Update Helm release longhorn to v1.8.1

apps-kustomized/1password-connect/deploy.yaml

@@ -46,7 +46,7 @@ spec:
           value: "8080"
         - name: OP_LOG_LEVEL
           value: info
-        image: 1password/connect-api:1.7.3
+        image: 1password/connect-api:1.7.2
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
@@ -92,7 +92,7 @@ spec:
           value: localhost:11220
         - name: OP_LOG_LEVEL
           value: info
-        image: 1password/connect-sync:1.7.3
+        image: 1password/connect-sync:1.7.2
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

apps-kustomized/external-dns/deploy.yaml

@@ -1,12 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: external-dns
-spec:
-  template:
-    spec:
-      containers:
-      - name: external-dns
-        envFrom:
-          - secretRef:
-              name: dnsimple-auth

apps-kustomized/external-dns/kustomization.yaml

@@ -3,16 +3,12 @@ kind: Kustomization
 
 helmCharts:      
 - name: external-dns
-  repo: https://kubernetes-sigs.github.io/external-dns
-  version: 1.15.2
+  repo: https://charts.bitnami.com/bitnami
+  version: 6.28.4
   releaseName: external-dns
   namespace: external-dns
   valuesInline:
-    provider: 
-      name: dnsimple
+    provider: dnsimple
     txtPrefix: armnleg
-patches:
-- path: deploy.yaml
-  target:
-    kind: Deployment
-    name: external-dns
+    sources: [service,ingress]
+    extraEnvVarsSecret: dnsimple-auth

apps-kustomized/files-web/ing.yaml

@@ -1,23 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
-    nginx.ingress.kubernetes.io/proxy-body-size: 700m
-  name: web-s3
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: files.martyn.berlin
-    http:
-      paths:
-      - backend:
-          service:
-            name: s3-nginx
-            port:
-              number: 80
-        path: /
-        pathType: Prefix
-  tls:
-  - hosts:
-    - files.martyn.berlin

apps-kustomized/files-web/nginx.yaml

@@ -1,27 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: s3-nginx
-  name: s3-nginx
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: s3-nginx
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app: s3-nginx
-    spec:
-      containers:
-      - image: nginx:1.27.4
-        name: nginx
-        volumeMounts:
-        - mountPath: /usr/share/nginx/html
-          name: s3
-      volumes:
-      - name: s3
-        persistentVolumeClaim:
-          claimName: smb-s3

apps-kustomized/files-web/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: smb-s3
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: smb-s3

apps-kustomized/files-web/svc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: s3-nginx
-  name: s3-nginx
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-  - port: 80
-  selector:
-    app: s3-nginx

apps-kustomized/lms/pvc.yaml

@@ -12,6 +12,18 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
+metadata:
+  name: smb-oldmusic
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: smb-oldmusic
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: logitech-media-server-config
 spec:

apps-kustomized/lms/statefulset.yaml

@@ -61,26 +61,29 @@ spec:
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
         volumeMounts:
+        - mountPath: /srv/squeezebox
+          name: config
+        - mountPath: /smbmusic
+          name: smbmusic
+        - mountPath: /smboldmusic
+          name: smboldmusic
+      dnsPolicy: ClusterFirst
+      initContainers:
+      - command:
+        - sh
+        - -c
+        - mkdir /smbmusic; mkdir -pv /config/playlists /config/config; chown -Rc 1000:1000
+          /config
+        image: doliana/logitech-media-server:2023_04_15-8.3.1
+        imagePullPolicy: IfNotPresent
+        name: init-config
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
         - mountPath: /config
           name: config
-        - mountPath: /music
-          name: smbmusic
-        - mountPath: /playlist
-          name: config
-          subPath: playlist
-      dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 1
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - talos-llu-kx3
       terminationGracePeriodSeconds: 30
       volumes:
       - name: config
@@ -89,6 +92,9 @@ spec:
       - name: smbmusic
         persistentVolumeClaim:
           claimName: smb-music
+      - name: smboldmusic
+        persistentVolumeClaim:
+          claimName: smb-oldmusic
   updateStrategy:
     rollingUpdate:
       partition: 0

