chore(deploy): enable netbird

Reviewed-on: #51

.gitea/workflows/deploy-lib.sh

@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+# Shared stages for the deploy workflow. Runs on the workstation, invoked as:
+#   REPO=/srv/homelab APPLY_PRUNE=false bash -se <<'EOF'
+#   source "$REPO/.gitea/workflows/deploy-lib.sh"
+#   run_stage "$STAGE"
+# EOF
+set -euo pipefail
+
+: "${REPO:?REPO must be set}"
+APPLY_PRUNE="${APPLY_PRUNE:-false}"
+
+log() {
+  echo "== $* =="
+}
+
+collect_k8s() {
+  git -C "$REPO" ls-files -- "$1" \
+    | grep -E '\.ya?ml$' \
+    | grep -Ev '/overlays/' \
+    | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$' \
+    | grep -Ev '(^|/)[^/]*secret[^/]*\.ya?ml$' \
+    | sort
+}
+
+kustomize_overlay() {
+  if [ -f "$1/overlays/prod/kustomization.yaml" ]; then
+    echo "$1/overlays/prod"
+  elif [ -f "$1/base/kustomization.yaml" ]; then
+    echo "$1/base"
+  fi
+}
+
+select_manifests() {
+  K8S_MANIFESTS=()
+  KUSTOMIZE_APPS=()
+  COMPOSE_STACKS=()
+  local kd_rel kd overlay cf_rel cf f
+  while IFS= read -r kd_rel; do
+    kd="$REPO/$kd_rel"
+    if [ ! -f "$kd/active" ]; then
+      echo "skip (no k8s/active): $kd_rel"
+      continue
+    fi
+    overlay="$(kustomize_overlay "$kd" || true)"
+    if [ -n "${overlay:-}" ]; then
+      echo "kustomize app: ${overlay#$REPO/}"
+      KUSTOMIZE_APPS+=("$overlay")
+    else
+      while IFS= read -r f; do
+        [ -n "$f" ] && K8S_MANIFESTS+=("$REPO/$f")
+      done < <(collect_k8s "$kd_rel" || true)
+    fi
+  done < <(
+    git -C "$REPO" ls-files '*.yaml' '*.yml' \
+      | grep -E '(^|/)k8s/' \
+      | sed -E 's#((^|.*/)k8s)/.*#\1#' \
+      | sort -u
+  )
+  while IFS= read -r cf_rel; do
+    cf="$REPO/$cf_rel"
+    if [ -f "$(dirname "$cf")/active" ]; then
+      echo "compose: $cf_rel"
+      COMPOSE_STACKS+=("$cf")
+    else
+      echo "skip (no root active): $cf_rel"
+    fi
+  done < <(git -C "$REPO" ls-files '*/compose.yaml' '*/compose.yml' compose.yaml compose.yml | sort)
+}
+
+stage_preflight() {
+  if [ ! -d "$REPO/.git" ]; then
+    echo "Repository not found at $REPO"
+    exit 1
+  fi
+  git -C "$REPO" fetch origin main
+  log "Workstation state"
+  echo "  local:  $(git -C "$REPO" rev-parse --short HEAD)"
+  echo "  remote: $(git -C "$REPO" rev-parse --short origin/main)"
+  if [ -n "$(git -C "$REPO" status --porcelain --untracked-files=no)" ]; then
+    echo "ERROR: workstation has local tracked modifications, refusing reset:"
+    git -C "$REPO" status --porcelain --untracked-files=no
+    git -C "$REPO" diff --stat
+    exit 1
+  fi
+  git -C "$REPO" reset --hard origin/main
+}
+
+stage_validate() {
+  cd "$REPO"
+  select_manifests
+  local m k cf
+  log "Validate compose stacks"
+  for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
+    echo "  config: $cf"
+    docker compose -f "$cf" config --quiet
+  done
+  log "Validate k8s manifests (kubectl dry-run=client)"
+  for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    kubectl apply --dry-run=client -f "$m" >/dev/null
+  done
+  for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do
+    kubectl apply -k "$k" --dry-run=client >/dev/null
+  done
+  log "Validate k8s manifests (kubectl dry-run=server)"
+  for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    kubectl apply --dry-run=server -f "$m" >/dev/null
+  done
+  for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do
+    kubectl apply -k "$k" --dry-run=server >/dev/null
+  done
+  log "Checking referenced Secrets exist"
+  echo "  (deploy never applies *secret*.yaml; create missing ones from the laptop)"
+  local ref_secrets=() missing_secrets=() all_secrets s
+  if [ "${#K8S_MANIFESTS[@]}" -gt 0 ]; then
+    while IFS= read -r s; do
+      [ -n "$s" ] && ref_secrets+=("$s")
+    done < <(
+      {
+        grep -h -A1 -E 'secretRef:|secretKeyRef:' "${K8S_MANIFESTS[@]}" 2>/dev/null || true
+        grep -h -E 'secretName:' "${K8S_MANIFESTS[@]}" 2>/dev/null || true
+      } | grep -E 'name:' | sed -E 's/.*name:[[:space:]]*//' | tr -d '"'"'"' "'"'" | sed -E 's/[[:space:]]*#.*//' | awk 'NF' | sort -u || true
+    )
+  fi
+  all_secrets="$(kubectl get secrets -A --no-headers -o custom-columns=:metadata.name 2>/dev/null || true)"
+  for s in ${ref_secrets[@]+"${ref_secrets[@]}"}; do
