commit cfa7deb3a55ddac6f000bc6a0b1452299796200a
parent c0060cbff5bc296eaf088a1c5b54c653ca07bd52
Author: MTRNord <mtrnord1@gmail.com>
Date: Wed, 12 Feb 2025 10:50:36 +0100
Improve mas and draupnir4all
Diffstat:
7 files changed, 119 insertions(+), 116 deletions(-)
diff --git a/apps/base/jenkins/release.yaml b/apps/base/jenkins/release.yaml
@@ -25,17 +25,17 @@ spec:
additionalContainers:
- sideContainerName: nodejs
image:
- repository: node
- tag: 23
+ repository: node
+ tag: 23
command: sleep
args: "99999999"
resources:
- requests:
- cpu: 512m
- memory: 512Mi
- limits:
- cpu: 512m
- memory: 1024Mi
+ requests:
+ cpu: 512m
+ memory: 512Mi
+ limits:
+ cpu: 512m
+ memory: 1024Mi
controller:
admin:
username: admin
@@ -76,7 +76,7 @@ spec:
tls:
- secretName: jenkins.midnightthoughts.space-tls
hosts:
- - jenkins.midnightthoughts.space
+ - jenkins.midnightthoughts.space
persistence:
enabled: true
size: 8Gi
@@ -89,13 +89,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3L25sUzlCejVNM3BLM3ZD
- enVDQXhLK2lnb0hTOE5CNEN0Y0Q5eThpVXhBCmZDczU4VzM2R1F1cmpPWm5iQk5v
- WXdXMXM3Y3VOazlxZUttdE9RVThrMEkKLS0tIGdyMHl3dzdPV0hDeUsxTnNGL1BK
- aW5QQ2V1LzhuMys0N01PdVJsMnpUcEUK1VYKGY8eIe1LixY1hCw2MGb8gFxerXCI
- W3m+QgsoKukbu5v9xd3PbsU2qfGncsOb/7q1hX4H6tKUAFnTRMWC/g==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3L25sUzlCejVNM3BLM3ZD
+ enVDQXhLK2lnb0hTOE5CNEN0Y0Q5eThpVXhBCmZDczU4VzM2R1F1cmpPWm5iQk5v
+ WXdXMXM3Y3VOazlxZUttdE9RVThrMEkKLS0tIGdyMHl3dzdPV0hDeUsxTnNGL1BK
+ aW5QQ2V1LzhuMys0N01PdVJsMnpUcEUK1VYKGY8eIe1LixY1hCw2MGb8gFxerXCI
+ W3m+QgsoKukbu5v9xd3PbsU2qfGncsOb/7q1hX4H6tKUAFnTRMWC/g==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-12-22T14:57:36Z"
mac: ENC[AES256_GCM,data:rej/F7igPPMx3P13rlHKjVk6yPZzHwsDbMAoXMjKuU5J5N3q45kZU3eBdifMAKjYtRuNdpM7d8rqcurQH08L6bIOCCrb8p5/ynFNYDl99F9480Lq2jvvRE9oTc6COaWlCadnpu+Qz/BBNN3Fp9JrovuUXDO5xfqkMLK23a0N3X4=,iv:Cs6ALE154TBSmx/iGaAPLFzFn0TxgdTtcL/Jalp4p4I=,tag:697cRQkyMBbIJBKXXHNVNQ==,type:str]
pgp: []
diff --git a/apps/base/matrix/draupnir-synapse/keydb.yaml b/apps/base/matrix/draupnir-synapse/keydb.yaml
@@ -19,12 +19,12 @@ spec:
command: ["keydb-server"]
args: ["/etc/keydb/keydb.conf", "--protected-mode", "no"]
ports:
- - containerPort: 6379
+ - containerPort: 6379
resources:
- requests:
- memory: "128Mi"
- cpu: "100m"
- limits: {}
+ requests:
+ memory: "128Mi"
+ cpu: "100m"
+ limits: {}
tolerations:
- key: arch
operator: Equal
diff --git a/apps/base/matrix/draupnir4all/deployment.yaml b/apps/base/matrix/draupnir4all/deployment.yaml
@@ -71,6 +71,11 @@ spec:
requests:
memory: "344Mi"
cpu: "252m"
+ securityContext:
+ runAsUser: 1000
+ runAsGroup: 1000
+ fsGroup: 1000
+ readOnlyRootFilesystem: true
ports:
- containerPort: 9001
name: widgets
