A ton of tweaks to fully spin up cluster from zero

kubernetes/atuin/Namespace-atuin.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: atuin

kubernetes/atuin/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
 - VaultAuth.yaml
 - VaultStaticSecret-postgres-atuin.yaml
 - deployment.yaml
+- Namespace-atuin.yaml

kubernetes/authentik/Namespace-authentik.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik

kubernetes/authentik/kustomization.yaml

@@ -13,3 +13,4 @@ resources:
 - VaultAuth.yaml
 - VaultStaticSecret-postgres-authentik.yaml
 - VaultStaticSecret-authentik-secrets.yaml
+- Namespace-authentik.yaml

kubernetes/cert-manager/Namespace-cert-manager.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/cert-manager/kustomization.yaml

@@ -4,3 +4,7 @@ namespace: cert-manager
 resources:
 - VaultAuth.yaml
 - VaultStaticSecret-cloudflare-cert-api.yaml
+- ClusterIssuer-cloudflare.yaml
+- https://github.com/cert-manager/cert-manager/releases/download/v1.15.1/cert-manager.yaml
+patches:
+- path: Namespace-cert-manager.yaml

kubernetes/cloudflare/Namespace-cloudflare.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudflare

kubernetes/cloudflare/config.yaml

@@ -12,7 +12,7 @@ ingress:
 - hostname: authentik.gmem.ca
   service: https://homelab.gmem.ca
 - hostname: nitter.gmem.ca
-  service: https://homelab.gmem.ca
+  service: http://nitter.nitter.svc.cluster.local:8081
 - hostname: git.gmem.ca
   service: https://homelab.gmem.ca
 - hostname: proxmox.gmem.ca

kubernetes/cloudflare/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
 - VaultAuth.yaml
 - VaultStaticSecret-tunnel-credentials.yaml
 - VaultStaticSecret-cloudflare-exporter.yaml
+- Namespace-cloudflare.yaml
 
 configMapGenerator:
 - name: cloudflared
@@ -27,3 +28,4 @@ helmCharts:
       labels:
         release: prometheus
   version: 0.2.1
+

kubernetes/duplikate/Namespace-duplikate.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: duplikate

kubernetes/duplikate/kustomization.yaml

@@ -18,3 +18,4 @@ resources:
 - Deployment-duplikate.yaml
 - VaultAuth.yaml
 - VaultStaticSecret-duplikate.yaml
+- Namespace-duplikate.yaml

kubernetes/e6-gallery/Namespace-e6-gallery.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: e6-gallery

kubernetes/e6-gallery/VaultStaticSecret-regcred.yaml

@@ -7,6 +7,7 @@ spec:
   destination:
     create: true
     name: regcred
+    type: kubernetes.io/dockerconfigjson
   mount: kv
   path: e6-gallery/regcred
   refreshAfter: 30s

kubernetes/e6-gallery/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
 - VaultAuth.yaml
 - VaultStaticSecret-regcred.yaml
 - e6-gallery.yaml
+- Namespace-e6-gallery.yaml

kubernetes/endpoints/Endpoints-photos.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: photos
+  namespace: endpoints
+subsets:
+- addresses:
+  - ip: 192.168.50.229
+  ports:
+  - name: photos
+    port: 443
+    protocol: TCP

kubernetes/endpoints/Ingress-photos.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+    nginx.ingress.kubernetes.io/proxy-body-size: 10g
+  name: photos
+  namespace: endpoints
+spec:
+  rules:
+  - host: photos.gmem.ca
+    http:
+      paths:
+      - backend:
+          service:
+            name: photos
+            port:
+              number: 443
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - photos.gmem.ca

kubernetes/endpoints/Namespace-endpoints.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: endpoints

kubernetes/endpoints/Service-photos.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: photos
+  namespace: endpoints
+spec:
+  ports:
+  - name: photos
+    port: 443
+    targetPort: 443