+    if printf '%s\n' "$all_secrets" | grep -qx "$s"; then
+      echo "  ok: $s"
+    else
+      echo "  MISSING: $s"
+      missing_secrets+=("$s")
+    fi
+  done
+  if [ "${#missing_secrets[@]}" -gt 0 ]; then
+    echo "ERROR: ${#missing_secrets[@]} referenced Secret(s) not found in the cluster:"
+    printf '  - %s\n' "${missing_secrets[@]}"
+    echo "Create them manually from the laptop, e.g.:"
+    echo "  kubectl apply -f SERVICE/k8s/secrets.yaml  # see SERVICE/k8s/secrets.yaml.example"
+    exit 1
+  fi
+}
+
+stage_apply_k8s() {
+  cd "$REPO"
+  select_manifests >/dev/null
+  local ns_files=() other_files=() m k prune_opts=()
+  for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    case "$m" in
+      */namespace.y?ml) ns_files+=("$m") ;;
+      *) other_files+=("$m") ;;
+    esac
+  done
+  if [ "$APPLY_PRUNE" = "true" ]; then
+    prune_opts=(--prune -l app.kubernetes.io/managed-by=homelab-deploy)
+  fi
+  if [ "${#ns_files[@]}" -gt 0 ]; then
+    log "Applying namespaces (${#ns_files[@]} files)"
+    for m in "${ns_files[@]}"; do
+      kubectl apply -f "$m"
+    done
+  fi
+  if [ -f "$REPO/prometheus-stack/k8s/active" ]; then
+    if [ ! -f "$REPO/prometheus-stack/k8s/grafana-values.yaml" ]; then
+      echo "ERROR: prometheus-stack/k8s/grafana-values.yaml (gitignored) missing on workstation, restore it first."
+      exit 1
+    fi
+    log "Upgrading kube-prometheus-stack"
+    helm upgrade --install prometheus-stack prometheus-community/kube-prometheus-stack \
+      --namespace prometheus \
+      --version 86.2.3 \
+      --values "$REPO/prometheus-stack/k8s/grafana-values.yaml" \
+      --wait --timeout 10m
+  fi
+  if [ -f "$REPO/loki/k8s/active" ]; then
+    log "Upgrading loki/alloy"
+    helm repo add grafana https://grafana.github.io/helm-charts >/dev/null 2>&1 || true
+    helm repo update grafana >/dev/null 2>&1 || true
+    helm upgrade --install loki grafana/loki \
+      --version 7.3.0 \
+      --namespace prometheus \
+      --values "$REPO/loki/k8s/loki-values.yaml" \
+      --wait --timeout 10m
+    helm upgrade --install alloy grafana/alloy \
+      --version 1.12.1 \
+      --namespace prometheus \
+      --values "$REPO/loki/k8s/alloy-values.yaml" \
+      --wait --timeout 10m
+  fi
+  if [ "${#other_files[@]}" -gt 0 ]; then
+    log "Applying resources (${#other_files[@]} files)"
+    for m in "${other_files[@]}"; do
+      kubectl apply "${prune_opts[@]}" -f "$m"
+    done
+  fi
+  for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do
+    log "Applying kustomize app: ${k#$REPO/}"
+    kubectl apply -k "$k"
+  done
+  if [ -f "$REPO/userbot/k8s/active" ]; then
+    log "userbot panel hook"
+    if kubectl get secret userbot-common-secrets -n userbot >/dev/null 2>&1; then
+      echo "  userbot-common-secrets already present in userbot ns, not touching"
+    elif kubectl get secret userbot-common-secrets -n default >/dev/null 2>&1; then
+      echo "  bootstrapping userbot-common-secrets into userbot ns"
+      kubectl get secret userbot-common-secrets -n default -o json \
+        | jq 'del(.metadata.annotations,.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields) | .metadata.namespace = "userbot"' \
+        | kubectl apply -f -
+    else
+      echo "  WARNING: userbot-common-secrets missing in both default and userbot ns; create it manually from the laptop"
+    fi
+    kubectl rollout restart deployment/userbot-panel -n userbot
+    kubectl rollout status deployment/userbot-panel -n userbot --timeout=180s
+  fi
+}
+
+stage_apply_compose() {
+  cd "$REPO"
+  select_manifests >/dev/null
+  local cf
+  log "Redeploying docker compose stacks (${#COMPOSE_STACKS[@]} stacks)"
+  for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
+    echo "  compose: $cf"
+    if grep -Eq '^\s+pull_policy:\s*build\b' "$cf"; then
+      docker compose -f "$cf" build
+      docker compose -f "$cf" push
+    fi
+    docker compose -f "$cf" up -d --pull always --remove-orphans
+  done
+}
+
+run_stage() {
+  case "${1:?stage required}" in
+    preflight) stage_preflight ;;
+    validate) stage_validate ;;
+    apply-k8s) stage_apply_k8s ;;
+    apply-compose) stage_apply_compose ;;
+    *)
+      echo "ERROR: unknown stage: $1"
+      exit 1
+      ;;
+  esac
+}