apps-kustomized/mosquitto/deploy.yaml

@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/name: mosquitto
     spec:
       containers:
-      - image: eclipse-mosquitto:1.6.15
+      - image: eclipse-mosquitto:1.6.12
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

apps-kustomized/nvidiastuff/kustomization.yaml

@@ -10,7 +10,7 @@ helmCharts:
   includeCRDs: true
   namespace: nvidia-device-plugin
   releaseName:  nvidia-device-plugin
-  version: 0.17.1
+  version: 0.17.0
   repo: https://nvidia.github.io/k8s-device-plugin
   valuesInline:
     nodeSelector: "feature.node.kubernetes.io/pci-0300_10de_13c0_1569_13c0.present=true"

apps-kustomized/paperless-ngx/kustomization.yaml

@@ -1,62 +0,0 @@
-
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-helmCharts:      
-- name: paperless-ngx
-  repo: https://charts.gabe565.com
-  version: 0.24.1
-  releaseName: paperless-ngx
-  namespace: paperless-ngx
-  valuesInline:
-    persistence:
-      data:
-        enabled: "true"
-        size: "1Gi"
-        accessMode: ReadWriteOnce
-        storageClass: "longhorn-fast"
-      media:
-        enabled: "true"
-        size: "8Gi"
-        accessMode: ReadWriteOnce
-        storageClass: "longhorn-fast"
-      export:
-        enabled: "true"
-        size: "1Gi"
-        accessMode: ReadWriteOnce
-        storageClass: "longhorn-fast"
-      consume:
-        enabled: "true"
-        size: "1Gi"
-        accessMode: ReadWriteOnce
-        storageClass: "smb-scans"
-    service:
-      main:
-        type: LoadBalancer
-        annotations:
-          external-dns.alpha.kubernetes.io/hostname: "paperless.martyn.berlin"
-        ports:
-          http:
-            port: 8080
-    postgresql:
-      enabled: "true"
-      primary:
-        persistence:
-          enabled: "true"
-          storageClass: "longhorn-fast"
-    env:
-      TZ: "Europe/Berlin"
-    resources:
-      requests:
-        cpu: "25m"
-        memory: "511772986"
-    
-
-patches:
-  - target:
-      kind: Service
-      name: paperless-ngx
-    patch: |-
-      - op: replace
-        path: /spec/ports
-        value: [{"name":"http","port":80,"targetPort":"http","protocol":"TCP"}]

apps-kustomized/rook-cluster-ssd/blockpool-ssd.yaml

@@ -0,0 +1,9 @@
+apiVersion: ceph.rook.io/v1
+kind: CephBlockPool
+metadata:
+  name: replicapool-ssd
+  namespace: rook-ceph
+spec:
+  failureDomain: host
+  replicated:
+    size: 2

apps-kustomized/rook-cluster-ssd/cluster-ssd.yaml

@@ -0,0 +1,47 @@
+apiVersion: ceph.rook.io/v1
+kind: CephCluster
+metadata:
+  name: ssd-cluster
+  namespace: rook-ceph # namespace:cluster
+spec:
+  dataDirHostPath: /var/lib/rook-cluster-ssd
+  cephVersion:
+    image: quay.io/ceph/ceph:v18
+    allowUnsupported: true
+  mon:
+    count: 1
+    allowMultiplePerNode: true
+  mgr:
+    count: 1
+    allowMultiplePerNode: true
+  dashboard:
+    enabled: true
+  crashCollector:
+    disable: true
+  storage:
+    useAllNodes: false
+    useAllDevices: false
+    #deviceFilter:
+    nodes:
+    - name: "talos-7oq-vur"
+      devices:
+      - name: "sda"
+        config:
+          osdsPerDevice: "1"
+    - name: "talos-iqd-ysy"
+      devices:
+      - name: "sda"
+        config:
+          osdsPerDevice: "1"
+  monitoring:
+    enabled: false
+  healthCheck:
+    daemonHealth:
+      mon:
+        interval: 45s
+        timeout: 600s
+  priorityClassNames:
+    all: system-node-critical
+    mgr: system-cluster-critical
+  disruptionManagement:
+    managePodBudgets: true

