization.yaml b/apps/base/irc/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: irc
+resources:
+ - resources.yaml
+configMapGenerator:
+ - name: irc-config
+ options:
+ disableNameSuffixHash: true
+ files:
+ - files/ircd.motd
+ - files/ircd.yaml
diff --git a/apps/base/irc/resources.yaml b/apps/base/irc/resources.yaml
@@ -0,0 +1,172 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ namespace: irc
+ name: irc.midnightthoughts.space
+spec:
+ secretName: irc-certs
+ dnsNames:
+ - irc.midnightthoughts.space
+ issuerRef:
+ name: letsencrypt-dns
+ kind: ClusterIssuer
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: irc-deployment
+ labels:
+ app: irc
+spec:
+ replicas: 1
+ strategy:
+ type: Recreate
+ selector:
+ matchLabels:
+ app: irc
+ template:
+ metadata:
+ labels:
+ app: irc
+ spec:
+ shareProcessNamespace: true
+ containers:
+ - name: irc
+ image: ghcr.io/ergochat/ergo:v2.15.0
+ ports:
+ - containerPort: 6697
+ name: ircs
+ - containerPort: 443
+ name: websocket
+ readinessProbe:
+ tcpSocket:
+ port: 6697
+ livenessProbe:
+ tcpSocket:
+ port: 6697
+ volumeMounts:
+ - mountPath: /ircd/
+ name: irc-config
+ readOnly: true
+ - mountPath: /ircd/tls
+ name: irc-certs
+ readOnly: true
+ - mountPath: /ircd/db
+ name: irc-db
+ env:
+ - name: ERGO__DATASTORE__MYSQL__PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: irc-db
+ key: password
+ - name: config-reloader
+ # image is based on busybox which includes inotifyd + pkill
+ image: ghcr.io/ergochat/ergo
+ command: ["/bin/sh"]
+ args:
+ - "-c"
+ - |
+ echo "Watching /ircd/";
+ inotifyd - /ircd/:wMymndox /ircd/tls/:wMymndox | while read -r notifies ; do
+ echo "$notifies";
+ echo "notify received, sending SIGHUP";
+ pkill -HUP ergo;
+ done
+ echo "Exiting.";
+ volumeMounts:
+ - mountPath: /ircd/
+ name: irc-config
+ readOnly: true
+ - mountPath: /ircd/tls
+ name: irc-certs
+ readOnly: true
+ volumes:
+ - name: irc-config
+ configMap:
+ name: irc-config
+ - name: irc-certs
+ secret:
+ secretName: irc-certs
+ - name: irc-db
+ persistentVolumeClaim:
+ claimName: irc-db
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: irc
+ labels:
+ app: irc
+spec:
+ type: ClusterIP
+ ports:
+ - name: irc
+ port: 6697
+ targetPort: 6697
+ - name: websockets
+ port: 443
+ targetPort: 443
+ selector:
+ app: irc
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ name: irc
+ namespace: irc
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - irc.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: irc
+ port: 443
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+ name: ircs
+ namespace: irc
+ annotations:
+ external-dns.alpha.kubernetes.io/hostname: irc.midnightthoughts.space
+spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: irc
+ rules:
+ - backendRefs:
+ - name: ircs
+ port: 6697
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+ name: enable-proxy-protocol-policy
+ namespace: irc
+spec:
+ targetRefs:
+ - group: gateway.networking.k8s.io
+ kind: TCPRoute
+ name: ircs
+ - group: gateway.networking.k8s.io
+ kind: HTTPRoute
+ name: irc
+ proxyProtocol:
+ version: "V2"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: irc-db
+ labels:
+ app: irc
+spec:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 1Gi
diff --git a/apps/base/mariadb-operator/mariadb.yaml b/apps/base/mariadb-operator/mariadb.yaml
@@ -293,3 +293,69 @@ spec:
username: bugzilla
grantOption: false
host: "%"
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Database
+metadata:
+ name: irc
+spec:
+ mariaDbRef:
+ name: mariadb
+ characterSet: utf8
+ collate: utf8_general_ci
+ # Delete the resource in the database whenever the CR gets deleted.
+ # Alternatively, you can specify Skip in order to omit deletion.
+ cleanupPolicy: Delete
+ requeueInterval: 30s
+ retryInterval: 5s
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: User
+metadata:
+ name: irc
+spec:
+ # If you want the user to be created with a different name than the resource name
+ # name: user-custom
+ mariaDbRef:
+ name: mariadb
+ passwordSecretKeyRef:
+ name: mariadb-irc
+ key: password
+ # This field defaults to 10
+ maxUserConnections: 10
+ host: "%"
+ # Delete the resource in the database whenever the CR gets deleted.
+ # Alternatively, you can specify Skip in order to omit deletion.
+ cleanupPolicy: Delete
+ requeueInterval: 30s
+ retryInterval: 5s
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Grant
+metadata:
+ name: grant-irc
+spec:
+ mariaDbRef:
+ name: irc
+ privileges:
+ - "ALL PRIVILEGES"
+ database: "irc"
+ table: "*"
+ username: irc
+ grantOption: false
+ host: "%"
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Grant
+metadata:
+ name: grant-irc-show-db
+spec:
+ mariaDbRef:
+ name: mariadb
+ privileges:
+ - "SHOW DATABASES"
+ database: "*"
+ table: "*"
+ username: irc
+ grantOption: false
+ host: "%"