.gitea/workflows/deploy.yaml

@@ -10,298 +10,62 @@ concurrency:
   group: deploy-main
   cancel-in-progress: false
 
-jobs:
-  redeploy:
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    steps:
-      - name: Redeploy workstation
-        shell: bash
-        env:
+env:
   DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
   DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
   DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
   DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
   DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
   APPLY_PRUNE: ${{ vars.APPLY_PRUNE }}
+
+jobs:
+  preflight:
+    runs-on: [self-hosted, linux, arch, homelab, prod]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Fetch and reset workstation
+        shell: bash
         run: |
           set -euo pipefail
+          ./.gitea/workflows/ssh-run.sh preflight
 
-          : "${DEPLOY_HOST:?missing DEPLOY_HOST}"
-          : "${DEPLOY_USER:?missing DEPLOY_USER}"
-          : "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"
+  validate:
+    needs: [preflight]
+    runs-on: [self-hosted, linux, arch, homelab, prod]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-          deploy_port="${DEPLOY_PORT:-22}"
-          deploy_path="${DEPLOY_PATH:-/srv/homelab}"
-
-          ssh_key="$RUNNER_TEMP/deploy_key"
-          mkdir -p "$RUNNER_TEMP"
-          printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
-          chmod 600 "$ssh_key"
-
-          ssh_opts=(
-            -i "$ssh_key"
-            -p "$deploy_port"
-            -o BatchMode=yes
-            -o StrictHostKeyChecking=accept-new
-          )
-
-          ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
-            "DEPLOY_PATH=$(printf '%q' \"$deploy_path\") APPLY_PRUNE=$(printf '%q' \"${APPLY_PRUNE:-false}\") bash -se" <<'EOF'
+      - name: Dry-run manifests and check Secrets
+        shell: bash
+        run: |
           set -euo pipefail
+          ./.gitea/workflows/ssh-run.sh validate
 