apps-kustomized/rook-cluster-ssd/configmap.yaml

@@ -0,0 +1,13 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: rook-config-override
+  namespace: rook-ceph # namespace:cluster
+data:
+  config: |
+    [global]
+    osd_pool_default_size = 1
+    mon_warn_on_pool_no_redundancy = false
+    bdev_flock_retry = 20
+    bluefs_buffered_io = false
+    mon_data_avail_warn = 10

apps-kustomized/rook-cluster-ssd/deploy-toolbox.yaml

@@ -0,0 +1,130 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rook-ceph-tools
+  namespace: rook-ceph # namespace:cluster
+  labels:
+    app: rook-ceph-tools
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: rook-ceph-tools
+  template:
+    metadata:
+      labels:
+        app: rook-ceph-tools
+    spec:
+      dnsPolicy: ClusterFirstWithHostNet
+      containers:
+        - name: rook-ceph-tools
+          image: quay.io/ceph/ceph:v17.2.6
+          command:
+            - /bin/bash
+            - -c
+            - |
+              # Replicate the script from toolbox.sh inline so the ceph image
+              # can be run directly, instead of requiring the rook toolbox
+              CEPH_CONFIG="/etc/ceph/ceph.conf"
+              MON_CONFIG="/etc/rook/mon-endpoints"
+              KEYRING_FILE="/etc/ceph/keyring"
+
+              # create a ceph config file in its default location so ceph/rados tools can be used
+              # without specifying any arguments
+              write_endpoints() {
+                endpoints=$(cat ${MON_CONFIG})
+
+                # filter out the mon names
+                # external cluster can have numbers or hyphens in mon names, handling them in regex
+                # shellcheck disable=SC2001
+                mon_endpoints=$(echo "${endpoints}"| sed 's/[a-z0-9_-]\+=//g')
+
+                DATE=$(date)
+                echo "$DATE writing mon endpoints to ${CEPH_CONFIG}: ${endpoints}"
+                  cat <<EOF > ${CEPH_CONFIG}
+              [global]
+              mon_host = ${mon_endpoints}
+
+              [client.admin]
+              keyring = ${KEYRING_FILE}
+              EOF
+              }
+
+              # watch the endpoints config file and update if the mon endpoints ever change
+              watch_endpoints() {
+                # get the timestamp for the target of the soft link
+                real_path=$(realpath ${MON_CONFIG})
+                initial_time=$(stat -c %Z "${real_path}")
+                while true; do
+                  real_path=$(realpath ${MON_CONFIG})
+                  latest_time=$(stat -c %Z "${real_path}")
+
+                  if [[ "${latest_time}" != "${initial_time}" ]]; then
+                    write_endpoints
+                    initial_time=${latest_time}
+                  fi
+
+                  sleep 10
+                done
+              }
+
+              # read the secret from an env var (for backward compatibility), or from the secret file
+              ceph_secret=${ROOK_CEPH_SECRET}
+              if [[ "$ceph_secret" == "" ]]; then
+                ceph_secret=$(cat /var/lib/rook-ceph-mon/secret.keyring)
+              fi
+
+              # create the keyring file
+              cat <<EOF > ${KEYRING_FILE}
+              [${ROOK_CEPH_USERNAME}]
+              key = ${ceph_secret}
+              EOF
+
+              # write the initial config file
+              write_endpoints
+
+              # continuously update the mon endpoints if they fail over
+              watch_endpoints
+          imagePullPolicy: IfNotPresent
+          tty: true
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 2016
+            runAsGroup: 2016
+            capabilities:
+              drop: ["ALL"]
+          env:
+            - name: ROOK_CEPH_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: rook-ceph-mon
+                  key: ceph-username
+          volumeMounts:
+            - mountPath: /etc/ceph
+              name: ceph-config
+            - name: mon-endpoint-volume
+              mountPath: /etc/rook
+            - name: ceph-admin-secret
+              mountPath: /var/lib/rook-ceph-mon
+              readOnly: true
+      volumes:
+        - name: ceph-admin-secret
+          secret:
+            secretName: rook-ceph-mon
+            optional: false
+            items:
+              - key: ceph-secret
+                path: secret.keyring
+        - name: mon-endpoint-volume
+          configMap:
+            name: rook-ceph-mon-endpoints
+            items:
+              - key: data
+                path: mon-endpoints
+        - name: ceph-config
+          emptyDir: {}
+      tolerations:
+        - key: "node.kubernetes.io/unreachable"
+          operator: "Exists"
+          effect: "NoExecute"
+          tolerationSeconds: 5