diff --git a/apps/base/matrix/mas/mas_deployment.yaml b/apps/base/matrix/mas/mas_deployment.yaml
@@ -34,8 +34,7 @@ spec:
requests:
memory: "100Mi"
cpu: "28m"
- image: ghcr.io/element-hq/matrix-authentication-service:latest
- imagePullPolicy: Always
+ image: ghcr.io/element-hq/matrix-authentication-service:0.13.0
# Normal mode
args: ["server"]
#args: [ "help" ]
@@ -53,7 +52,7 @@ spec:
value: /config.yaml
initContainers:
- name: mas-config
- image: ghcr.io/element-hq/matrix-authentication-service:latest
+ image: ghcr.io/element-hq/matrix-authentication-service:0.13.0
imagePullPolicy: Always
# Sync config
args: ["config", "sync"]
diff --git a/apps/base/matrix/networkpolicies/matrix.yaml b/apps/base/matrix/networkpolicies/matrix.yaml
@@ -1,88 +1,88 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
- name: matrix
- namespace: matrix
+ name: matrix
+ namespace: matrix
spec:
- endpointSelector: {}
- egress:
- - toEntities:
- - world
- - toEndpoints:
- - matchLabels:
- io.kubernetes.pod.namespace: kube-system
- k8s-app: kube-dns
- toPorts:
- - ports:
- - port: "53"
- protocol: UDP
- rules:
- dns:
- - matchPattern: "*"
- - toEndpoints:
- - matchLabels:
- k8s:app.kubernetes.io/component: proxy
- k8s:app.kubernetes.io/managed-by: envoy-gateway
- k8s:app.kubernetes.io/name: envoy
- k8s:gateway.envoyproxy.io/owning-gateway-name: envoy-gateway
- k8s:gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
- io.kubernetes.pod.namespace: envoy-gateway
- toPorts:
- - ports:
- - port: "10443"
- - toEndpoints:
- - matchLabels:
- k8s:app.kubernetes.io/name: draupnir4all
- io.kubernetes.pod.namespace: matrix
- toPorts:
- - ports:
- - port: "9000"
- - toEndpoints:
- - matchLabels:
- k8s:app: draupnir-synapse-keydb
- io.kubernetes.pod.namespace: matrix
- toPorts:
- - ports:
- - port: "6379"
- - toEndpoints:
- - matchLabels:
- k8s:app: matrix-synapse-keydb
- io.kubernetes.pod.namespace: matrix
- toPorts:
- - ports:
- - port: "6379"
- - toEndpoints:
- - matchLabels:
- k8s:app: pantalaimon-freifunk
- io.kubernetes.pod.namespace: matrix
- toPorts:
- - ports:
- - port: "8008"
- - toEndpoints:
- - matchLabels:
- k8s:app.kubernetes.io/instance: draupnir-synapse
- io.kubernetes.pod.namespace: matrix
- toPorts:
- - ports:
- - port: "9093"
- - toEndpoints:
- - matchLabels:
- k8s:app.kubernetes.io/instance: matrix-synapse
- io.kubernetes.pod.namespace: matrix
- toPorts:
- - ports:
- - port: "9093"
- - toEndpoints:
- - matchLabels:
- k8s:cnpg.io/cluster: pg-cluster-v2
- io.kubernetes.pod.namespace: postgres-cluster
- toPorts:
- - ports:
- - port: "5432"
- - toEndpoints:
- - matchLabels:
- k8s:app.kubernetes.io/instance: traefik
- io.kubernetes.pod.namespace: traefik-ingress