-          repo="${DEPLOY_PATH:-/srv/homelab}"
+  apply-k8s:
+    needs: [validate]
+    runs-on: [self-hosted, linux, arch, homelab, prod]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-          if [ ! -d "$repo/.git" ]; then
-            echo "Repository not found at $repo"
-            exit 1
-          fi
+      - name: Apply Kubernetes manifests
+        shell: bash
+        run: |
+          set -euo pipefail
+          ./.gitea/workflows/ssh-run.sh apply-k8s
 
-          git -C "$repo" fetch origin main
+  apply-compose:
+    needs: [validate]
+    runs-on: [self-hosted, linux, arch, homelab, prod]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-          echo "== Workstation state =="
-          echo "  local:  $(git -C "$repo" rev-parse --short HEAD)"
-          echo "  remote: $(git -C "$repo" rev-parse --short origin/main)"
-
-          if [ -n "$(git -C "$repo" status --porcelain --untracked-files=no)" ]; then
-            echo "ERROR: workstation has local tracked modifications, refusing reset:"
-            git -C "$repo" status --porcelain --untracked-files=no
-            git -C "$repo" diff --stat
-            exit 1
-          fi
-
-          git -C "$repo" reset --hard origin/main
-          cd "$repo"
-
-          is_disabled() {
-            local target="$1"
-            if [ -f "$target" ]; then
-              target="$(dirname "$target")"
-            fi
-            while true; do
-              if [ -f "$target/DISABLED" ]; then
-                return 0
-              fi
-              if [ "$target" = "$repo" ]; then
-                break
-              fi
-              target="$(dirname "$target")"
-              case "$target" in
-                "$repo"/*) ;;
-                *) break ;;
-              esac
-            done
-            return 1
-          }
-
-          collect_k8s() {
-            git ls-files -- "$1" \
-              | grep -E '\.ya?ml$' \
-              | grep -Ev '/routing/|/overlays/' \
-              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$' \
-              | grep -Ev '(^|/)[^/]*secret[^/]*\.ya?ml$' \
-              | sort
-          }
-
-          collect_k8s_inactive() {
-            collect_k8s "$1" \
-              | grep -E '(^|/)namespace\.ya?ml$|/routing/'
-          }
-
-          kustomize_overlay() {
-            if [ -f "$1/overlays/prod/kustomization.yaml" ]; then
-              echo "$1/overlays/prod"
-            elif [ -f "$1/base/kustomization.yaml" ]; then
-              echo "$1/base"
-            fi
-          }
-
-          mapfile -t k8s_dirs < <(
-            git ls-files '*.yaml' '*.yml' \
-              | grep -E '(^|/)k8s/' \
-              | sed -E 's#((^|.*/)k8s)/.*#\1#' \
-              | sort -u
-          )
-
-          k8s_manifests=()
-          kustomize_apps=()
-          for kd_rel in "${k8s_dirs[@]}"; do
-            kd="$repo/$kd_rel"
-            if is_disabled "$kd"; then
-              echo "skip (DISABLED): $kd_rel"
-              continue
-            fi
-            if [ -f "$kd/active" ]; then
-              overlay="$(kustomize_overlay "$kd" || true)"
-              if [ -n "${overlay:-}" ]; then
-                echo "kustomize app: ${overlay#$repo/}"
-                kustomize_apps+=("$overlay")
-              else
-                while IFS= read -r f; do
-                  [ -n "$f" ] && k8s_manifests+=("$repo/$f")
-                done < <(collect_k8s "$kd_rel" || true)
-              fi
-            else
-              while IFS= read -r f; do
-                [ -n "$f" ] && k8s_manifests+=("$repo/$f")
-              done < <(collect_k8s_inactive "$kd_rel" || true)
-            fi
-          done
-
-          mapfile -t compose_rel < <(
-            git ls-files '*/compose.yaml' '*/compose.yml' compose.yaml compose.yml | sort
-          )
-
-          compose_stacks=()
-          for cf_rel in "${compose_rel[@]}"; do
-            cf="$repo/$cf_rel"
-            if is_disabled "$cf"; then
-              echo "skip (DISABLED): $cf_rel"
-              continue
-            fi
-            if [ -f "$(dirname "$cf")/k8s/active" ]; then
-              echo "skip (k8s-managed): $cf_rel"
-              continue
-            fi
-            compose_stacks+=("$cf")
-          done
-
-          echo "== Validate compose stacks =="
-          for cf in "${compose_stacks[@]}"; do
-            echo "  config: $cf"
-            docker compose -f "$cf" config --quiet
-          done
-
-          echo "== Validate k8s manifests (kubectl dry-run=client) =="
-          for m in "${k8s_manifests[@]}"; do
-            echo "  apply --dry-run=client $m"
-            kubectl apply --dry-run=client -f "$m" >/dev/null
-          done
-          for k in "${kustomize_apps[@]}"; do
-            echo "  apply -k --dry-run=client $k"
-            kubectl apply -k "$k" --dry-run=client >/dev/null
-          done
-
-          echo "== Validate k8s manifests (kubectl dry-run=server) =="
-          for m in "${k8s_manifests[@]}"; do
-            echo "  apply --dry-run=server $m"
-            kubectl apply --dry-run=server -f "$m" >/dev/null
-          done
-          for k in "${kustomize_apps[@]}"; do
-            echo "  apply -k --dry-run=server $k"
-            kubectl apply -k "$k" --dry-run=server >/dev/null
-          done
-
-          echo "== Checking referenced Secrets exist =="
-          echo "  (deploy never applies *secret*.yaml; create missing ones from the laptop)"
-          ref_secrets=()