apps-kustomized/rook-cluster-ssd/fs.yaml

@@ -0,0 +1,17 @@
+apiVersion: ceph.rook.io/v1
+kind: CephFilesystem
+metadata:
+  name: ssdfs
+  namespace: rook-ceph
+spec:
+  metadataPool:
+    replicated:
+      size: 1
+  dataPools:
+    - name: replicated
+      replicated:
+        size: 1
+  preserveFilesystemOnDelete: true
+  metadataServer:
+    activeCount: 1
+    activeStandby: true

apps-kustomized/rook-cluster-ssd/storageclass-ssd-fs.yaml

@@ -0,0 +1,24 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+   name: rook-cephfs-ssd
+# Change "rook-ceph" provisioner prefix to match the operator namespace if needed
+provisioner: rook-ceph.cephfs.csi.ceph.com
+parameters:
+    # clusterID is the namespace where the rook cluster is running
+    clusterID: rook-ceph
+    fsName: ssdfs
+
+    # Ceph pool into which the image shall be created
+    pool: ssdfs-replicated
+
+    # The secrets contain Ceph admin credentials.
+    csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
+    csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
+    csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
+    csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph
+    csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
+    csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
+
+# Delete the rbd volume when a PVC is deleted
+reclaimPolicy: Delete

apps-kustomized/rook-cluster-ssd/storageclass-ssd.yaml

@@ -0,0 +1,32 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+   name: rook-ceph-block-ssd
+   annotations:
+       storageclass.kubernetes.io/is-default-class: true
+# Change "rook-ceph" provisioner prefix to match the operator namespace if needed
+provisioner: rook-ceph.rbd.csi.ceph.com
+parameters:
+    # clusterID is the namespace where the rook cluster is running
+    clusterID: rook-ceph
+    # Ceph pool into which the RBD image shall be created
+    pool: replicapool-ssd
+
+    # RBD image format. Defaults to "2".
+    imageFormat: "2"
+
+    # RBD image features. Available for imageFormat: "2". CSI RBD currently supports only `layering` feature.
+    imageFeatures: layering
+
+    # The secrets contain Ceph admin credentials.
+    csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
+    csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
+    csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
+    csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
+
+    # Specify the filesystem type of the volume. If not specified, csi-provisioner
+    # will set default as `ext4`.
+    csi.storage.k8s.io/fstype: xfs
+
+# Delete the rbd volume when a PVC is deleted
+reclaimPolicy: Delete

apps-kustomized/smb-storageclasses/sc-s3.yaml

@@ -1,17 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: smb-s3
-provisioner: smb.csi.k8s.io
-parameters:
-  source: "//172.20.0.69/s3"
-  csi.storage.k8s.io/node-stage-secret-name: smb-creds
-  csi.storage.k8s.io/node-stage-secret-namespace: kube-system
-reclaimPolicy: Retain
-volumeBindingMode: Immediate
-mountOptions:
-  - dir_mode=0777
-  - file_mode=0777
-  - uid=1001
-  - gid=1001
-  - noperm

apps-kustomized/spoolman/deploy.yaml

@@ -1,49 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: spoolman
-  name: spoolman
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: spoolman
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: spoolman
-    spec:
-      containers:
-      - image: ghcr.io/donkie/spoolman:0.22
-        env:
-        - name: SPOOLMAN_DB_TYPE
-          value: postgres
-        - name: SPOOLMAN_DB_HOST
-          value: postgres-spoolman
-        - name: SPOOLMAN_DB_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: spoolman.postgres-spoolman.credentials.postgresql.acid.zalan.do
-              key: username
-        - name: SPOOLMAN_DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: spoolman.postgres-spoolman.credentials.postgresql.acid.zalan.do
-              key: password
-        imagePullPolicy: IfNotPresent
-        name: spoolman
-        resources: {}
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
-status: {}

