feat(k8s): add K8s manifests for all homelab services

traefik, gitea, adguard, nextcloud, errorpages, homepages, uptime-kuma, kener, checkmk, headscale, dockmon, metube, downtify, portainer, netronome, userbot Includes Helm values, deployments, services, ingress routes, configmaps, secrets (placeholders), postgres statefulsets, kustomize overlays, and Traefik dynamic configuration.
2026-06-08 10:51:04 +02:00
parent f3d04e935c
commit 36922a177c
60 changed files with 2596 additions and 5 deletions
@@ -0,0 +1,50 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dashboard-dev
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`traefik.gigaforust.internal`)
+    kind: Rule
+    services:
+    - name: api@internal
+      kind: TraefikService
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dashboard-local
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`traefik.workstation.internal`)
+    kind: Rule
+    services:
+    - name: api@internal
+      kind: TraefikService
+  tls:
+    secretName: local-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dashboard-prod
+  namespace: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`traefik.forust.xyz`)
+    kind: Rule
+    services:
+    - name: api@internal
+      kind: TraefikService
+  tls:
+    {}
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: local-tls
+  namespace: traefik
+type: kubernetes.io/tls
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURXVENDQWtHZ0F3SUJBZ0lVR0FpNCtsWDlCOUFteVdmcVpUSWl3UTlYYkcwd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0Z6RVZNQk1HQTFVRUF3d01LaTVtYjNKMWMzUXVlSGw2TUI0WERUSTJNRFl3T0RBMk1qazFObG9YRFRNMgpNRFl3TlRBMk1qazFObG93RnpFVk1CTUdBMVVFQXd3TUtpNW1iM0oxYzNRdWVIbDZNSUlCSWpBTkJna3Foa2lHCjl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF5c2VLRnBmaDRJVGR0NGdHR2JNV01pQ1F2bTc5UkZ4UDgwa3QKNDVWOTF5VkVRWUZaMmptRjFpOS9JRTNiKzhacXR6cXQ2bWU5aHN4L21LTXE5Z05tQ1M1NWUxc0NMNkttRCs3bgpSOXJtM2h2TEJWRUpselIwZW9FOXhWS091dzJYNkNvcEZRelVQU1ZzUFRSajExQlUyVDVqekVUc00xTG5LVFhHCnlzMHpCcjByZHMvRlM2cUV2alY4TkREdUVZWVNCaU1hMUdpclpPSndvd2NiZ0pBVWRiRnUyMHRGRmZMb3B2R0wKSEFQcnA3TXpYWTdVQ3RRYW9xY0xMeTN1NEdKN3dyNUcyRURvVUhmdXlJaFBtTStibENZbWkzY2NlZ0tBQ2hKcApZQTQyMGRXVkRBYWpmT1hFc2c1VTFFT3JLK2hQaTluRVc3MUlYYnNYdWp3ZG9zbEgvd0lEQVFBQm80R2NNSUdaCk1CMEdBMVVkRGdRV0JCVHkxdFlLWElYUXJSdlFGL0g4RkFmanp5Z2ZyekFmQmdOVkhTTUVHREFXZ0JUeTF0WUsKWElYUXJSdlFGL0g4RkFmanp5Z2ZyekFQQmdOVkhSTUJBZjhFQlRBREFRSC9NRVlHQTFVZEVRUS9NRDJDRENvdQpabTl5ZFhOMExuaDVlb0lXS2k1M2IzSnJjM1JoZEdsdmJpNXBiblJsY201aGJJSVZLaTVuYVdkaFptOXlkWE4wCkxtbHVkR1Z5Ym1Gc01BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1ZTQ21Sekl2RjhhdXRWVkxZRXpuVHN6OHUKWlNWOGJSYkxYalpDVWVSZUJidW1OR2JQS1c5dExLS2JBWmJqUit1dWZIbGxMMGk1TjdrdFRvNm5NU05vS3NjaApOSjdrRkJoVHRwcmRZUjhMNFpnUkh1VFZGTmViR0pBL1RPRFpUSjhUNTNXaVdoa2tUWnRWOEViQ2hwZ3Zqb2tuCkJCSEpBbEo2dkZFczBzSE9pMVp4Yk5VU2ZLQWdiMlJiSXpJRlhPZkllR095ZjZCL3hFcGtndVNzN3drMGJrK3QKV2YyNVJ5WnZiYmg0amc4WDVOVGQwS2dwdU5NZU96aERlUHNKNlM0b3o5STA0UlEvdENRdWErdlRYNEM3NkFrWgpjcnYxYlR4Wm5pNjBzYVZKeC8wVDI0LzBPN2dGbXFkelcvL1U0QS82eUx3RzlRMG9jZ1JYcGFlVmFLeUkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRREt4NG9XbCtIZ2hOMjMKaUFZWnN4WXlJSkMrYnYxRVhFL3pTUzNqbFgzWEpVUkJnVm5hT1lYV0wzOGdUZHY3eG1xM09xM3FaNzJHekgrWQpveXIyQTJZSkxubDdXd0l2b3FZUDd1ZEgydWJlRzhzRlVRbVhOSFI2Z1QzRlVvNjdEWmZvS2lrVkROUTlKV3c5Ck5HUFhVRlRaUG1QTVJPd3pVdWNwTmNiS3pUTUd2U3QyejhWTHFvUytOWHcwTU80UmhoSUdJeHJVYUt0azRuQ2oKQnh1QWtCUjFzVzdiUzBVVjh1aW04WXNjQSt1bnN6TmRqdFFLMUJxaXB3c3ZMZTdnWW52Q3ZrYllRT2hRZCs3SQppRStZejV1VUppYUxkeHg2QW9BS0VtbGdEamJSMVpVTUJxTjg1Y1N5RGxUVVE2c3I2RStMMmNSYnZVaGR1eGU2ClBCMml5VWYvQWdNQkFBRUNnZ0VBRWdrZlloVU9OUTc4UFdldXl6aGZnQVBmZStDWlRDdzl2RERGRVJucHdHb0QKSVNSbEhvREJRNlNqMVBhMzJ6UHhwK3hqTFpjZWgwL0hCWWQxdWIzaHBHMXF4cXI0amM0VW9SUXBvLzEzVFVnQgpqYTZBZ045Y2dNemY5cDM2TGU3dWxPcXpEcmsrWTFYaHc2dldPWDllbkpmcy9tMGU2UTIxbTdlNXY2M3luT1dyCjN0cFhWcXNPNVhrVWwyb2lCQWNHNG1STnhOSzVkdTZjamJMSTlIenBZSEQrYVpNNVBnTDdUUDltQ3djN1M2dnEKWks4M1h2UC9DL0U2alJzMmwyTWJLRzFkSzllOVl3cnVaNmpCbTRVVVRtR0xOVU1JamVnZ09XTWNnaDVhVHRBRAo5N2JTUFovWHYxeWgwZzUyMkhNbUFHYW52WlZRNWs3VkIyY3dCc2FabVFLQmdRRG8zTm5EWGhsM1l2ajRFQUtDCk1TK2ZkVEp2NFYzem9oWnlLZlYxN053U2dpQ2ZQaldKbDduRGluSVdhR2p1QzY2OENPM0dURys5Q25IY2dLS2UKcnp5QWhaUGpzc2EvQVZuSGE0MDBTYm9Cb3RacUVQdnA5eTVQTzVnNGkyT1k3ZUFjTDZZakJsUmVmOUsyNUNkbQpIR1d3MjNnRG5UeDRXMDFncjY4Uk5GOVZEUUtCZ1FEZTdYditkVUhCT1BzcHNSVmVlV1FuWjB3WlJFVGxvSE1KCnZ3OVZsdlYrN1hIYTRDb0gyMUg5TU1IbkM5TkhuYmlTaUpvR09lc1FLMUowUnhVNjZMMkZDQUJnQk9USTlqYU4KZmNmaTNKcGZ4a2N3c2VWRXB1WmQrZHFZbVlPNjlRZG1nODJOa3o0emwrTWREU0RBOVQ5Uk1XS1V4WHZVSEVPcgpuTE9pU0VQbU93S0JnQ3V1c2xNSjVmRVZhZXJ1NWVtU1hJS25NNHoxVS9DT0tYUEZGenpGOEFxd3lublU2Nm9pCkFrRUNTYUNXZVlpZVBHc2RxYTBYVGFiQ3ZOVkdkRHNjV0ZjcnQ3QnhLd05OdDQvSFJ6ZlYxTVRWelM4Y2ZJVkoKVHpDaDEwNVVKNXpha3IzMjJrMmJ0RnY5MG9Ob2pWT0VaRGNuRkg1cEVwenBVN3lkZUZQYjVUNUpBb0dCQUlVNAp6Um5TL3htMnNMcElubW1ZQjlkWWJ1ekdsSm5abWdYZ0RRenNLd2ZRWkhNVjlXZytsQy9IL0lqVDAwNkFIZlpMCjlpZjBZdHFGMlQrdDN5MFdPM1FOeFJPY3VSQ3p1d1F4Zjh1K1krOEtjaTdTa1IzRzAvS2pSeFJjNFpGUHJ6MS8KVk03ZmlKT1NtR0liSDFEUS95YkphWTFZdTFpV0Q0YTJIYy9FZWZkVEFvR0FQRmcxZW14U1BoYUdCN3RKVkVFaQptNzhCUEhpZ01OTXd6VDFWRVcrV1BXeks4a3lvak1XU1puRkIyamEwZ25VL0dOSjkzY3F3T0xGck1aOCtSL1JyClRnRnVJZ0JENGRENUJ0MGd4WlQ1SC9QU0dUOGszUU0vYloxamZaTXk0WG1vTlFONytaVXIrS2EycWNaSjhMZHYKbmlvdGhGTGg3VmI4d0grTGhvNnVzaFE9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
@@ -0,0 +1,124 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: traefik-dynamic
+  namespace: traefik
+data:
+  dynamic.yml: |
+    http:
+      serversTransports:
+        insecureTransport:
+          insecureSkipVerify: true
+  middlewares.yml: |
+    http:
+      middlewares:
+        # HTTPS Redirect
+        redirect-https:
+          redirectScheme:
+            scheme: https
+            permanent: true
+        # Cloudflare IP Whitelist
+        cloudflare-ipwhitelist:
+          ipWhiteList:
+            sourceRange:
+              - "173.245.48.0/20"
+              - "103.21.244.0/22"
+              - "103.22.200.0/22"
+              - "103.31.4.0/22"
+              - "141.101.64.0/18"
+              - "108.162.192.0/18"
+              - "190.93.240.0/20"
+              - "188.114.96.0/20"
+              - "197.234.240.0/22"
+              - "198.41.128.0/17"
+              - "162.158.0.0/15"
+              - "104.16.0.0/13"
+              - "104.24.0.0/14"
+              - "172.64.0.0/13"
+              - "131.0.72.0/22"
+
+        # Authentik + secure headers
+        security-chain:
+          chain:
+            middlewares:
+              - authentik@file
+              - security-headers@file
+        authentik:
+          forwardAuth:
+            address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
+            trustForwardHeader: true
+            maxResponseBodySize: 1048576
+            authResponseHeaders:
+              - X-authentik-username
+              - X-authentik-groups
+              - X-authentik-email
+              - X-authentik-name
+              - X-authentik-uid
+              - X-authentik-jwt