-          if [ "${#k8s_manifests[@]}" -gt 0 ]; then
-            while IFS= read -r s; do
-              [ -n "$s" ] && ref_secrets+=("$s")
-            done < <(
-              {
-                grep -h -A1 -E 'secretRef:|secretKeyRef:' "${k8s_manifests[@]}" 2>/dev/null || true
-                grep -h -E 'secretName:' "${k8s_manifests[@]}" 2>/dev/null || true
-              } | grep -E 'name:' | sed -E 's/.*name:[[:space:]]*//' | tr -d '"'"'"' "'"'" | sed -E 's/[[:space:]]*#.*//' | awk 'NF' | sort -u || true
-            )
-          fi
-          missing_secrets=()
-          all_secrets="$(kubectl get secrets -A --no-headers -o custom-columns=:metadata.name 2>/dev/null || true)"
-          for s in "${ref_secrets[@]}"; do
-            if printf '%s\n' "$all_secrets" | grep -qx "$s"; then
-              echo "  ok: $s"
-            else
-              echo "  MISSING: $s"
-              missing_secrets+=("$s")
-            fi
-          done
-          if [ "${#missing_secrets[@]}" -gt 0 ]; then
-            echo "ERROR: ${#missing_secrets[@]} referenced Secret(s) not found in the cluster:"
-            printf '  - %s\n' "${missing_secrets[@]}"
-            echo "Create them manually from the laptop, e.g.:"
-            echo "  kubectl apply -f SERVICE/k8s/secrets.yaml  # see SERVICE/k8s/secrets.yaml.example"
-            exit 1
-          fi
-
-          echo "== Applying Kubernetes manifests =="
-          ns_files=()
-          other_files=()
-          for m in "${k8s_manifests[@]}"; do
-            case "$m" in
-              */namespace.y?ml) ns_files+=("$m") ;;
-              *) other_files+=("$m") ;;
-            esac
-          done
-
-          prune_opts=()
-          if [ "${APPLY_PRUNE:-false}" = "true" ]; then
-            prune_opts=(--prune -l app.kubernetes.io/managed-by=homelab-deploy)
-          fi
-
-          if [ "${#ns_files[@]}" -gt 0 ]; then
-            echo "  namespaces first: ${ns_files[*]}"
-            kubectl apply -f "${ns_files[@]}"
-          fi
-          if [ -f "$repo/prometheus-stack/k8s/active" ] && ! is_disabled "$repo/prometheus-stack/k8s"; then
-            if [ ! -f "$repo/prometheus-stack/k8s/grafana-values.yaml" ]; then
-              echo "ERROR: prometheus-stack/k8s/grafana-values.yaml (gitignored) missing on workstation, restore it first."
-              exit 1
-            fi
-            echo "== Upgrading kube-prometheus-stack =="
-            helm upgrade --install prometheus-stack prometheus-community/kube-prometheus-stack \
-              --namespace prometheus \
-              --version 86.2.3 \
-              --values "$repo/prometheus-stack/k8s/grafana-values.yaml" \
-              --wait --timeout 10m
-          fi
-          if [ -f "$repo/loki/k8s/active" ] && ! is_disabled "$repo/loki/k8s"; then
-            echo "== Upgrading loki/alloy =="
-            helm repo add grafana https://grafana.github.io/helm-charts >/dev/null 2>&1 || true
-            helm repo update grafana >/dev/null 2>&1 || true
-            helm upgrade --install loki grafana/loki \
-              --version 7.3.0 \
-              --namespace prometheus \
-              --values "$repo/loki/k8s/loki-values.yaml" \
-              --wait --timeout 10m
-            helm upgrade --install alloy grafana/alloy \
-              --version 1.12.1 \
-              --namespace prometheus \
-              --values "$repo/loki/k8s/alloy-values.yaml" \
-              --wait --timeout 10m
-          fi
-
-          if [ "${#other_files[@]}" -gt 0 ]; then
-            echo "  resources: ${other_files[*]}"
-            kubectl apply "${prune_opts[@]}" -f "${other_files[@]}"
-          fi
-
-          for k in "${kustomize_apps[@]}"; do
-            echo "== Applying kustomize app: ${k#$repo/} =="
-            kubectl apply -k "$k"
-          done
-
-          if [ -f "$repo/userbot/k8s/active" ] && ! is_disabled "$repo/userbot"; then
-            echo "== userbot panel hook =="
-            if kubectl get secret userbot-common-secrets -n userbot >/dev/null 2>&1; then
-              echo "  userbot-common-secrets already present in userbot ns, not touching"
-            elif kubectl get secret userbot-common-secrets -n default >/dev/null 2>&1; then
-              echo "  bootstrapping userbot-common-secrets into userbot ns"
-              kubectl get secret userbot-common-secrets -n default -o json \
-                | jq 'del(.metadata.annotations,.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields) | .metadata.namespace = "userbot"' \
-                | kubectl apply -f -
-            else
-              echo "  WARNING: userbot-common-secrets missing in both default and userbot ns; create it manually from the laptop"
-            fi
-            kubectl rollout restart deployment/userbot-panel -n userbot
-            kubectl rollout status deployment/userbot-panel -n userbot --timeout=180s
-          fi
-
-          echo "== Redeploying docker compose stacks =="
-          for cf in "${compose_stacks[@]}"; do
-            echo "  compose: $cf"
-            if grep -Eq '^\s+pull_policy:\s*build\b' "$cf"; then
-              docker compose -f "$cf" build
-              docker compose -f "$cf" push
-            fi
-            docker compose -f "$cf" up -d --pull always --remove-orphans
-          done
-          EOF
+      - name: Redeploy docker compose stacks
+        shell: bash
+        run: |
+          set -euo pipefail
+          ./.gitea/workflows/ssh-run.sh apply-compose