kubernetes/endpoints/kustomization.yaml

@@ -6,16 +6,20 @@ resources:
 - Endpoints-ibiza.yaml
 - Endpoints-proxmox.yaml
 - Endpoints-tokyo.yaml
+- Endpoints-photos.yaml
 - Service-austin.yaml
 - Service-git.yaml
 - Service-ibiza.yaml
 - Service-proxmox.yaml
 - Service-tokyo.yaml
+- Service-photos.yaml
 - Ingress-austin.yaml
 - Ingress-git.yaml
 - Ingress-ibiza.yaml
 - Ingress-proxmox.yaml
 - Ingress-tokyo.yaml
+- Ingress-photos.yaml
 - Endpoints-secrets.yaml
 - Ingress-secrets.yaml
 - Service-secrets.yaml
+- Namespace-endpoints.yaml

kubernetes/homepage/Namespace-homepage.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: homepage

kubernetes/homepage/kustomization.yaml

@@ -14,3 +14,4 @@ patches:
 resources:
 - ./VaultStaticSecret-homepage-config.yaml
 - ./VaultAuth.yaml
+- Namespace-homepage.yaml

kubernetes/ingress-nginx/Namespace-ingress-nginx.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/ingress-nginx/kustomization.yaml

@@ -10,3 +10,5 @@ helmCharts:
 kind: Kustomization
 namespace: ingress-nginx
 
+resources:
+- Namespace-ingress-nginx.yaml

kubernetes/ingress-nginx/nginx.yaml

@@ -1,5 +1,11 @@
 controller:
   kind: DaemonSet
+  config:
+    enable-real-ip: "true"
+    use-proxy-protocol: "true"
+    enable-brotli: "true"
+    proxy-send-timeout: "30"
+    proxy-read-timeout: "30"
   metrics:
     enabled: true
     serviceMonitor:

kubernetes/irc/Namespace-irc.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: irc

kubernetes/irc/kustomization.yaml

@@ -14,8 +14,10 @@ resources:
 - VaultAuth.yaml
 - VaultStaticSecret-postgres-soju.yaml
 - VaultStaticSecret-soju.yaml
+- Namespace-irc.yaml
 
