Upgrading for "reasons"

Signed-off-by: Martyn Ranyard <m@rtyn.berlin>

apps-kustomized/1password-connect/deploy.yaml

@@ -46,7 +46,7 @@ spec:
           value: "8080"
         - name: OP_LOG_LEVEL
           value: info
-        image: 1password/connect-api:1.7.2
+        image: 1password/connect-api:1.7.3
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
@@ -92,7 +92,7 @@ spec:
           value: localhost:11220
         - name: OP_LOG_LEVEL
           value: info
-        image: 1password/connect-sync:1.7.2
+        image: 1password/connect-sync:1.7.3
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

apps-kustomized/external-dns/deploy.yaml

@@ -0,0 +1,12 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-dns
+spec:
+  template:
+    spec:
+      containers:
+      - name: external-dns
+        envFrom:
+          - secretRef:
+              name: dnsimple-auth

apps-kustomized/external-dns/kustomization.yaml

@@ -3,12 +3,16 @@ kind: Kustomization
 
 helmCharts:      
 - name: external-dns
-  repo: https://charts.bitnami.com/bitnami
-  version: 6.28.4
+  repo: https://kubernetes-sigs.github.io/external-dns
+  version: 1.15.2
   releaseName: external-dns
   namespace: external-dns
   valuesInline:
-    provider: dnsimple
+    provider: 
+      name: dnsimple
     txtPrefix: armnleg
-    sources: [service,ingress]
-    extraEnvVarsSecret: dnsimple-auth
+patches:
+- path: deploy.yaml
+  target:
+    kind: Deployment
+    name: external-dns

apps-kustomized/files-web/ing.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
+    nginx.ingress.kubernetes.io/proxy-body-size: 700m
+  name: web-s3
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: files.martyn.berlin
+    http:
+      paths:
+      - backend:
+          service:
+            name: s3-nginx
+            port:
+              number: 80
+        path: /
+        pathType: Prefix
+  tls:
+  - hosts:
+    - files.martyn.berlin

apps-kustomized/files-web/nginx.yaml

@@ -0,0 +1,27 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: s3-nginx
+  name: s3-nginx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: s3-nginx
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: s3-nginx
+    spec:
+      containers:
+      - image: nginx:1.27.4
+        name: nginx
+        volumeMounts:
+        - mountPath: /usr/share/nginx/html
+          name: s3
+      volumes:
+      - name: s3
+        persistentVolumeClaim:
+          claimName: smb-s3

apps-kustomized/files-web/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: smb-s3
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: smb-s3

apps-kustomized/files-web/svc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: s3-nginx
+  name: s3-nginx
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+  - port: 80
+  selector:
+    app: s3-nginx

apps-kustomized/lms/pvc.yaml

@@ -12,18 +12,6 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
-metadata:
-  name: smb-oldmusic
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: smb-oldmusic
----
-apiVersion: v1
-kind: PersistentVolumeClaim
 metadata:
   name: logitech-media-server-config
 spec:

apps-kustomized/lms/statefulset.yaml

@@ -61,29 +61,26 @@ spec:
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
         volumeMounts:
-        - mountPath: /srv/squeezebox
-          name: config
-        - mountPath: /smbmusic
-          name: smbmusic
-        - mountPath: /smboldmusic
-          name: smboldmusic
-      dnsPolicy: ClusterFirst
-      initContainers:
-      - command:
-        - sh
-        - -c
-        - mkdir /smbmusic; mkdir -pv /config/playlists /config/config; chown -Rc 1000:1000
-          /config
-        image: doliana/logitech-media-server:2023_04_15-8.3.1
-        imagePullPolicy: IfNotPresent
-        name: init-config
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
         - mountPath: /config
           name: config
+        - mountPath: /music
+          name: smbmusic
+        - mountPath: /playlist
+          name: config
+          subPath: playlist
+      dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - talos-llu-kx3
       terminationGracePeriodSeconds: 30
       volumes:
       - name: config
@@ -92,9 +89,6 @@ spec:
       - name: smbmusic
         persistentVolumeClaim:
           claimName: smb-music
-      - name: smboldmusic
-        persistentVolumeClaim:
-          claimName: smb-oldmusic
   updateStrategy:
     rollingUpdate:
       partition: 0