.gitea/workflows/ssh-run.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# usage: ssh-run.sh <stage>
+# Runs one deploy-lib.sh stage on the workstation over SSH.
+set -euo pipefail
+
+: "${DEPLOY_HOST:?missing DEPLOY_HOST}"
+: "${DEPLOY_USER:?missing DEPLOY_USER}"
+: "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"
+
+deploy_port="${DEPLOY_PORT:-22}"
+deploy_path="${DEPLOY_PATH:-/srv/homelab}"
+deploy_path="$(printf '%s' "$deploy_path" | tr -d '\"' | tr -d '\r' | xargs)"
+
+ssh_key="$RUNNER_TEMP/deploy_key"
+mkdir -p "$RUNNER_TEMP"
+printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
+chmod 600 "$ssh_key"
+
+ssh -i "$ssh_key" -p "$deploy_port" \
+  -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
+  "${DEPLOY_USER}@${DEPLOY_HOST}" \
+  "REPO=$deploy_path APPLY_PRUNE=${APPLY_PRUNE:-false} STAGE=$1 bash -se" <<'EOF'
+source "$REPO/.gitea/workflows/deploy-lib.sh"
+run_stage "$STAGE"
+EOF

.gitignore

@@ -21,6 +21,9 @@ checkmk/checkmk/*
 downtify/Downtify_downloads
 headscale/config/*
 headscale/data/*
+# NetBird local hostnames and generated secrets
+netbird/.env
+netbird/secrets/
 searxng/core-config/*
 