 configMapGenerator:
   - name: soju
     files:
     - config.in
+

kubernetes/jellyseerr/ConfigMap-jellyseerr.yaml

@@ -0,0 +1,235 @@
+apiVersion: v1
+data:
+  DB_HOST: 192.168.50.236
+  DB_TYPE: postgres
+  DB_USER: jellyseerr
+  settings.json: |
+    {
+     "clientId": "a54f0b33-d4d3-4c23-962f-8cd912e9c19d",
+     "vapidPrivate": "j85uoYz8PoOdcFsZ15ePwqpJ2CqSB5BM_9wrdzDR2Oc",
+     "vapidPublic": "BCohD75wkSzbTF4WTLCWgQc7gstxaXVOlZ1SSjsGnloqsjdSrMr3FG_pM6l4YkiC710yhKRxtdIeD3BWLlU2YGY",
+     "main": {
+      "apiKey": "MTcxNDMxNzE2NDkyMGMyODczOWFkLWY2OTgtNGZmYy04NmUzLTg0YjVkZjhhNTQ5NA==",
+      "applicationTitle": "Jellyseerr",
+      "applicationUrl": "",
+      "csrfProtection": false,
+      "cacheImages": false,
+      "defaultPermissions": 32,
+      "defaultQuotas": {
+       "movie": {},
+       "tv": {}
+      },
+      "hideAvailable": false,
+      "localLogin": true,
+      "newPlexLogin": true,
+      "region": "",
+      "originalLanguage": "",
+      "trustProxy": false,
+      "mediaServerType": 1,
+      "partialRequestsEnabled": true,
+      "locale": "en"
+     },
+     "plex": {
+      "name": "vancouver",
+      "ip": "192-168-50-229.9fbcf035272d41dfa381c69090233d0c.plex.direct",
+      "port": 32400,
+      "useSsl": true,
+      "libraries": [
+       {
+        "id": "1",
+        "name": "Movies",
+        "enabled": true,
+        "type": "movie",
+        "lastScan": 1714317300613
+       },
+       {
+        "id": "2",
+        "name": "TV Shows",
+        "enabled": true,
+        "type": "show",
+        "lastScan": 1714317300676
+       }
+      ],
+      "machineId": "b719ba766ebd77c763e95b5a9ae3cb818f7da290"
+     },
+     "jellyfin": {
+      "name": "",
+      "hostname": "",
+      "externalHostname": "",
+      "jellyfinForgotPasswordUrl": "",
+      "libraries": [],
+      "serverId": ""
+     },
+     "tautulli": {},
+     "radarr": [
+      {
+       "name": "Radarr",
+       "hostname": "192.168.50.187",
+       "port": 7878,
+       "apiKey": "2818686b8ed44f878bd964512fc6a183",
+       "useSsl": false,
+       "baseUrl": "",
+       "activeProfileId": 4,
+       "activeProfileName": "HD-1080p",
+       "activeDirectory": "/media/movies",
+       "is4k": false,
+       "minimumAvailability": "released",
+       "tags": [],
+       "isDefault": true,
+       "syncEnabled": false,
+       "preventSearch": false,
+       "tagRequests": true,
+       "id": 0
+      }
+     ],
+     "sonarr": [
+      {
+       "name": "Sonarr",
+       "hostname": "192.168.50.187",
+       "port": 8989,
+       "apiKey": "5d8fa991e831479f97dd03cc7532a697",
+       "useSsl": false,
+       "baseUrl": "",
+       "activeProfileId": 4,
+       "activeLanguageProfileId": 1,
+       "activeProfileName": "HD-1080p",
+       "activeDirectory": "/media/tvshows",
+       "tags": [],
+       "animeTags": [],
+       "is4k": false,
+       "isDefault": true,
+       "enableSeasonFolders": false,
+       "syncEnabled": false,
+       "preventSearch": false,
+       "tagRequests": true,
+       "id": 0
+      }
+     ],
+     "public": {
+      "initialized": true
+     },
+     "notifications": {
+      "agents": {
+       "email": {
+        "enabled": false,
+        "options": {
+         "userEmailRequired": false,
+         "emailFrom": "",
+         "smtpHost": "",
+         "smtpPort": 587,
+         "secure": false,
+         "ignoreTls": false,
+         "requireTls": false,
+         "allowSelfSigned": false,
+         "senderName": "Jellyseerr"
+        }
+       },
+       "discord": {
+        "enabled": false,
+        "types": 0,
+        "options": {
+         "webhookUrl": "",
+         "enableMentions": true
+        }
+       },
+       "lunasea": {
+        "enabled": false,
+        "types": 0,
+        "options": {
+         "webhookUrl": ""
+        }
+       },
+       "slack": {
+        "enabled": false,
+        "types": 0,
+        "options": {
+         "webhookUrl": ""
+        }
+       },
+       "telegram": {
+        "enabled": false,
+        "types": 0,
+        "options": {
+         "botAPI": "",