apps-kustomized/spoolman/postgres.yaml

@@ -1,22 +0,0 @@
-apiVersion: "acid.zalan.do/v1"
-kind: postgresql
-metadata:
-  name: postgres-spoolman
-spec:
-  teamId: spoolman 
-  volume:
-    size: 8Gi
-    storageClass: longhorn-fast
-  numberOfInstances: 1
-  users:
-    spoolman:
-    - superuser
-    - createdb
-  databases:
-    spoolman: spoolman  # dbname: owner
-  postgresql:
-    version: "15"
-  resources:
-    requests:
-      cpu: 10m
-      memory: 1Mi

apps-kustomized/spoolman/svc.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: spoolman
-  name: k8s-spoolman
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: spoolman.martyn.berlin
-spec:
-  ports:
-  - port: 80
-    targetPort: 8000
-  selector:
-    app: spoolman
-  type: LoadBalancer

everything-app/app-ingress-nginx.yaml

@@ -11,7 +11,7 @@ spec:
   source:
     chart: ingress-nginx
     repoURL: https://kubernetes.github.io/ingress-nginx
-    targetRevision: 4.12.1
+    targetRevision: 4.12.0
     helm:
       parameters:
       - name: controller.ingressClassResource.default
@@ -37,11 +37,6 @@ spec:
           more_set_headers -a "X-Robots-Tag: anthropic-ai: none";
           more_set_headers -a "X-Robots-Tag: CCBot: none";
           more_set_headers -a "X-Robots-Tag: semrushbot: none";
-          more_set_headers -a "X-Robots-Tag: Amazonbot: none";
-          more_set_headers -a "X-Robots-Tag: dotbot: none";
-          more_set_headers -a "X-Robots-Tag: AhrefsBot: none";
-      - name: controller.config.block-user-agents
-        value: "~*Amazonbot,~*SemrushBot,~*DotBot,~*Ahrefsbot,~*GPT"
   syncPolicy:
     automated:
       selfHeal: true

everything-app/app-secrets-store-csi-driver.yaml

@@ -11,7 +11,7 @@ spec:
   source:
     chart: secrets-store-csi-driver
     repoURL: https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
-    targetRevision: 1.4.8
+    targetRevision: 1.3.4
   syncPolicy:
     automated:
       selfHeal: true

everything-app/files-web.yaml

@@ -1,17 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: files-web
-  namespace: argocd
-spec:
-  destination:
-    namespace: files-web
-    server: https://kubernetes.default.svc
-  project: apps
-  source:
-    path: apps-kustomized/files-web
-    repoURL: https://git.martyn.berlin/martyn/infra4talos
-    targetRevision: HEAD
-  syncPolicy:
-    automated:
-      selfHeal: true

everything-app/garage.yaml

@@ -0,0 +1,65 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: garage
+  namespace: argocd
+spec:
+  destination:
+    namespace: garage
+    server: https://kubernetes.default.svc
+  project: infra
+  source:
+    helm:
+      valuesObject:
+        service:
+          type: LoadBalancer
+        persistence:
+          enabled: "true"
+          meta:
+            storageClass: longhorn-fast
+          data:
+            storageClass: longhorn-spinny
+            size: "1Gi"
+        deployment:
+          replicaCount: "1"
+        garage:
+          replicationMode: "1"
+          s3:
+            api:
+              rootDomain: ".s3.files.martyn.berlin"
+            web:
+              rootDomain: ".martyn.berlin"
+        ingress:
+          s3:
+            api:
+              className: "nginx"
+              enabled: "true"
+              annotations: 
+                external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
+                cert-manager.io/cluster-issuer: letsencrypt
+                nginx.ingress.kubernetes.io/proxy-body-size: "700m"
+              tls:
+              - hosts:
+                - "s3.files.martyn.berlin"
+              hosts:
+              - host: s3.files.martyn.berlin
+                paths:
+                - path: /
+                  pathType: Prefix
+            web:
+              className: "nginx"
+              enabled: "true"
+              annotations: 
+                external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
+                cert-manager.io/cluster-issuer: letsencrypt
+              tls:
+              - hosts:
+                - "files.martyn.berlin"
+              hosts:
+              - host: files.martyn.berlin
+                paths:
+                - path: /
+                  pathType: Prefix
+    path: script/helm/garage
+    repoURL: https://git.deuxfleurs.fr/Deuxfleurs/garage
+    targetRevision: HEAD