 # Steaming services files

dockmon/compose.yaml

@@ -1,6 +1,6 @@
 services:
   dockmon:
-    image: darthnorse/dockmon:2.4.5
+    image: darthnorse/dockmon:2.5.0
     container_name: dockmon
     restart: unless-stopped
     # ports:

dockmon/k8s/dockmon.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: dockmon
-          image: darthnorse/dockmon:2.4.5
+          image: darthnorse/dockmon:2.5.0
           ports:
             - containerPort: 443
           volumeMounts:

downtify/compose.yaml

@@ -1,7 +1,7 @@
 services:
   downtify:
     container_name: downtify
-    image: ghcr.io/henriquesebastiao/downtify:2.13.0
+    image: ghcr.io/henriquesebastiao/downtify:3.1.0
     restart: unless-stopped
     # ports:
     #   - '7077:8000'

downtify/k8s/downtify.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: downtify
-          image: ghcr.io/henriquesebastiao/downtify:2.13.0
+          image: ghcr.io/henriquesebastiao/downtify:3.1.0
           ports:
             - containerPort: 8000
           volumeMounts:

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.40.3
+    image: docker.n8n.io/n8nio/n8n:2.41.0
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.40.3
+          image: docker.n8n.io/n8nio/n8n:2.41.0
           envFrom:
             - configMapRef:
                 name: n8n-config

netbird/.env.example

@@ -0,0 +1,13 @@
+# Public hostname advertised to NetBird clients and used for TLS/OAuth.
+NETBIRD_DOMAIN=nb.forust.xyz
+
+# Internal-only aliases routed by the existing Traefik instance.
+NETBIRD_LOCAL_DOMAIN=netbird.workstation.internal
+NETBIRD_DEV_DOMAIN=netbird.gigaforust.internal
+
+NETBIRD_PROXY_SUBNET=auto
+
+NETBIRD_CLIENT_HOSTNAME=hostname
+
+# Add a dashboard-generated setup key before starting client.compose.yaml.
+# NB_SETUP_KEY=