apps-kustomized/mosquitto/deploy.yaml

@@ -21,7 +21,7 @@ spec:
         app.kubernetes.io/name: mosquitto
     spec:
       containers:
-      - image: eclipse-mosquitto:1.6.12
+      - image: eclipse-mosquitto:1.6.15
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3

apps-kustomized/nvidiastuff/kustomization.yaml

@@ -10,7 +10,7 @@ helmCharts:
   includeCRDs: true
   namespace: nvidia-device-plugin
   releaseName:  nvidia-device-plugin
-  version: 0.17.0
+  version: 0.17.1
   repo: https://nvidia.github.io/k8s-device-plugin
   valuesInline:
     nodeSelector: "feature.node.kubernetes.io/pci-0300_10de_13c0_1569_13c0.present=true"

apps-kustomized/paperless-ngx/kustomization.yaml

@@ -0,0 +1,62 @@
+
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+helmCharts:      
+- name: paperless-ngx
+  repo: https://charts.gabe565.com
+  version: 0.24.1
+  releaseName: paperless-ngx
+  namespace: paperless-ngx
+  valuesInline:
+    persistence:
+      data:
+        enabled: "true"
+        size: "1Gi"
+        accessMode: ReadWriteOnce
+        storageClass: "longhorn-fast"
+      media:
+        enabled: "true"
+        size: "8Gi"
+        accessMode: ReadWriteOnce
+        storageClass: "longhorn-fast"
+      export:
+        enabled: "true"
+        size: "1Gi"
+        accessMode: ReadWriteOnce
+        storageClass: "longhorn-fast"
+      consume:
+        enabled: "true"
+        size: "1Gi"
+        accessMode: ReadWriteOnce
+        storageClass: "smb-scans"
+    service:
+      main:
+        type: LoadBalancer
+        annotations:
+          external-dns.alpha.kubernetes.io/hostname: "paperless.martyn.berlin"
+        ports:
+          http:
+            port: 8080
+    postgresql:
+      enabled: "true"
+      primary:
+        persistence:
+          enabled: "true"
+          storageClass: "longhorn-fast"
+    env:
+      TZ: "Europe/Berlin"
+    resources:
+      requests:
+        cpu: "25m"
+        memory: "511772986"
+    
+
+patches:
+  - target:
+      kind: Service
+      name: paperless-ngx
+    patch: |-
+      - op: replace
+        path: /spec/ports
+        value: [{"name":"http","port":80,"targetPort":"http","protocol":"TCP"}]

apps-kustomized/rook-cluster-ssd/blockpool-ssd.yaml

@@ -1,9 +0,0 @@
-apiVersion: ceph.rook.io/v1
-kind: CephBlockPool
-metadata:
-  name: replicapool-ssd
-  namespace: rook-ceph
-spec:
-  failureDomain: host
-  replicated:
-    size: 2

apps-kustomized/rook-cluster-ssd/cluster-ssd.yaml

@@ -1,47 +0,0 @@
-apiVersion: ceph.rook.io/v1
-kind: CephCluster
-metadata:
-  name: ssd-cluster
-  namespace: rook-ceph # namespace:cluster
-spec:
-  dataDirHostPath: /var/lib/rook-cluster-ssd
-  cephVersion:
-    image: quay.io/ceph/ceph:v18
-    allowUnsupported: true
-  mon:
-    count: 1
-    allowMultiplePerNode: true
-  mgr:
-    count: 1
-    allowMultiplePerNode: true
-  dashboard:
-    enabled: true
-  crashCollector:
-    disable: true
-  storage:
-    useAllNodes: false
-    useAllDevices: false
-    #deviceFilter:
-    nodes:
-    - name: "talos-7oq-vur"
-      devices:
-      - name: "sda"
-        config:
-          osdsPerDevice: "1"
-    - name: "talos-iqd-ysy"
-      devices:
-      - name: "sda"
-        config:
-          osdsPerDevice: "1"
-  monitoring:
-    enabled: false
-  healthCheck:
-    daemonHealth:
-      mon:
-        interval: 45s
-        timeout: 600s
-  priorityClassNames:
-    all: system-node-critical
-    mgr: system-cluster-critical
-  disruptionManagement:
-    managePodBudgets: true