everything-app/longhorn.yaml

@@ -25,7 +25,7 @@ spec:
         value: "false"
     chart: longhorn
     repoURL: https://charts.longhorn.io
-    targetRevision: 1.6.4
+    targetRevision: 1.8.1
   syncPolicy:
     automated:
       selfHeal: true

everything-app/nodered.yaml

@@ -31,7 +31,7 @@ spec:
           annotations:
             external-dns.alpha.kubernetes.io/hostname: nodered.martyn.berlin
     repoURL: https://k8s-at-home.com/charts/
-    targetRevision: 5.4.0
+    targetRevision: 5.3.1
   syncPolicy:
     automated:
       selfHeal: true

everything-app/paperless-ngx.yaml

@@ -9,9 +9,57 @@ spec:
     server: https://kubernetes.default.svc
   project: apps
   source:
-    path: apps-kustomized/paperless-ngx
-    repoURL: https://git.martyn.berlin/martyn/infra4talos
-    targetRevision: HEAD
+    chart: paperless-ngx
+    helm:
+      parameters:
+      - name: service.main.type
+        value: "LoadBalancer"
+      - name: persistence.data.enabled
+        value: "true"
+      - name: persistence.data.size
+        value: "1Gi"
+      - name: persistence.data.accessMode
+        value: ReadWriteOnce
+      - name: persistence.data.storageClass
+        value: "longhorn-fast"
+      - name: persistence.media.enabled
+        value: "true"
+      - name: persistence.media.size
+        value: "8Gi"
+      - name: persistence.media.accessMode
+        value: ReadWriteOnce
+      - name: persistence.media.storageClass
+        value: "longhorn-fast"
+      - name: persistence.export.enabled
+        value: "true"
+      - name: persistence.export.size
+        value: "1Gi"
+      - name: persistence.export.accessMode
+        value: ReadWriteOnce
+      - name: persistence.export.storageClass
+        value: "longhorn-fast"
+      - name: persistence.consume.enabled
+        value: "true"
+      - name: persistence.consume.size
+        value: "1Gi"
+      - name: persistence.consume.accessMode
+        value: ReadWriteOnce
+      - name: persistence.consume.storageClass
+        value: "smb-scans"
+      - name: postgresql.enabled
+        value: "true"
+      - name: postgresql.primary.persistence.enabled
+        value: "true"
+      - name: postgresql.primary.persistence.storageClass
+        value: "longhorn-fast"
+      - name: env.TZ
+        value: "Europe/Berlin"
+      - name: resources.requests.cpu
+        value: "25m"
+      - name: resources.requests.memory
+        value: "511772986"
+    repoURL: https://charts.gabe565.com
+    targetRevision: 0.7.8
   syncPolicy:
     automated:
       selfHeal: true

everything-app/project-apps.yaml

@@ -16,7 +16,6 @@ spec:
     - https://k8s-at-home.com/charts/
     - https://charts.bitnami.com/bitnami
     - https://charts.gabe565.com
-    - https://ideaplexus.gitlab.io/charts
   destinations:
     - name: '*'
       namespace: '*'

everything-app/samba-longhorn-ssd.yaml

@@ -24,16 +24,6 @@ spec:
           users:
           - username: martyn
             password: "564628"
-        affinity:
-          nodeAffinity:
-            preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 1
-              preference:
-                matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: In
-                  values:
-                  - talos-llu-kx3
         persistence:
           extraPVCShares:
           - name: oldspace
@@ -54,9 +44,6 @@ spec:
           - name: scans
             size: 1Gi
             storageClass: longhorn-fast
-          - name: s3
-            size: 20Gi
-            storageClass: longhorn-fast
     path: apps-helm/samba4
     repoURL: https://git.martyn.berlin/martyn/infra4talos.git
     targetRevision: HEAD

everything-app/spoolman.yaml

@@ -1,17 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: spoolman
-  namespace: argocd
-spec:
-  destination:
-    namespace: spoolman
-    server: https://kubernetes.default.svc
-  project: apps
-  source:
-    path: apps-kustomized/spoolman
-    repoURL: https://git.martyn.berlin/martyn/infra4talos
-    targetRevision: HEAD
-  syncPolicy:
-    automated:
-      selfHeal: true