+              - X-authentik-meta-jwks
+              - X-authentik-meta-outpost
+              - X-authentik-meta-provider
+              - X-authentik-meta-app
+              - X-authentik-meta-version
+
+        # Security Headers
+        security-headers:
+          headers:
+            browserXssFilter: true
+            contentTypeNosniff: true
+            forceSTSHeader: true
+            stsIncludeSubdomains: true
+            stsPreload: true
+            stsSeconds: 31536000
+            customFrameOptionsValue: "SAMEORIGIN"
+            customResponseHeaders:
+              X-Content-Type-Options: "nosniff"
+              Referrer-Policy: "strict-origin-when-cross-origin"
+
+        # Nextcloud specific headers
+        nextcloud-secure-headers:
+          headers:
+            hostsProxyHeaders:
+              - "X-Forwarded-Host"
+              - "X-Forwarded-Proto"
+            referrerPolicy: "same-origin"
+            customFrameOptionsValue: "SAMEORIGIN"
+
+        # Rate limiting
+        rate-limit:
+          rateLimit:
+            average: 100
+            burst: 50
+            period: 1m
+
+        # Nextcloud chain
+        nextcloud-chain:
+          chain:
+            middlewares:
+              - nextcloud-secure-headers@file
+              - security-headers@file
+
+        # Error pages
+        error-pages:
+          errors:
+            status:
+              - "400"
+              - "402-599"
+            service: error-pages-service.error-pages@kubernetescrd
+            query: /{status}.html
+  tls.yml: |
+    # TLS Configuration
+    tls:
+      options:
+        default:
+          minVersion: VersionTLS12
+          sniStrict: false
+          cipherSuites:
+            - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+            - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+            - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
@@ -0,0 +1,81 @@
+# Auto-generated by forust | See https://github.com/traefik/traefik-helm-chart/blob/master/values.yaml
+
+hostNetwork: true
+
+api:
+  dashboard: true
+  insecure: true
+
+deployment:
+  initContainers:
+    - name: volume-permissions
+      image: busybox:latest
+      command:
+        - sh
+        - -c
+        - "mkdir -p /data/letsencrypt && touch /data/letsencrypt/acme.json && chmod 600 /data/letsencrypt/acme.json"
+      volumeMounts:
+        - name: data
+          mountPath: /data
+
+providers:
+  kubernetesIngress:
+    enabled: false
+  kubernetesCRD:
+    enabled: true
+  kubernetesGateway:
+    enabled: false
+  file:
+    enabled: false
+
+# Entrypoints
+ports:
+  web:
+    port: 80
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+          permanent: true
+  websecure:
+    port: 443
+    http:
+      tls:
+        enabled: true
+  ssh:
+    port: 2221
+
+ingressRoute:
+  dashboard:
+    enabled: false
+
+persistence:
+  enabled: true
+  size: 100Mi
+  path: /data
+
+certificatesResolvers:
+  letsencrypt-staging:
+    acme:
+      email: bobrovod@national.shitposting.agency
+      storage: /data/letsencrypt/acme.json
+      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
+      httpChallenge:
+        entryPoint: web
+
+volumes:
+  - name: traefik-dynamic
+    mountPath: /etc/traefik/dynamic
+    type: configMap
+
+additionalArguments:
+  - "--providers.file.directory=/etc/traefik/dynamic"
+  - "--providers.file.watch=true"
+
+logs:
+  general:
+    level: INFO
+    format: json
+  access:
+    enabled: true