apps-kustomized/rook-cluster-ssd/configmap.yaml

@@ -1,13 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: rook-config-override
-  namespace: rook-ceph # namespace:cluster
-data:
-  config: |
-    [global]
-    osd_pool_default_size = 1
-    mon_warn_on_pool_no_redundancy = false
-    bdev_flock_retry = 20
-    bluefs_buffered_io = false
-    mon_data_avail_warn = 10

apps-kustomized/rook-cluster-ssd/deploy-toolbox.yaml

@@ -1,130 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rook-ceph-tools
-  namespace: rook-ceph # namespace:cluster
-  labels:
-    app: rook-ceph-tools
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: rook-ceph-tools
-  template:
-    metadata:
-      labels:
-        app: rook-ceph-tools
-    spec:
-      dnsPolicy: ClusterFirstWithHostNet
-      containers:
-        - name: rook-ceph-tools
-          image: quay.io/ceph/ceph:v17.2.6
-          command:
-            - /bin/bash
-            - -c
-            - |
-              # Replicate the script from toolbox.sh inline so the ceph image
-              # can be run directly, instead of requiring the rook toolbox
-              CEPH_CONFIG="/etc/ceph/ceph.conf"
-              MON_CONFIG="/etc/rook/mon-endpoints"
-              KEYRING_FILE="/etc/ceph/keyring"
-
-              # create a ceph config file in its default location so ceph/rados tools can be used
-              # without specifying any arguments
-              write_endpoints() {
-                endpoints=$(cat ${MON_CONFIG})
-
-                # filter out the mon names
-                # external cluster can have numbers or hyphens in mon names, handling them in regex
-                # shellcheck disable=SC2001
-                mon_endpoints=$(echo "${endpoints}"| sed 's/[a-z0-9_-]\+=//g')
-
-                DATE=$(date)
-                echo "$DATE writing mon endpoints to ${CEPH_CONFIG}: ${endpoints}"
-                  cat <<EOF > ${CEPH_CONFIG}
-              [global]
-              mon_host = ${mon_endpoints}
-
-              [client.admin]
-              keyring = ${KEYRING_FILE}
-              EOF
-              }
-
-              # watch the endpoints config file and update if the mon endpoints ever change
-              watch_endpoints() {
-                # get the timestamp for the target of the soft link
-                real_path=$(realpath ${MON_CONFIG})
-                initial_time=$(stat -c %Z "${real_path}")
-                while true; do
-                  real_path=$(realpath ${MON_CONFIG})
-                  latest_time=$(stat -c %Z "${real_path}")
-
-                  if [[ "${latest_time}" != "${initial_time}" ]]; then
-                    write_endpoints
-                    initial_time=${latest_time}
-                  fi
-
-                  sleep 10
-                done
-              }
-
-              # read the secret from an env var (for backward compatibility), or from the secret file
-              ceph_secret=${ROOK_CEPH_SECRET}
-              if [[ "$ceph_secret" == "" ]]; then
-                ceph_secret=$(cat /var/lib/rook-ceph-mon/secret.keyring)
-              fi
-
-              # create the keyring file
-              cat <<EOF > ${KEYRING_FILE}
-              [${ROOK_CEPH_USERNAME}]
-              key = ${ceph_secret}
-              EOF
-
-              # write the initial config file
-              write_endpoints
-
-              # continuously update the mon endpoints if they fail over
-              watch_endpoints
-          imagePullPolicy: IfNotPresent
-          tty: true
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 2016
-            runAsGroup: 2016
-            capabilities:
-              drop: ["ALL"]
-          env:
-            - name: ROOK_CEPH_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: rook-ceph-mon
-                  key: ceph-username
-          volumeMounts:
-            - mountPath: /etc/ceph
-              name: ceph-config
-            - name: mon-endpoint-volume
-              mountPath: /etc/rook
-            - name: ceph-admin-secret
-              mountPath: /var/lib/rook-ceph-mon
-              readOnly: true
-      volumes:
-        - name: ceph-admin-secret
-          secret:
-            secretName: rook-ceph-mon
-            optional: false
-            items:
-              - key: ceph-secret
-                path: secret.keyring
-        - name: mon-endpoint-volume
-          configMap:
-            name: rook-ceph-mon-endpoints
-            items:
-              - key: data
-                path: mon-endpoints
-        - name: ceph-config
-          emptyDir: {}
-      tolerations:
-        - key: "node.kubernetes.io/unreachable"
-          operator: "Exists"
-          effect: "NoExecute"
-          tolerationSeconds: 5