+         "chatId": "",
+         "sendSilently": false
+        }
+       },
+       "pushbullet": {
+        "enabled": false,
+        "types": 0,
+        "options": {
+         "accessToken": ""
+        }
+       },
+       "pushover": {
+        "enabled": false,
+        "types": 0,
+        "options": {
+         "accessToken": "",
+         "userToken": "",
+         "sound": ""
+        }
+       },
+       "webhook": {
+        "enabled": false,
+        "types": 0,
+        "options": {
+         "webhookUrl": "",
+         "jsonPayload": "IntcbiAgXCJub3RpZmljYXRpb25fdHlwZVwiOiBcInt7bm90aWZpY2F0aW9uX3R5cGV9fVwiLFxuICBcImV2ZW50XCI6IFwie3tldmVudH19XCIsXG4gIFwic3ViamVjdFwiOiBcInt7c3ViamVjdH19XCIsXG4gIFwibWVzc2FnZVwiOiBcInt7bWVzc2FnZX19XCIsXG4gIFwiaW1hZ2VcIjogXCJ7e2ltYWdlfX1cIixcbiAgXCJ7e21lZGlhfX1cIjoge1xuICAgIFwibWVkaWFfdHlwZVwiOiBcInt7bWVkaWFfdHlwZX19XCIsXG4gICAgXCJ0bWRiSWRcIjogXCJ7e21lZGlhX3RtZGJpZH19XCIsXG4gICAgXCJ0dmRiSWRcIjogXCJ7e21lZGlhX3R2ZGJpZH19XCIsXG4gICAgXCJzdGF0dXNcIjogXCJ7e21lZGlhX3N0YXR1c319XCIsXG4gICAgXCJzdGF0dXM0a1wiOiBcInt7bWVkaWFfc3RhdHVzNGt9fVwiXG4gIH0sXG4gIFwie3tyZXF1ZXN0fX1cIjoge1xuICAgIFwicmVxdWVzdF9pZFwiOiBcInt7cmVxdWVzdF9pZH19XCIsXG4gICAgXCJyZXF1ZXN0ZWRCeV9lbWFpbFwiOiBcInt7cmVxdWVzdGVkQnlfZW1haWx9fVwiLFxuICAgIFwicmVxdWVzdGVkQnlfdXNlcm5hbWVcIjogXCJ7e3JlcXVlc3RlZEJ5X3VzZXJuYW1lfX1cIixcbiAgICBcInJlcXVlc3RlZEJ5X2F2YXRhclwiOiBcInt7cmVxdWVzdGVkQnlfYXZhdGFyfX1cIixcbiAgICBcInJlcXVlc3RlZEJ5X3NldHRpbmdzX2Rpc2NvcmRJZFwiOiBcInt7cmVxdWVzdGVkQnlfc2V0dGluZ3NfZGlzY29yZElkfX1cIixcbiAgICBcInJlcXVlc3RlZEJ5X3NldHRpbmdzX3RlbGVncmFtQ2hhdElkXCI6IFwie3tyZXF1ZXN0ZWRCeV9zZXR0aW5nc190ZWxlZ3JhbUNoYXRJZH19XCJcbiAgfSxcbiAgXCJ7e2lzc3VlfX1cIjoge1xuICAgIFwiaXNzdWVfaWRcIjogXCJ7e2lzc3VlX2lkfX1cIixcbiAgICBcImlzc3VlX3R5cGVcIjogXCJ7e2lzc3VlX3R5cGV9fVwiLFxuICAgIFwiaXNzdWVfc3RhdHVzXCI6IFwie3tpc3N1ZV9zdGF0dXN9fVwiLFxuICAgIFwicmVwb3J0ZWRCeV9lbWFpbFwiOiBcInt7cmVwb3J0ZWRCeV9lbWFpbH19XCIsXG4gICAgXCJyZXBvcnRlZEJ5X3VzZXJuYW1lXCI6IFwie3tyZXBvcnRlZEJ5X3VzZXJuYW1lfX1cIixcbiAgICBcInJlcG9ydGVkQnlfYXZhdGFyXCI6IFwie3tyZXBvcnRlZEJ5X2F2YXRhcn19XCIsXG4gICAgXCJyZXBvcnRlZEJ5X3NldHRpbmdzX2Rpc2NvcmRJZFwiOiBcInt7cmVwb3J0ZWRCeV9zZXR0aW5nc19kaXNjb3JkSWR9fVwiLFxuICAgIFwicmVwb3J0ZWRCeV9zZXR0aW5nc190ZWxlZ3JhbUNoYXRJZFwiOiBcInt7cmVwb3J0ZWRCeV9zZXR0aW5nc190ZWxlZ3JhbUNoYXRJZH19XCJcbiAgfSxcbiAgXCJ7e2NvbW1lbnR9fVwiOiB7XG4gICAgXCJjb21tZW50X21lc3NhZ2VcIjogXCJ7e2NvbW1lbnRfbWVzc2FnZX19XCIsXG4gICAgXCJjb21tZW50ZWRCeV9lbWFpbFwiOiBcInt7Y29tbWVudGVkQnlfZW1haWx9fVwiLFxuICAgIFwiY29tbWVudGVkQnlfdXNlcm5hbWVcIjogXCJ7e2NvbW1lbnRlZEJ5X3VzZXJuYW1lfX1cIixcbiAgICBcImNvbW1lbnRlZEJ5X2F2YXRhclwiOiBcInt7Y29tbWVudGVkQnlfYXZhdGFyfX1cIixcbiAgICBcImNvbW1lbnRlZEJ5X3NldHRpbmdzX2Rpc2NvcmRJZFwiOiBcInt7Y29tbWVudGVkQnlfc2V0dGluZ3NfZGlzY29yZElkfX1cIixcbiAgICBcImNvbW1lbnRlZEJ5X3NldHRpbmdzX3RlbGVncmFtQ2hhdElkXCI6IFwie3tjb21tZW50ZWRCeV9zZXR0aW5nc190ZWxlZ3JhbUNoYXRJZH19XCJcbiAgfSxcbiAgXCJ7e2V4dHJhfX1cIjogW11cbn0i"
+        }
+       },
+       "webpush": {
+        "enabled": false,
+        "options": {}
+       },
+       "gotify": {
+        "enabled": false,
+        "types": 0,
+        "options": {
+         "url": "",
+         "token": ""
+        }
+       }
+      }
+     },
+     "jobs": {
+      "plex-recently-added-scan": {
+       "schedule": "0 */5 * * * *"
+      },
+      "plex-full-scan": {
+       "schedule": "0 0 3 * * *"
+      },
+      "plex-watchlist-sync": {
+       "schedule": "0 */10 * * * *"
+      },
+      "radarr-scan": {
+       "schedule": "0 0 4 * * *"
+      },
+      "sonarr-scan": {
+       "schedule": "0 30 4 * * *"
+      },
+      "availability-sync": {
+       "schedule": "0 0 5 * * *"
+      },
+      "download-sync": {
+       "schedule": "0 * * * * *"
+      },
+      "download-sync-reset": {
+       "schedule": "0 0 1 * * *"
+      },
+      "jellyfin-recently-added-scan": {
+       "schedule": "0 */5 * * * *"
+      },
+      "jellyfin-full-scan": {
+       "schedule": "0 0 3 * * *"
+      },
+      "image-cache-cleanup": {
+       "schedule": "0 0 5 * * *"
+      }
+     }
+    }
+kind: ConfigMap
+metadata:
+  name: jellyseerr
+  namespace: jellyseerr