- toPorts:
- - ports:
- - port: "8443"
+ endpointSelector: {}
+ egress:
+ - toEntities:
+ - world
+ - toEndpoints:
+ - matchLabels:
+ io.kubernetes.pod.namespace: kube-system
+ k8s-app: kube-dns
+ toPorts:
+ - ports:
+ - port: "53"
+ protocol: UDP
+ rules:
+ dns:
+ - matchPattern: "*"
+ - toEndpoints:
+ - matchLabels:
+ k8s:app.kubernetes.io/component: proxy
+ k8s:app.kubernetes.io/managed-by: envoy-gateway
+ k8s:app.kubernetes.io/name: envoy
+ k8s:gateway.envoyproxy.io/owning-gateway-name: envoy-gateway
+ k8s:gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
+ io.kubernetes.pod.namespace: envoy-gateway
+ toPorts:
+ - ports:
+ - port: "10443"
+ - toEndpoints:
+ - matchLabels:
+ k8s:app.kubernetes.io/name: draupnir4all
+ io.kubernetes.pod.namespace: matrix
+ toPorts:
+ - ports:
+ - port: "9000"
+ - toEndpoints:
+ - matchLabels:
+ k8s:app: draupnir-synapse-keydb
+ io.kubernetes.pod.namespace: matrix
+ toPorts:
+ - ports:
+ - port: "6379"
+ - toEndpoints:
+ - matchLabels:
+ k8s:app: matrix-synapse-keydb
+ io.kubernetes.pod.namespace: matrix
+ toPorts:
+ - ports:
+ - port: "6379"
+ - toEndpoints:
+ - matchLabels:
+ k8s:app: pantalaimon-freifunk
+ io.kubernetes.pod.namespace: matrix
+ toPorts:
+ - ports:
+ - port: "8008"
+ - toEndpoints:
+ - matchLabels:
+ k8s:app.kubernetes.io/instance: draupnir-synapse
+ io.kubernetes.pod.namespace: matrix
+ toPorts:
+ - ports:
+ - port: "9093"
+ - toEndpoints:
+ - matchLabels:
+ k8s:app.kubernetes.io/instance: matrix-synapse
+ io.kubernetes.pod.namespace: matrix
+ toPorts:
+ - ports:
+ - port: "9093"
+ - toEndpoints:
+ - matchLabels:
+ k8s:cnpg.io/cluster: pg-cluster-v2
+ io.kubernetes.pod.namespace: postgres-cluster
+ toPorts:
+ - ports:
+ - port: "5432"
+ - toEndpoints:
+ - matchLabels:
+ k8s:app.kubernetes.io/instance: traefik
+ io.kubernetes.pod.namespace: traefik-ingress
+ toPorts:
+ - ports:
+ - port: "8443"
diff --git a/apps/base/matrix/synapse/keydb.yaml b/apps/base/matrix/synapse/keydb.yaml
@@ -21,10 +21,10 @@ spec:
ports:
- containerPort: 6379
resources:
- requests:
- memory: "128Mi"
- cpu: "100m"
- limits: {}
+ requests:
+ memory: "128Mi"
+ cpu: "100m"
+ limits: {}
tolerations:
- key: arch
operator: Equal
diff --git a/apps/base/rundeck/release.yaml b/apps/base/rundeck/release.yaml
@@ -46,7 +46,6 @@ spec:
size: 1G
nginx:
enabled: false
-
ingress:
enabled: true
className: traefik
@@ -55,12 +54,12 @@ spec:
hosts:
- host: rundeck.midnightthoughts.space
paths:
- - path: /
- pathType: ImplementationSpecific
+ - path: /
+ pathType: ImplementationSpecific
tls:
- secretName: rundeck.midnightthoughts.space-tls
hosts:
- - rundeck.midnightthoughts.space
+ - rundeck.midnightthoughts.space
persistence:
enabled: true
claim:
