commit edae426b884d76d8e0cf2fe7a0a8cd33eb1dda0c parent 32641587be2032e9c06723ab85d1b643faefd13e Author: MTRNord <MTRNord@users.noreply.github.com> Date: Wed, 25 Feb 2026 21:05:50 +0100 Revert "cleanup" This reverts commit 32641587be2032e9c06723ab85d1b643faefd13e. Diffstat:
| A | apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml | | | 73 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml | | | 116 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/clickstack/kustomization.yaml | | | 10 | ++++++++++ |
| A | apps/talos_cluster/clickstack/release.yaml | | | 73 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/clickstack/repository.yaml | | | 17 | +++++++++++++++++ |
| A | apps/talos_cluster/clickstack/route.yaml | | | 32 | ++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/clickstack/secrets.yaml | | | 57 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/immich/database-credentials.yaml | | | 32 | ++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/immich/kustomization.yaml | | | 8 | ++++++++ |
| A | apps/talos_cluster/immich/release.yaml | | | 74 | ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/immich/repository.yaml | | | 13 | +++++++++++++ |
| A | apps/talos_cluster/immich/route.yaml | | | 32 | ++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/sentry/kustomization.yaml | | | 7 | +++++++ |
| A | apps/talos_cluster/sentry/release.yaml | | | 167 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ |
| A | apps/talos_cluster/sentry/repository.yaml | | | 8 | ++++++++ |
| A | apps/talos_cluster/sentry/route.yaml | | | 32 | ++++++++++++++++++++++++++++++++ |
16 files changed, 751 insertions(+), 0 deletions(-)
diff --git a/apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml b/apps/talos_cluster/clickstack/k8s_events_global_metrics_collector.yaml @@ -0,0 +1,73 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: k8s-events-global-metrics-collector + namespace: clickstack +spec: + releaseName: k8s-events-global-metrics-collector + chart: + spec: + chart: opentelemetry-collector + sourceRef: + kind: HelmRepository + name: open-telemetry + interval: 60m + values: + # deployment.yaml + mode: deployment + + image: + repository: otel/opentelemetry-collector-contrib + tag: 0.145.0 + + # We only want one of these collectors - any more and we'd produce duplicate data + replicaCount: 1 + + presets: + kubernetesAttributes: + enabled: true + # When enabled the processor will extra all labels for an associated pod and add them as resource attributes. + # The label's exact name will be the key. + extractAllPodLabels: true + # When enabled the processor will extra all annotations for an associated pod and add them as resource attributes. + # The annotation's exact name will be the key. + extractAllPodAnnotations: true + # Configures the collector to collect kubernetes events. + # Adds the k8sobject receiver to the logs pipeline and collects kubernetes events by default. + # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-objects-receiver + kubernetesEvents: + enabled: true + # Configures the Kubernetes Cluster Receiver to collect cluster-level metrics. + # Adds the k8s_cluster receiver to the metrics pipeline and adds the necessary rules to