kubernetes/jellyseerr/Namespace-jellyseerr.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jellyseerr

kubernetes/jellyseerr/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
 - VaultAuth.yaml
 - VaultStaticSecret-jellyseerr.yaml
 - ConfigMap-jellyseerr.yaml
+- Namespace-jellyseerr.yaml

kubernetes/kustomization.yaml

@@ -26,3 +26,4 @@ resources:
 - vault-secrets-operator
 - vaultwarden
 - smarthome
+- cert-manager

kubernetes/librespeed/Namespace-librespeed.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: librespeed

kubernetes/librespeed/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
 - Deployment-librespeed.yaml
 - Service-librespeed.yaml
 - Ingress-librespeed.yaml
+- Namespace-librespeed.yaml

kubernetes/metube/Namespace-metube.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metube

kubernetes/metube/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
 - Deployment-metube.yaml
 - Service-metube.yaml
 - Ingress-metube.yaml
+- Namespace-metube.yaml

kubernetes/minecraft-invites/Namespace-minecraft-invites.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: minecraft-invites

kubernetes/minecraft-invites/VaultStaticSecret-whitelistmanager.yaml

@@ -8,7 +8,7 @@ spec:
     create: true
     name: whitelistmanager
   mount: kv
-  path: whitelistmanager/whitelistmanager
+  path: minecraft-invites/whitelistmanager
   refreshAfter: 30s
   type: kv-v2
   vaultAuthRef: vault

kubernetes/minecraft-invites/kustomization.yaml

@@ -8,3 +8,4 @@ resources:
 - Ingress-whitelistmanager.yaml
 - VaultAuth.yaml
 - VaultStaticSecret-whitelistmanager.yaml
+- Namespace-minecraft-invites.yaml