apps-kustomized/rook-cluster-ssd/fs.yaml

@@ -1,17 +0,0 @@
-apiVersion: ceph.rook.io/v1
-kind: CephFilesystem
-metadata:
-  name: ssdfs
-  namespace: rook-ceph
-spec:
-  metadataPool:
-    replicated:
-      size: 1
-  dataPools:
-    - name: replicated
-      replicated:
-        size: 1
-  preserveFilesystemOnDelete: true
-  metadataServer:
-    activeCount: 1
-    activeStandby: true

apps-kustomized/rook-cluster-ssd/storageclass-ssd-fs.yaml

@@ -1,24 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-   name: rook-cephfs-ssd
-# Change "rook-ceph" provisioner prefix to match the operator namespace if needed
-provisioner: rook-ceph.cephfs.csi.ceph.com
-parameters:
-    # clusterID is the namespace where the rook cluster is running
-    clusterID: rook-ceph
-    fsName: ssdfs
-
-    # Ceph pool into which the image shall be created
-    pool: ssdfs-replicated
-
-    # The secrets contain Ceph admin credentials.
-    csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
-    csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
-    csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
-    csi.storage.k8s.io/controller-expand-secret-namespace: rook-ceph
-    csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
-    csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
-
-# Delete the rbd volume when a PVC is deleted
-reclaimPolicy: Delete

apps-kustomized/rook-cluster-ssd/storageclass-ssd.yaml

@@ -1,32 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-   name: rook-ceph-block-ssd
-   annotations:
-       storageclass.kubernetes.io/is-default-class: true
-# Change "rook-ceph" provisioner prefix to match the operator namespace if needed
-provisioner: rook-ceph.rbd.csi.ceph.com
-parameters:
-    # clusterID is the namespace where the rook cluster is running
-    clusterID: rook-ceph
-    # Ceph pool into which the RBD image shall be created
-    pool: replicapool-ssd
-
-    # RBD image format. Defaults to "2".
-    imageFormat: "2"
-
-    # RBD image features. Available for imageFormat: "2". CSI RBD currently supports only `layering` feature.
-    imageFeatures: layering
-
-    # The secrets contain Ceph admin credentials.
-    csi.storage.k8s.io/provisioner-secret-name: rook-csi-rbd-provisioner
-    csi.storage.k8s.io/provisioner-secret-namespace: rook-ceph
-    csi.storage.k8s.io/node-stage-secret-name: rook-csi-rbd-node
-    csi.storage.k8s.io/node-stage-secret-namespace: rook-ceph
-
-    # Specify the filesystem type of the volume. If not specified, csi-provisioner
-    # will set default as `ext4`.
-    csi.storage.k8s.io/fstype: xfs
-
-# Delete the rbd volume when a PVC is deleted
-reclaimPolicy: Delete

apps-kustomized/smb-storageclasses/sc-s3.yaml

@@ -0,0 +1,17 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: smb-s3
+provisioner: smb.csi.k8s.io
+parameters:
+  source: "//172.20.0.69/s3"
+  csi.storage.k8s.io/node-stage-secret-name: smb-creds
+  csi.storage.k8s.io/node-stage-secret-namespace: kube-system
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+mountOptions:
+  - dir_mode=0777
+  - file_mode=0777
+  - uid=1001
+  - gid=1001
+  - noperm

apps-kustomized/spoolman/deploy.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: spoolman
+  name: spoolman
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: spoolman
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: spoolman
+    spec:
+      containers:
+      - image: ghcr.io/donkie/spoolman:0.22
+        env:
+        - name: SPOOLMAN_DB_TYPE
+          value: postgres
+        - name: SPOOLMAN_DB_HOST
+          value: postgres-spoolman
+        - name: SPOOLMAN_DB_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: spoolman.postgres-spoolman.credentials.postgresql.acid.zalan.do
+              key: username
+        - name: SPOOLMAN_DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: spoolman.postgres-spoolman.credentials.postgresql.acid.zalan.do
+              key: password
+        imagePullPolicy: IfNotPresent
+        name: spoolman
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+status: {}