ClusteRole. + # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-cluster-receiver + clusterMetrics: + enabled: true + + extraEnvs: + - name: HYPERDX_API_KEY + valueFrom: + secretKeyRef: + name: hyperdx-secret + key: HYPERDX_API_KEY + optional: true + - name: YOUR_OTEL_COLLECTOR_ENDPOINT + valueFrom: + configMapKeyRef: + name: otel-config-vars + key: YOUR_OTEL_COLLECTOR_ENDPOINT + + config: + exporters: + otlphttp: + endpoint: "${env:YOUR_OTEL_COLLECTOR_ENDPOINT}" + compression: gzip + headers: + authorization: "${env:HYPERDX_API_KEY}" + service: + pipelines: + logs: + exporters: + - otlphttp + metrics: + exporters: + - otlphttp diff --git a/apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml b/apps/talos_cluster/clickstack/k8s_log_metrics_collector.yaml @@ -0,0 +1,116 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: k8s-log-metrics-collector + namespace: clickstack +spec: + releaseName: k8s-log-metrics-collector + chart: + spec: + chart: opentelemetry-collector + sourceRef: + kind: HelmRepository + name: open-telemetry + interval: 60m + values: + # daemonset.yaml + mode: daemonset + + image: + repository: otel/opentelemetry-collector-contrib + tag: 0.145.0 + + # Required to use the kubeletstats cpu/memory utilization metrics + clusterRole: + create: true + rules: + - apiGroups: + - "" + resources: + - nodes/proxy + verbs: + - get + + presets: + logsCollection: + enabled: true + hostMetrics: + enabled: true + # Configures the Kubernetes Processor to add Kubernetes metadata. + # Adds the k8sattributes processor to all the pipelines and adds the necessary rules to ClusterRole. + # More info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubernetes-attributes-processor + kubernetesAttributes: + enabled: true + # When enabled the processor will extra all labels for an associated pod and add them as resource attributes. + # The label's exact name will be the key. + extractAllPodLabels: true + # When enabled the processor will extra all annotations for an associated pod and add them as resource attributes. + # The annotation's exact name will be the key. + extractAllPodAnnotations: true + # Configures the collector to collect node, pod, and container metrics from the API server on a kubelet.. + # Adds the kubeletstats receiver to the metrics pipeline and adds the necessary rules to ClusterRole. + # More Info: https://opentelemetry.io/docs/kubernetes/collector/components/#kubeletstats-receiver + kubeletMetrics: + enabled: true + + extraEnvs: + - name: HYPERDX_API_KEY + valueFrom: + secretKeyRef: + name: hyperdx-secret + key: HYPERDX_API_KEY + optional: true + - name: YOUR_OTEL_COLLECTOR_ENDPOINT + valueFrom: + configMapKeyRef: + name: otel-config-vars + key: YOUR_OTEL_COLLECTOR_ENDPOINT + config: + receivers: + # Configures additional kubelet metrics + kubeletstats: + collection_interval: 20s + auth_type: "serviceAccount" + #endpoint: "${env:K8S_NODE_NAME}:10250" + #endpoint: "127.0.0.1:10250" + endpoint: "${env:K8S_NODE_IP}:10250" + insecure_skip_verify: true + metrics: + k8s.pod.cpu_limit_utilization: + enabled: true + k8s.pod.cpu_request_utilization: + enabled: true + k8s.pod.memory_limit_utilization: + enabled: true + k8s.pod.memory_request_utilization: + enabled: true + k8s.pod.uptime: + enabled: true + k8s.node.uptime: + enabled: true + k8s.container.cpu_limit_utilization: + enabled: true + k8s.container.cpu_request_utilization: + enabled: true + k8s.container.memory_limit_utilization: + enabled: true + k8s.container.memory_request_utilization: + enabled: true + container.uptime: + enabled: true + + exporters: + otlphttp: + endpoint: "${env:YOUR_OTEL_COLLECTOR_ENDPOINT}" + headers: + authorization: "${env:HYPERDX_API_KEY}" + compression: gzip + + service: + pipelines: + logs: + exporters: + - otlphttp + metrics: + exporters: + - otlphttp diff --git a/apps/talos_cluster/clickstack/kustomization.yaml b/apps/talos_cluster/clickstack/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: clickstack +resources: + - repository.yaml + - release.yaml + - route.yaml + - secrets.yaml + - k8s_log_metrics_collector.yaml + - k8s_events_global_metrics_collector.yaml diff --git a/apps/talos_cluster/clickstack/release.yaml b/apps/talos_cluster/clickstack/release.yaml @@ -0,0 +1,73 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: clickstack + namespace: clickstack +spec: + releaseName: clickstack + chart: + spec: + chart: clickstack + sourceRef: + kind: HelmRepository + name: clickstack + interval: 60m + values: + global: + storageClassName: longhorn + hyperdx: + apiKey: ENC[AES256_GCM,data:8kskExN3VStHrMmbw1NTiCBwh6hrEv87EyAyAPR02+z28k25,iv:0QTlYvEYwypMLwicnVAKLFt84bwdUPQouPwFTrX+v0M=,tag:0h063JeXW7uvXgYFokQY/g==,type:str] + appUrl: https://clickstack.midnightthoughts.space + frontendUrl: https://clickstack.midnightthoughts.space + mongodb: + persistence: + enabled: true + size: 10Gi + clickhouse: + persistence: + enabled: true + dataSize: 10Gi + logSize: 5Gi + config: + users: + appUserPassword: ENC[AES256_GCM,data:UZQQ9Yg8yDlC2Hm5z/YYj2xw3fCdbV+2Brnn/UEB0B+wMiyGH9s4GupK0Q4/uvqIGkCjRvZH4DqG+higPyaJ,iv:kipnRldYvL/NaQTDwQuus1Skt2pV8TLXIGoiLrm0iFM=,tag:u+tv9dGEWVPmrnhfOWuStA==,type:str] + otelUserPassword: ENC[AES256_GCM,data:s0QRS+ZMfLg/eLJoqxpkiYxgNheTpj4hZwqdUynRSysSzL5dxVMwSZq/lRhJQ8FqmHP5miGETJNF11Y0kEUb,iv:VCXLiq961D/LJMl0X9/ccFisNXJbE+9RxvlqBcxCAeg=,tag:V7UxUW46qQlrVShZpKiEOw==,type:str] + otelUserName: otelcollector + # otel: + # customConfig: | + # processors: + # batch: + # tail_sampling: + # decission_wait: 30s + # num_traces: 20000 + # expected_new_traces_per_sec: 50 + # policies: + # - name: always_on_error + # type: error + # - name: slow_traces + # type: latency + # latency_threshold: 250ms + # - name: probabilistic_fallback + # type: probabilistic + # sampling_percentage: 5.0 + # # TODO: Unclear how to configure the pipelines as its hardcoded over at https://github.com/hyperdxio/hyperdx/blob/af3bbcf1a0f3d31a0a74b4f4fe3073af229a8df7/packages/api/src/opamp/controllers/opampController.ts#L4 possibly? +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtbXJpK0Q0cjdXNFhwRWpP + Zzl5NmNGZzE5Sk5zeC9lVk9mMEdVUmQxNkRFCld6MVN3VEtLWlM4RW1Va3VocWpU + Ly9Ld2Q3Q0I1NGx2bEdHRkgvMXF4UEEKLS0tIGhmR2IwV0I3Z1lsRFZGek4vdzZC + RlNWRVQ1aDlCTmFDNkhHNlRJVEFZeGcKx+4o4lJK1ttkMTqf9WphCyp+454FEvcH + KMoTJYzYDFr3Ol/jwvOX3J+rwyn3of0GPNW+T6si9iBLd0dXegkWOQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-01-05T18:20:57Z" + mac: ENC[AES256_GCM,data:ijOmWUKboiCUFSKY1KfctWWyfS39bCGg06RwVrWU+ndO0AHV2Fgc++73/iVhQf+kcmAv+Bpp46aAVwVpcEWAiiGI1Bglu8aUWaehwPcE9ZDWJwqN+NIyXjT1PFOcQ4e8P+qihaPbbXkGafo31FbHJlKgaig8PsjwhqAKlD50MW8=,iv:QrmnkqoHdJRGwDOvYYukGI2vjid47J36q+MTR7RrJk0=,tag:lduLOK+lo/naVVHI266RaQ==,type:str] + pgp: [] + encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ + version: 3.9.1 diff --git a/apps/talos_cluster/clickstack/repository.yaml b/apps/talos_cluster/clickstack/repository.yaml @@ -0,0 +1,17 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: clickstack + namespace: clickstack +spec: + interval: 60m + url: https://hyperdxio.github.io/helm-charts +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: open-telemetry + namespace: clickstack +spec: + interval: 60m + url: https://open-telemetry.github.io/opentelemetry-helm-charts diff --git a/apps/talos_cluster/clickstack/route.yaml b/apps/talos_cluster/clickstack/route.yaml @@ -0,0 +1,32 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: clickstack + namespace: clickstack +spec: + parentRefs: + - name: envoy-gateway + namespace: envoy-gateway + hostnames: + - clickstack.midnightthoughts.space + rules: + - backendRefs: + - name: clickstack-app + port: 3000 + timeouts: + request: 240s + backendRequest: 0s +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: BackendTrafficPolicy +metadata: + name: clickstack-compression + namespace: clickstack +spec: + targetRef: + group: gateway.networking.k8s.io + kind: HTTPRoute + name: clickstack + compression: + - type: Gzip + - type: Brotli diff --git a/apps/talos_cluster/clickstack/secrets.yaml b/apps/talos_cluster/clickstack/secrets.yaml @@ -0,0 +1,57 @@ +apiVersion: v1 +kind: Secret +metadata: + name: hyperdx-secret + namespace: clickstack +type: Opaque +stringData: + HYPERDX_API_KEY: ENC[AES256_GCM,data:A+gj3fg/FMVjRuqMVUoYWqJWl25L4hZrw6YiQNlbtKKeMb5C,iv:hOFqFn2vV+mSNTZAu5OG/NVgPvAugSaSPJ2NG/9Tpj4=,tag:U4/K9zHnpGSpKnc+zIUhTQ==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ + VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5 + MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl + amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh + u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-01-07T08:48:49Z" + mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str] + pgp: [] + encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ + version: 3.9.1 +--- +# Configmap for the otel collector endpoint +apiVersion: v1 +kind: ConfigMap +metadata: + name: otel-config-vars + namespace: clickstack +data: + YOUR_OTEL_COLLECTOR_ENDPOINT: ENC[AES256_GCM,data:jKOaxrj5Fb+wNMZcybCMD/+eP2E+Wz0hOe8H6ctGq8mW/FD601kX2IP6azbfobz8NbgwvQc5RQrao05FuYDOY9Jq,iv:Bu71B4EPiwT+3nh5xO2J3u50Fmb1KduivEYPi8sS+Ak=,tag:evJx/AUSJzLiKvW9D92L5Q==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDYVFJUnFXVWYyNk91aGxZ + VjZ0Y0IyajJMYnEwaVdTZzhNY1d6eWNTbjJZCkx6Zm1zYnd6a3U5c0RoR1Z3eGV5 + MndobFFCV0FnazU1dW5Qa3ROdzg3aUUKLS0tIFVnUDhjenhHK3owNkZMcE1xWlFl + amxYOUhKSGU0bGIrTnM1WTBtZ0hwUTgKmCD84Zz6gfHFzySqqAU6S+zX+z2l/LEh + u6+FzzEHdwnaTDLcXhkuaushcH+NaeGApLPaFBVVzpHiXn+NKvw7Ig== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-01-07T08:48:49Z" + mac: ENC[AES256_GCM,data:hhfCPstGlLkRQBgiLVibY8nAIj4spkfSEyr1hGii1oQCV7bNCdDdiiSrOve9FSTJF+6gyQu4A2kLezqudc9dYWqlRdVJ3MHp/Gr8hDxjKkp5zmxuVDk7+N17vHajCyKtTzW/jRAqmKQLyMAdUBCxyPXyzc+/nBVVeXWncwSXVhQ=,iv:9M71puGKMgEGRxbbO7iLsoP0N7ZEbZ4keiYS6fTp0rc=,tag:oCXXt9+w82+Fw7ZTBlrb0Q==,type:str] + pgp: [] + encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ + version: 3.9.1 diff --git a/apps/talos_cluster/immich/database-credentials.yaml b/apps/talos_cluster/immich/database-credentials.yaml @@ -0,0 +1,32 @@ +# Secret +apiVersion: v1 +kind: Secret +metadata: + name: immich-database + namespace: immich +type: Opaque +stringData: + host: ENC[AES256_GCM,data:ReseNUa2mc2Cf7C17/rxjYh5K+EZkZzKBe03vMqIBcKv1seGnP5Nqzk2SG5Svgxyh/8b,iv:anQMpD9bLkyOSQeKWfIQvsVEiOUz8aW/jzXV4yJrs7g=,tag:OdFmwjnoKp5Jb1xERMTQ5A==,type:str] + username: ENC[AES256_GCM,data:i4xsvTHL,iv:l5Mfr9/oLlP3hqfIpDqhz8Z1KtmvgD2OxewEZChcCC8=,tag:AVOWSu1IjhzpfvtE/xTNKQ==,type:str] + password: ENC[AES256_GCM,data:oJuJ7ulDQoreyuML5en4UOrhwRiNBqUCgaMsxE8EDtKgZQGFmtH8O1FFiU2IUWKvYCf3/4hLAr0KPNhNbXqQWQ==,iv:Bcu4WnbNIs8QCoqIxUO0VhdCOrsYkk9g0+YE7yeVHB8=,tag:bKNZ4nQbZL/YDlEx8d11Ug==,type:str] + dbname: ENC[AES256_GCM,data:NYj7qrNm,iv:K867td+2mraT2ne7ga8zEsO7kRG35MCKAEZ9xdrpGbw=,tag:vURQGZYVxC4Buvk8z3D42A==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsU2doMSt0cWhSd2M2L3BN + VEp5UktUSWRGUWh6OHNUTlpxbThkTVBEaGlBCjFrait6N3o0RFJkVGFpSEg0VlI4 + TFYvb1htTHVaUmNES3pMTTN3bWRJUk0KLS0tIGFVY1RxdTZtMjNNZk1lNVJxNTRz + WUlrOGIrRWVOSFloTnlWMFdkQXpPWm8KwmzW87pNLHUEafGJG3tDyJv1aGgqv+5X + U86qdfLwxtg220rm6sq1+x0qdWRlAmmg1mij920dDL9lMZ2PqRT+TA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-12-20T22:26:54Z" + mac: ENC[AES256_GCM,data:Xf1XzBBgz4rPJqvrvpTmamE3f1pVLh9QYAxtQRqA0qKsauFiTXx2T+gjz91RDZozhI5dVu8rq+qfVEzIMCslwi3brBASeOIDZhozdkbS3PkCWNP5a/YaL727QZ7uViIIu+SoxyBZMYIMPyUSHG3Q3H77Ad6ICvE2PmNBMv3roeo=,iv:ToqbvhLxbeikmioryuJUs2ptc2MSPMrNT0h1hA9frSE=,tag:susZLm6jz8D6iqGq9uvTFw==,type:str] + pgp: [] + encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ + version: 3.9.1 diff --git a/apps/talos_cluster/immich/kustomization.yaml b/apps/talos_cluster/immich/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: immich +resources: + - repository.yaml + - database-credentials.yaml + - release.yaml + - route.yaml diff --git a/apps/talos_cluster/immich/release.yaml b/apps/talos_cluster/immich/release.yaml @@ -0,0 +1,74 @@ +# PVC for immich +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: immmich-pvc + namespace: immich +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi + storageClassName: longhorn +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: immich + namespace: immich +spec: + releaseName: immich + chartRef: + kind: OCIRepository + name: immich + namespace: immich + interval: 60m + values: + controllers: + main: + containers: + main: + image: + tag: "v2.5.6" + server: + controllers: + main: + containers: + main: + env: + DB_HOSTNAME: + valueFrom: + secretKeyRef: + name: immich-database + key: host + DB_USERNAME: + valueFrom: + secretKeyRef: + name: immich-database + key: username + DB_PASSWORD: + valueFrom: + secretKeyRef: + name: immich-database + key: password + DB_DATABASE_NAME: + valueFrom: + secretKeyRef: + name: immich-database + key: dbname + immich: + persistence: + library: + existingClaim: immmich-pvc + configuration: {} + configurationKind: ConfigMap + valkey: + enabled: true + persistence: + data: + enabled: true + size: 1Gi + type: emptyDir + accessMode: ReadWriteOnce + storageClass: longhorn diff --git a/apps/talos_cluster/immich/repository.yaml b/apps/talos_cluster/immich/repository.yaml @@ -0,0 +1,13 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: OCIRepository +metadata: + name: immich + namespace: immich +spec: + interval: 60m + url: oci://ghcr.io/immich-app/immich-charts/immich + layerSelector: + mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip" + operation: copy + ref: + semver: "^0.10.3" diff --git a/apps/talos_cluster/immich/route.yaml b/apps/talos_cluster/immich/route.yaml @@ -0,0 +1,32 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: immich + namespace: immich +spec: + parentRefs: + - name: envoy-gateway + namespace: envoy-gateway + hostnames: + - immich.mtrnord.blog + rules: + - backendRefs: + - name: immich-server + port: 2283 + timeouts: + request: 240s + backendRequest: 0s +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: BackendTrafficPolicy +metadata: + name: immich-compression + namespace: immich +spec: + targetRef: + group: gateway.networking.k8s.io + kind: HTTPRoute + name: immich + compression: + - type: Gzip + - type: Brotli diff --git a/apps/talos_cluster/sentry/kustomization.yaml b/apps/talos_cluster/sentry/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: sentry +resources: + - repository.yaml + - release.yaml + - route.yaml diff --git a/apps/talos_cluster/sentry/release.yaml b/apps/talos_cluster/sentry/release.yaml @@ -0,0 +1,167 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: sentry + namespace: sentry +spec: + releaseName: sentry + chart: + spec: + chart: sentry + version: 28.1.x + sourceRef: + kind: HelmRepository + name: sentry + interval: 60m + timeout: 240m0s + values: + ipv6: true + user: + create: true + email: mtrnord@nordgedanken.dev + password: ENC[AES256_GCM,data:WTwV6ujtww48,iv:jqWkKwcQYBVmVbrMNWelAPdM99HxeLoKH01wr8HMELM=,tag:79lhm3xMAYWJgDSPp2g6XA==,type:str] + # this is required on the first installation, as sentry has to be initialized first + # recommended to set false for updating the helm chart afterwards, + # as you will have some downtime on each update if it's a hook + # deploys relay & snuba consumers as post hooks + asHook: false + hooks: + dbCheck: + image: + repository: toolbelt/netcat + tag: latest + pullPolicy: Always + vroom: + persistence: + enabled: true + size: 5Gi + accessMode: ReadWriteMany + storageClass: longhorn + geodata: + persistence: + storageClass: longhorn + sentry: + singleOrganization: true + web: + enabled: true + features: + orgSubdomains: false + enableProfiling: false + enableSessionReplay: true + enableFeedback: true + enableSpan: true + enableUptime: false + ingestFeedback: + enabled: true + system: + url: https://sentry.mtrnord.blog + adminEmail: ENC[AES256_GCM,data:FZctGNse1Ruv7krqJxAu2k36/2cBkaS/7/UGqjKZ,iv:DGhUqYRIYcWQAOTTmFd1B8R4+MCYP16Crndfv2i7Tbk=,tag:TdVeCP6gsTCDwmcZMBswqg==,type:str] + public: false + secretKey: ENC[AES256_GCM,data:25IVzNtqa8GMGbAcvt52UtmkgA1oQcm1qLudb0O4Nf3fmZFGzW3rgmhH3Xy6n0wBrZA+21n0s0buRsvDaF2Nxg==,iv:I6GpOFvrOcyuY+sczCqWpfNCwdZxt4Rk+svKBEGmhv0=,tag:xHaP5EHDcJrH+XqN0dXRgw==,type:str] + mail: + backend: smtp + host: mail.midnightthoughts.space + useTls: "true" + useSsl: "false" + port: "587" + username: support@midnightthoughts.space + password: ENC[AES256_GCM,data:jBgw6wgU8wHO22oHOjigdDD0jfr1ZN4vhSQxoDa/YFgAoFferHEYc724gamTuoEOTSB8oBkIQduNm65PemRnrw==,iv:Iq8fpC0SuMnXN19AePDzU564oyvGTdZDJb3UYrl0mlE=,tag:prH26pGX0bpOBMvRUr/RwA==,type:str] + from: support@midnightthoughts.space + github: + appId: ENC[AES256_GCM,data:9Nh2OIzQzw==,iv:ESWCjcEsDV4lILIpyp+MRDJHMJ4lxghhAB8TTRHADcw=,tag:03Y10Q6RuwxUOBMN7wFeUw==,type:str] + appName: Sentry Midnightthoughts + clientId: ENC[AES256_GCM,data:IV3fzL3qUSyWS5FFG5//GOprtJs=,iv:c/8aWMMcqnePEDLTF9et1pUbwcoXa39+on+TqUl6F7A=,tag:TCGyxJkWzfCM88Su16wCKA==,type:str] + clientSecret: ENC[AES256_GCM,data:Zp4uu9L5Hc7zqlORkPoQVeW5GPj1Ho/S1fjaw/PTuHQXPeBzC+qpEA==,iv:ILXi9XL7+FYskjv5OEk64Y8E+6motfARONM7XKH36Jw=,tag:MRB8KFpkdwua4XH2WcIfMg==,type:str] + privateKey: ENC[AES256_GCM,data:cb9g6j3UrDc93Yo7u+6OOmay10ES3Uy/Y6iLyR1t4jTOrCh1Ws1ArwvqFHWuEa7cd5NxEpkGUorglxgSLr8QXOsvM+mJwcSUtoS9cLHxK8PYOlF8oP0C6lUzYYqYeboCOLltCftV+4VKxYQt6jhWo+I44Tcd6ftVCOEESg68YlHmO6tn/wDYdAVvN0F/V7doRDjLoNs1iA+RyPoipWuJOayDtuLbN+POWLHoNPGuhgw38fVNaAtv3vp+fwxfU00mhGkw6u5+BkeEBOlf9dmwz1krETqw5HWNyHufboC+wMRBpyG4EYS8/Z6Ms4zfy6pm+SIr1EfCozYam5mlzJszAlH8YHFKpGUSH2n0pOYsmO+KEgMg40xiwR65pOkQNLzlFCfP3gu1+y1GtAC7nnRTHE1puE9LiflNR6eONW5vcvjWaJOxrnmoVJRkcGQnkIOCzs2PTQg4VMGgIuhNTyAKRGvsoeXQEEdCK3WUCA5KrwdxRGqORKlORV8qtbunVxXtazIbE9Ze82tHPB2jAS24IdxjHAg29zuKasPJT/TFeKxmNfB6qnLXDKn3KZ6sBq3hh2Fa6vP3xn2kXg+UBkeqY34ana9tX0o+oLtNHUB7UhGkOCEvggJ1BtbvvhTQ5fkCpp479AzeZq2bBwnvKNXTqLuJP4MEjit04VLP1Nrss0uDcShSxnWASAzeA+mkFucweFNJy4zcL2P0VdM4wzX3nZcR5AbfnS/gPA+yyPGrPkHQiTDuKLIxPcvFxvuLVr1Oe80HXpeDULyV6PXXuW7ojHHGEAXwyIwx1H74i1GafQxNm5MRP291ljaandFNZQxxYb8BcP5WKBPBA8910aXzuK13rt/54mznkwc0YOlhRPq+S9z2RUbw8skORb7xGbducabVJTxBpjxmSDQ/73Co+ffEwaOQY3XOmJGIpe8IUP6+iBGuXL3E3cThWS/sydFzkhiv58TjqxhO6i9dLh6nEP9n5sSpbLi283qD2H2xBag/QWUM1j6pgXFzF/IaaygmGx4/r+Aez//Ti1soWq7vqY9koZyDrBE7IYdGYdi9OWEuTGMhQlyB3bwsZ/Syya8WH10X2IyPrDbn3+679NhM9/Oq4RuA9p4zli5iJ6TAvGN3v0ybIIVWab+AcTTqd5e6dbHVxEyMIc3d+aoBjCZT60XIfP1/NwDxY66Dlo1svZvwc44yBIvKdYvqRUhOjDrLGI/Vw2SgLD9xsfY1yLqpxhGRhEoqgL88h5IIeOzs+XWD2O5Z0n7X2hoLOGLAuqCs00A/ovsFE3jtWPb2GOC9GjN4siTtL0Dcnm6M+sIXIAmiV9JRM67wjtAqrfxA9RCspKTeNE5kVT0B3tNXT5IJSCe/XRUISJrya6fbWVphQoEbT3UQJpEMXIez5zux0Xp24vPv6YDFzIV5he8LWDPKAmL48X32cuKf/8fJlencdY6IPr/2rrEo/mLsvwuT7YP1aORWy+nJ55sdWP9/gWU7MMnSaBfcY+3q+pe1l8rbYhgKoKZaXmwrw5D2XeZiurZ+Acyda7FLmYjoisd0oAXr8PMxEPionFYJhawiMqtkXY7fZSRq2IfiCp51qjXYZn+7lKvAR8ktTPQf+uF6udSPWaRdd/gXiNpBdy5q5eNXJouoBxkqMJZaeVr4eVVqMv0AiRApKXLSXQ0jZdfLii7l8D4RD4OoqASJO3NgKCbb477sAYvfmfbxhjKCzIptBkK55s82gA34PboCmqPwSNQPaKa6eKwRKICVDfL0Uoa8igvp2Y8D5uMmVBQDPJBlXV+AsGwDM6ExA+GxK36bn6Uu+h5csDPc1ej8NfifpbVfnxkKNayA10OEKUr1Wdk42ch4UOnPAfUmG0Qw3NLVy1qM+nUZxqv+DLrvatDj6yLaVBumNx3NVseslRvQoIsBbq4xgpBGuvsUf9enPiSTO1+Mz+iQ940DutMPZGjdIc25JUwMhUxm+3rEfFHNfhTKEdTjiHOQiz0rzlfbTNsIXj/AvQ7DdHcI6IUBXgVy3uTJ0fQM2Cv7y+rcCa7iewT2ErGNG02Z2pedgc4dWpWDvprUOgHAcM/sUxFD1RpeV27D2CkDsiWvxtvH8+uUSOc+YI4rCu6eWa3Btf8Em6H5xSVhdA136DTpg60uFtnR1dY1BtlVIwWt1bh/RG9CGcVv8rh9dOVdiIuRUS1G6lWnH2UmuQ3IAzp7gLyMJPyNbI3O88bFtmVsq2TW8vXr9OZM32Q=,iv:td50Un7ITMuMeamp2xI1ZirEfueVLy7riN9eLYAb0Ic=,tag:qa762/Nkwx82V8IBAeDwzg==,type:str] + webhookSecret: ENC[AES256_GCM,data:PfkiR6C2T+GdkeDjKm4d8walePHqqWYrLCPLDyKejjqrwX9RLFQPIfkHw66d0rxA9Q3/LjXXx1++8cT+J3Ie6w==,iv:5MJqZdTdgYBZt53MXwE6jgCiBc43AvyT8BTruhz+9w4=,tag:DvmVrko9Omq1dwS9L4Izdg==,type:str] + auth: + register: false + ingress: + enabled: false + filestore: + backend: filesystem + filesystem: + persistence: + enabled: true + size: 5Gi + accessMode: ReadWriteMany + storageClass: longhorn + persistentWorkers: true + clickhouse: + clickhouse: + persistentVolumeClaim: + enabled: true + dataPersistentVolume: + storage: 20Gi + storageClassName: longhorn + accessModes: + - ReadWriteMany + - ReadWriteOnce + zookeeper: + persistence: + enabled: true + size: 8Gi + accessModes: + - ReadWriteMany + - ReadWriteOnce + storageClass: longhorn + redis: + master: + persistence: + enabled: true + size: 5Gi + accessModes: + - ReadWriteOnce + - ReadWriteMany + storageClass: longhorn + replica: + persistence: + enabled: true + size: 5Gi + accessModes: + - ReadWriteOnce + - ReadWriteMany + storageClass: longhorn + postgresql: + enabled: false + externalPostgresql: + port: 5432 + username: sentry + password: ENC[AES256_GCM,data:poj0izLlXR7y6xZI8CHrXV/COL6q8kUvNNs5hEr2/LXveA4YKF1zlQMELUOzMyUwHvovjTBoKXEy9UQ2Rrf/WQ==,iv:U/c72XqWoeKflHx5sWKP/iz1ZMLdS1SmjW0fQKr/jlo=,tag:Mnu9FLOjXcIYQoX0eJQmHA==,type:str] + database: sentry + connMaxAge: 600 + host: pg-cluster-v2-rw.postgres-cluster.svc.cluster.local + sslMode: require + rabbitmq: + enabled: false + kafka: + controller: + persistence: + enabled: true + size: 10Gi + accessModes: + - ReadWriteMany + - ReadWriteOnce + storageClass: longhorn + logPersistence: + enabled: false +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhQXBKUG1SWmliSUU2Z1Rn + dWdlTTVkbUllcXVxbzhQMnVBNzhHNzJETEdnCjdVZ1crSjROT1lnM0cweWcrUzZF + cThwQW44TGNQUDkrdU5PNTZIc3laTzQKLS0tIEkzQnFUdTZteGxpNElHYXlxbjdZ + Y3BhYXZ4RmpHcUpEQ2ZSK3NZUEtwekEKfudmrfTPHxLJtILnz3B7/uWKwBgrIE3W + lchyeAAESQ9KFFnYuCaKuIvxM48x1KLN4LkrWnV4BPWCsx6wryV6fA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2025-12-16T11:05:34Z" + mac: ENC[AES256_GCM,data:hxsmpfgd4CQs7eY9iYyn066NXd0nqdm/WRNuNV9LdgoBR2gdyI9t/a3JOoc5gNXC+qQyIG86VUpVkMUiiHZBFkgMqk65DAeoupat1d6pZ7+4G0YJWRTRWNmNrQe0eSdLx0Bg1xyxuN8tkYZnmg/yWPvj/EDzHOdcUQCUMthz02A=,iv:tNoFVh1X0OsiW9yMTsJauekxEl7R9RBxQgQ4t6HiB3M=,tag:DBYh6FgHcG9EtEx2JiPhdA==,type:str] + pgp: [] + encrypted_regex: ^(harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$ + version: 3.9.1 diff --git a/apps/talos_cluster/sentry/repository.yaml b/apps/talos_cluster/sentry/repository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: sentry + namespace: sentry +spec: + interval: 60m + url: https://sentry-kubernetes.github.io/charts diff --git a/apps/talos_cluster/sentry/route.yaml b/apps/talos_cluster/sentry/route.yaml @@ -0,0 +1,32 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: sentry + namespace: sentry +spec: + parentRefs: + - name: envoy-gateway + namespace: envoy-gateway + hostnames: + - sentry.mtrnord.blog + rules: + - backendRefs: + - name: sentry-nginx + port: 80 + timeouts: + request: 240s + backendRequest: 0s +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: BackendTrafficPolicy +metadata: + name: sentry-compression + namespace: sentry +spec: + targetRef: + group: gateway.networking.k8s.io + kind: HTTPRoute + name: sentry + compression: + - type: Gzip + - type: Brotli