kubernetes/miniflux/Namespace-miniflux.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: miniflux

kubernetes/miniflux/kustomization.yaml

@@ -1,5 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+
+namespace: miniflux
+
 resources:
 - Deployment-miniflux.yaml
 - Service-miniflux.yaml
@@ -7,6 +10,7 @@ resources:
 - Ingress-miniflux.yaml
 - VaultAuth.yaml
 - VaultStaticSecret-miniflux.yaml
+- Namespace-miniflux.yaml
 
 configMapGenerator:
 - name: miniflux

kubernetes/misc/CronJob-router-cert.yaml

@@ -0,0 +1,101 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: router-cert
+  namespace: default
+spec:
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          volumes:
+          - secret:
+              secretName: router-gmem-ca
+            name: cert
+          containers:
+            - command:
+                - /bin/bash
+                - -c
+                - >
+                  apt update && apt install -y curl
+
+                  curl "https://healthchecks.gmem.ca/ping/${HEALTHCHECKS_UUID}/start"
+
+                  export LOGIN=$(echo -n "${LOGIN_USERNAME}:${LOGIN_PASSWORD}" | base64 -w0)
+
+                  curl "https://${BASE_URL}/login.cgi"
+                  -H "Content-Type: application/x-www-form-urlencoded"
+                  -H "Referer: https://${BASE_URL}/Main_Login.asp"
+                  --data-urlencode "login_authorization=${LOGIN}"
+                  -c /tmp/cookie.txt -k
+
+                  curl "https://${BASE_URL}/upload_cert_key.cgi"
+                  -H "Referer: https://${BASE_URL}/Advanced_ASUSDDNS_Content.asp"
+                  -F "file_key=@/data/tls.key"
+                  -F "file_cert=@/data/tls.crt"
+                  -F "le_enable=2"
+                  -b /tmp/cookie.txt -k
+
+                  curl "https://${BASE_URL}/Logout.asp"
+                  -H "Referer: https://${BASE_URL}/index.asp"
+                  -b /tmp/cookie.txt -k
+
+                  curl "https://healthchecks.gmem.ca/ping/${HEALTHCHECKS_UUID}"
+              envFrom:
+                - configMapRef:
+                    name: router-cert
+                - secretRef:
+                    name: router-cert
+              image: debian:bookworm-slim
+              name: upload-certificate
+              volumeMounts:
+              - mountPath: /data
+                name: cert
+          restartPolicy: Never
+  schedule: "0 0 1 * *"
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: router-gmem-ca
+  namespace: default
+spec:
+  # Secret names are always required.
+  secretName: router-gmem-ca
+
+  duration: 2160h # 90d
+  renewBefore: 360h # 15d
+
+  dnsNames:
+    - router.gmem.ca
+  issuerRef:
+    name: le-issuer
+    # We can reference ClusterIssuers by changing the kind here.
+    # The default value is Issuer (i.e. a locally namespaced Issuer)
+    kind: ClusterIssuer
+    # This is optional since cert-manager will default to this value however
+    # if you are using an external issuer, change this to that issuer group.
+    group: cert-manager.io
+---
+apiVersion: v1
+data:
+  BASE_URL: router.gmem.ca
+kind: ConfigMap
+metadata:
+  name: router-cert
+  namespace: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: router-cert
+  namespace: default
+spec:
+  destination:
+    create: true
+    name: router-cert
+  mount: kv
+  path: default/router-cert
+  refreshAfter: 30s
+  type: kv-v2
+  vaultAuthRef: vault

kubernetes/misc/Namespace-misc.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ntfy
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: it-tools

kubernetes/misc/VaultAuth.yaml

@@ -0,0 +1,11 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: vault
+  namespace: default
+spec:
+  kubernetes:
+    role: reader
+    serviceAccount: default
+  method: kubernetes
+  mount: kubernetes

kubernetes/misc/kustomization.yaml

@@ -1,7 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- issuer.yml
 - nginx-podmonitor.yml
 - ntfy.yaml
 - tools.yml
+- Namespace-misc.yaml
+- VaultAuth.yaml
+- CronJob-router-cert.yaml