apps-kustomized/spoolman/postgres.yaml

@@ -0,0 +1,22 @@
+apiVersion: "acid.zalan.do/v1"
+kind: postgresql
+metadata:
+  name: postgres-spoolman
+spec:
+  teamId: spoolman 
+  volume:
+    size: 8Gi
+    storageClass: longhorn-fast
+  numberOfInstances: 1
+  users:
+    spoolman:
+    - superuser
+    - createdb
+  databases:
+    spoolman: spoolman  # dbname: owner
+  postgresql:
+    version: "15"
+  resources:
+    requests:
+      cpu: 10m
+      memory: 1Mi

apps-kustomized/spoolman/svc.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: spoolman
+  name: k8s-spoolman
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: spoolman.martyn.berlin
+spec:
+  ports:
+  - port: 80
+    targetPort: 8000
+  selector:
+    app: spoolman
+  type: LoadBalancer

everything-app/app-ingress-nginx.yaml

@@ -11,7 +11,7 @@ spec:
   source:
     chart: ingress-nginx
     repoURL: https://kubernetes.github.io/ingress-nginx
-    targetRevision: 4.12.0
+    targetRevision: 4.12.1
     helm:
       parameters:
       - name: controller.ingressClassResource.default
@@ -37,6 +37,11 @@ spec:
           more_set_headers -a "X-Robots-Tag: anthropic-ai: none";
           more_set_headers -a "X-Robots-Tag: CCBot: none";
           more_set_headers -a "X-Robots-Tag: semrushbot: none";
+          more_set_headers -a "X-Robots-Tag: Amazonbot: none";
+          more_set_headers -a "X-Robots-Tag: dotbot: none";
+          more_set_headers -a "X-Robots-Tag: AhrefsBot: none";
+      - name: controller.config.block-user-agents
+        value: "~*Amazonbot,~*SemrushBot,~*DotBot,~*Ahrefsbot,~*GPT"
   syncPolicy:
     automated:
       selfHeal: true

everything-app/app-secrets-store-csi-driver.yaml

@@ -11,7 +11,7 @@ spec:
   source:
     chart: secrets-store-csi-driver
     repoURL: https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts
-    targetRevision: 1.3.4
+    targetRevision: 1.4.8
   syncPolicy:
     automated:
       selfHeal: true

everything-app/files-web.yaml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: files-web
+  namespace: argocd
+spec:
+  destination:
+    namespace: files-web
+    server: https://kubernetes.default.svc
+  project: apps
+  source:
+    path: apps-kustomized/files-web
+    repoURL: https://git.martyn.berlin/martyn/infra4talos
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      selfHeal: true

everything-app/garage.yaml

@@ -1,65 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: garage
-  namespace: argocd
-spec:
-  destination:
-    namespace: garage
-    server: https://kubernetes.default.svc
-  project: infra
-  source:
-    helm:
-      valuesObject:
-        service:
-          type: LoadBalancer
-        persistence:
-          enabled: "true"
-          meta:
-            storageClass: longhorn-fast
-          data:
-            storageClass: longhorn-spinny
-            size: "1Gi"
-        deployment:
-          replicaCount: "1"
-        garage:
-          replicationMode: "1"
-          s3:
-            api:
-              rootDomain: ".s3.files.martyn.berlin"
-            web:
-              rootDomain: ".martyn.berlin"
-        ingress:
-          s3:
-            api:
-              className: "nginx"
-              enabled: "true"
-              annotations: 
-                external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
-                cert-manager.io/cluster-issuer: letsencrypt
-                nginx.ingress.kubernetes.io/proxy-body-size: "700m"
-              tls:
-              - hosts:
-                - "s3.files.martyn.berlin"
-              hosts:
-              - host: s3.files.martyn.berlin
-                paths:
-                - path: /
-                  pathType: Prefix
-            web:
-              className: "nginx"
-              enabled: "true"
-              annotations: 
-                external-dns.alpha.kubernetes.io/target: armnleg.martyn.berlin
-                cert-manager.io/cluster-issuer: letsencrypt
-              tls:
-              - hosts:
-                - "files.martyn.berlin"
-              hosts:
-              - host: files.martyn.berlin
-                paths:
-                - path: /
-                  pathType: Prefix
-    path: script/helm/garage
-    repoURL: https://git.deuxfleurs.fr/Deuxfleurs/garage
-    targetRevision: HEAD