kubernetes/nfs-subdir-external-provisioner/Namespace-nfs-subdir-external-provisioner.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nfs-subdir-external-provisioner

kubernetes/nfs-subdir-external-provisioner/kustomization.yaml

@@ -9,3 +9,5 @@ helmCharts:
   version: 4.0.18
 kind: Kustomization
 namespace: nfs-subdir-external-provisioner
+resources:
+- Namespace-nfs-subdir-external-provisioner.yaml

kubernetes/nitter/Namespace-nitter.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nitter

kubernetes/nitter/StatefulSet-nitter-bot.yaml

@@ -23,7 +23,7 @@ spec:
         - secretRef:
             name: nitter-bot
         - configMapRef:
-            name: nitter-bot-5d9aefaae4
+            name: nitter-bot
         image: git.gmem.ca/arch/nitter-bot:latest
         name: nitter-bot
         resources:

kubernetes/nitter/kustomization.yaml

@@ -13,6 +13,7 @@ resources:
 - VaultStaticSecret-nitter.yaml
 - ConfigMap-nitter.yaml
 - ConfigMap-nitter-bot.yaml
+- Namespace-nitter.yaml
 
 helmCharts:
 - name: redis

kubernetes/piped/Namespace-piped.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: piped

kubernetes/piped/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
 - CronJob-piped-refresh.yaml
 - VaultAuth.yaml
 - VaultStaticSecret-postgres-piped.yaml
+- Namespace-piped.yaml

kubernetes/prometheus/Namespace-prometheus.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prometheus
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/prometheus/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
 - VaultStaticSecret-nextdns-exporter.yaml
 - VaultStaticSecret-nextdns-ts-exporter.yaml
 - VaultStaticSecret-prometheus-remote-basic-auth.yaml
+- Namespace-prometheus.yaml

kubernetes/redlib/Namespace-redlib.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: redlib

kubernetes/redlib/kustomization.yaml

@@ -4,4 +4,4 @@ resources:
 - Deployment-redlib.yaml
 - Service-redlib.yaml
 - Ingress-redlib.yaml
-
+- Namespace-redlib.yaml

kubernetes/searxng/Namespace-searxng.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: searxng

kubernetes/searxng/kustomization.yaml

@@ -23,9 +23,11 @@ resources:
 - Ingress-searxng.yaml
 - VaultAuth.yaml
 - VaultStaticSecret-searxng.yaml
+- Namespace-searxng.yaml
 
 configMapGenerator:
 - name: searxng
   files:
   - limiter.toml
   - settings.yml
+

kubernetes/smarthome/Namespace-smarthome.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: smarthome
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/smarthome/kustomization.yaml

@@ -8,3 +8,4 @@ resources:
 - hue.yaml
 - VaultAuth.yaml
 - VaultStaticSecret-hue.yaml
+- Namespace-smarthome.yaml

kubernetes/tclip/Namespace-tclip.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tclip

kubernetes/tclip/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
 - Ingress-tclip.yaml
 - VaultAuth.yaml
 - VaultStaticSecret-tclip.yaml
+- Namespace-tclip.yaml

kubernetes/vault-secrets-operator/Namespace-vault-secrets-operator.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vault-secrets-operator
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/vault-secrets-operator/crb.yaml

@@ -23,4 +23,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: vault-auth
-    namespace: default
+    namespace: vault-secrets-operator

kubernetes/vault-secrets-operator/kustomization.yaml

@@ -18,4 +18,4 @@ kind: Kustomization
 namespace: vault-secrets-operator
 resources:
 - ./crb.yaml
-
+- Namespace-vault-secrets-operator.yaml