everything-app/nodered.yaml

@@ -31,7 +31,7 @@ spec:
           annotations:
             external-dns.alpha.kubernetes.io/hostname: nodered.martyn.berlin
     repoURL: https://k8s-at-home.com/charts/
-    targetRevision: 5.3.1
+    targetRevision: 5.4.0
   syncPolicy:
     automated:
       selfHeal: true

everything-app/paperless-ngx.yaml

@@ -9,57 +9,9 @@ spec:
     server: https://kubernetes.default.svc
   project: apps
   source:
-    chart: paperless-ngx
-    helm:
-      parameters:
-      - name: service.main.type
-        value: "LoadBalancer"
-      - name: persistence.data.enabled
-        value: "true"
-      - name: persistence.data.size
-        value: "1Gi"
-      - name: persistence.data.accessMode
-        value: ReadWriteOnce
-      - name: persistence.data.storageClass
-        value: "longhorn-fast"
-      - name: persistence.media.enabled
-        value: "true"
-      - name: persistence.media.size
-        value: "8Gi"
-      - name: persistence.media.accessMode
-        value: ReadWriteOnce
-      - name: persistence.media.storageClass
-        value: "longhorn-fast"
-      - name: persistence.export.enabled
-        value: "true"
-      - name: persistence.export.size
-        value: "1Gi"
-      - name: persistence.export.accessMode
-        value: ReadWriteOnce
-      - name: persistence.export.storageClass
-        value: "longhorn-fast"
-      - name: persistence.consume.enabled
-        value: "true"
-      - name: persistence.consume.size
-        value: "1Gi"
-      - name: persistence.consume.accessMode
-        value: ReadWriteOnce
-      - name: persistence.consume.storageClass
-        value: "smb-scans"
-      - name: postgresql.enabled
-        value: "true"
-      - name: postgresql.primary.persistence.enabled
-        value: "true"
-      - name: postgresql.primary.persistence.storageClass
-        value: "longhorn-fast"
-      - name: env.TZ
-        value: "Europe/Berlin"
-      - name: resources.requests.cpu
-        value: "25m"
-      - name: resources.requests.memory
-        value: "511772986"
-    repoURL: https://charts.gabe565.com
-    targetRevision: 0.7.8
+    path: apps-kustomized/paperless-ngx
+    repoURL: https://git.martyn.berlin/martyn/infra4talos
+    targetRevision: HEAD
   syncPolicy:
     automated:
       selfHeal: true

everything-app/project-apps.yaml

@@ -16,6 +16,7 @@ spec:
     - https://k8s-at-home.com/charts/
     - https://charts.bitnami.com/bitnami
     - https://charts.gabe565.com
+    - https://ideaplexus.gitlab.io/charts
   destinations:
     - name: '*'
       namespace: '*'

everything-app/samba-longhorn-ssd.yaml

@@ -24,6 +24,16 @@ spec:
           users:
           - username: martyn
             password: "564628"
+        affinity:
+          nodeAffinity:
+            preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 1
+              preference:
+                matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                  - talos-llu-kx3
         persistence:
           extraPVCShares:
           - name: oldspace
@@ -44,6 +54,9 @@ spec:
           - name: scans
             size: 1Gi
             storageClass: longhorn-fast
+          - name: s3
+            size: 20Gi
+            storageClass: longhorn-fast
     path: apps-helm/samba4
     repoURL: https://git.martyn.berlin/martyn/infra4talos.git
     targetRevision: HEAD

everything-app/spoolman.yaml

@@ -0,0 +1,17 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: spoolman
+  namespace: argocd
+spec:
+  destination:
+    namespace: spoolman
+    server: https://kubernetes.default.svc
+  project: apps
+  source:
+    path: apps-kustomized/spoolman
+    repoURL: https://git.martyn.berlin/martyn/infra4talos
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      selfHeal: true