kubernetes/vault-secrets-operator/tokenreview.yaml

@@ -0,0 +1,7 @@
+apiVersion: authentication.k8s.io/v1
+kind: TokenReview
+metadata:
+  name: test
+spec:
+  audiences: []
+  token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImpXVFI3MGdGTmJkRHN3MUVqdTNpOTZPeXZHNk1sNzYtS09pOTJwc09OdkEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJ2YXVsdC1zZWNyZXRzLW9wZXJhdG9yIiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6InZhdWx0LWF1dGgiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC5uYW1lIjoidmF1bHQtYXV0aCIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50LnVpZCI6IjQzNjdmMjBjLWZlOTAtNDIxMy04YmM2LTcwYjZiYThmNzJmYSIsInN1YiI6InN5c3RlbTpzZXJ2aWNlYWNjb3VudDp2YXVsdC1zZWNyZXRzLW9wZXJhdG9yOnZhdWx0LWF1dGgifQ.SlQ3GUc9RUicbmcsH-qMzw231mansaG2OE-kZwLaYGyoFYNSt-kwW-GaUUdCQ3rB7fz4yADM_SCbOyczYGmhtm5hEUJxs4Vp_171RP8xfvphrbeGUxd5e5e0hv5vDFXtWQxLCkSwZX8sWymSpj01ujEqW9fJgDl9zGYsg7Yf94YaEEynYpU2ClamiFuPsmzu2yARYZEOaSTV_zq6TDjt6dojB63e5wYVODuJr_rOU1TNniQrL9SHBnIwFYTwM24cYP16rG8deV_yUaJE8BCTEUPXFv_vyh-RU3sQWQ1RuuCoDmxZqcQ5yiZ7dW7wcdP6FjKzbkrXB5Y7gni8Zl0WmIgJfZegnQktJIiHFZQaJAOE7V4b-NvYG6jb3HqtvtyHHXs92BS4jj9_B_M2TJb4Vv4fB7Y0v1ev39uOmMsPNkqp_SIhyOrlrjz7bvQAwcE9g5ew7QuNtcJN1ljF9s7dVJes8gjQjoOwKrk-S9GlLSPFk5jqt8e6WS85LO-3_hNliKECCWZar2z0L1SVOU7yrdguoH4ydligBwVemKotydnnmcYh6vdZOjhW5ZNoQwjclHDhTggCMvmWMuTnTRL-z_S8o2jYjmBEuo6EbTqgoT1NXmp8miT9mYkgE8JMM7IP-CD_HMfIYEWoKWRpwUX5SRkub6rELgMNVT6Xge_uQPk"

kubernetes/vaultwarden/Namespace-vaultwarden.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vaultwarden

kubernetes/vaultwarden/deployment.yaml

@@ -18,8 +18,7 @@ spec:
           emptyDir: {}
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:testing
-          imagePullPolicy: Always
+          image: vaultwarden/server:1.31.0
           resources:
             limits:
               memory: "128Mi"
@@ -37,6 +36,8 @@ spec:
           env:
             - name: LOG_LEVEL
               value: debug
+            - name: ROCKET_ADDRESS
+              value: "::"
           ports:
             - containerPort: 80
               name: web

kubernetes/vaultwarden/kustomization.yaml

@@ -7,8 +7,10 @@ resources:
 - VaultAuth.yaml
 - VaultStaticSecret-vaultwarden.yaml
 - deployment.yaml
+- Namespace-vaultwarden.yaml
 
 configMapGenerator:
 - name: vaultwarden
   envs:
   - vaultwarden.env
+

kubernetes/vrchat/Namespace-vrchat.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vrchat

kubernetes/vrchat/VaultStaticSecret-vrchat-prometheus-adapter.yaml

@@ -8,7 +8,7 @@ spec:
     create: true
     name: vrchat-prometheus-adapter
   mount: kv
-  path: vrchat-prometheus-adapter
+  path: vrchat/vrchat-prometheus-adapter
   refreshAfter: 30s
   type: kv-v2
   vaultAuthRef: vault

kubernetes/vrchat/kustomization.yaml

@@ -8,8 +8,10 @@ resources:
 - Service-vrchat-prometheus-adapter.yaml
 - ServiceMonitor-vrchat-prometheus-adapter.yaml
 - VaultAuth.yaml
-
+- Namespace-vrchat.yaml
+- VaultStaticSecret-vrchat-prometheus-adapter.yaml
 configMapGenerator:
 - name: vrchat-prometheus-adapter
   files:
   - config.toml
+