netbird/README.md

@@ -0,0 +1,123 @@
+# NetBird
+
+Self-hosted NetBird with the combined management, signal, relay, and STUN server. The dashboard and server run behind the repository's existing external Traefik instance on the Docker `proxy` network. Only STUN UDP `3478` is published directly.
+
+The deployment uses SQLite for a single-instance homelab server. The persistent `netbird_data` volume and the datastore encryption key are both required to recover the installation.
+
+## Files
+
+- `compose.yaml`: dashboard and combined server; selected by the marker-driven deploy workflow through `active`.
+- `config.template.yaml`: non-secret server configuration rendered at startup.
+- `entrypoint.sh`: injects Docker secrets into an in-memory runtime configuration.
+- `client.compose.yaml`: optional host-network peer using a dashboard-generated setup key.
+- `.env`: ignored local hostnames, the detected Traefik Docker-network subnet, and optional client setup key.
+- `secrets/`: ignored relay secret and datastore encryption key.
+
+## First deployment
+
+Run these commands on the Docker host before merging the activating branch. The deploy preflight resets tracked files but preserves ignored local state.
+
+```bash
+cd /srv/homelab/netbird
+./setup.sh
+$EDITOR .env
+docker compose config --quiet
+docker compose up -d
+```
+
+Review the values in `.env` before starting. The example public hostname is `netbird.forust.xyz`; change it if a different public domain was selected. `setup.sh` replaces `NETBIRD_PROXY_SUBNET=auto` with the first IPv4 subnet of the external Docker `proxy` network. Keep that value synchronized with the network; set an explicit CIDR instead if the network is managed elsewhere.
+
+`setup.sh` is idempotent and never replaces existing secrets. Do not delete or regenerate `secrets/datastore-encryption-key` after the first successful start unless all encrypted setup keys and API tokens are intentionally being invalidated.
+
+## Network prerequisites
+
+- Point the public hostname directly to the Docker host. Do not proxy UDP `3478` through Cloudflare or another CDN.
+- Allow inbound TCP `80`, TCP `443`, and UDP `3478` through the host firewall and upstream router.
+- Ensure the external `proxy` Docker network exists and Traefik uses its `websecure` entrypoint and `letsencrypt` resolver. `NETBIRD_PROXY_SUBNET` must describe that network; it is used to trust only forwarded client addresses from Traefik.
+- Ensure the internal names in `.env` resolve where the local and development aliases are needed.
+- Keep Traefik's `websecure` read timeout disabled for long-lived gRPC and WebSocket sessions. This repository configures `--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0` in `traefik/compose.yaml`.
+
+After startup, verify OIDC discovery through the public TLS endpoint:
+
+```bash
+curl -fsS "https://${NETBIRD_DOMAIN}/oauth2/.well-known/openid-configuration"
+```
+
+Open `https://${NETBIRD_DOMAIN}` immediately and complete the initial owner setup. Treat the initial setup flow as public until the owner exists.
+
+## Optional host client
+
+The client intentionally lives in a separate Compose project. Normal server deploys use `--remove-orphans`, so keeping the client in the server project would cause it to be removed.
+
+1. Create a reusable or ephemeral setup key in the NetBird dashboard.
+2. Put `NB_SETUP_KEY=<key>` in the ignored `netbird/.env` file.
+3. Set `NETBIRD_CLIENT_HOSTNAME` to this machine's desired peer name.
+4. Start and inspect the client:
+
+```bash
+cd /srv/homelab/netbird
+docker compose -f client.compose.yaml config --quiet
+docker compose -f client.compose.yaml up -d
+docker compose -f client.compose.yaml exec netbird-client netbird status
+```
+
+The client uses host networking and requires `NET_ADMIN`, `SYS_ADMIN`, `SYS_RESOURCE`, and `/dev/net/tun`. Remove it without affecting the server stack:
+
+```bash
+docker compose -f client.compose.yaml down
+```
+
+## Operations
+
+Inspect status and logs:
+
+```bash
+docker compose ps
+docker compose logs --tail=200 netbird-server dashboard
+```
+
+Stop or remove containers without deleting data:
+
+```bash
+docker compose down
+```
+
+Do not add `-v` to `docker compose down`; it would delete the NetBird datastore.
+
+## Backup and restore
+
+Back up both the persistent volume and the ignored secret files. For a consistent SQLite backup, briefly stop the server first and store the resulting archive and `datastore-encryption-key` in an encrypted backup:
+
+```bash
+cd /srv/homelab/netbird
+mkdir -p backups
+docker compose stop netbird-server
+docker run --rm \
+  -v netbird_data:/data:ro \
+  -v "$PWD/backups:/backup" \
+  busybox:1.37.0 \
+  tar -C /data -czf "/backup/netbird-data-$(date -u +%Y%m%dT%H%M%SZ).tar.gz" .
+docker compose start netbird-server
+```
+
+Also securely back up:
+
+- `secrets/datastore-encryption-key` — required to decrypt stored secrets.
+- `secrets/relay-auth-secret` — keeps issued relay credentials valid across restoration.
+- `netbird/.env` — optional, but it records the public and internal hostnames.
+
+Test a restore in an isolated Docker host before relying on a backup.
+
+## Upgrade
+
+1. Take and verify a backup.
+2. Review NetBird release notes for server, client, and dashboard compatibility.
+3. Update the pinned tags in `compose.yaml`; update `client.compose.yaml` separately when deploying the client.
+4. Pull and recreate the selected services:
+
+```bash
+docker compose pull
+docker compose up -d
+```
+
+The image tags are intentionally pinned instead of using `latest`, matching this repository's pull-on-deploy policy.

netbird/client.compose.yaml

@@ -0,0 +1,31 @@
+name: netbird-client
+
+services:
+  netbird-client:
+    image: netbirdio/netbird:0.79.0
+    container_name: netbird-client
+    hostname: "${NETBIRD_CLIENT_HOSTNAME:?Set NETBIRD_CLIENT_HOSTNAME in netbird/.env}"
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_RESOURCE
+    devices:
+      - /dev/net/tun
+    network_mode: host
+    environment:
+      NB_SETUP_KEY: "${NB_SETUP_KEY:?Set NB_SETUP_KEY in netbird/.env after creating a peer setup key}"
+      NB_MANAGEMENT_URL: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
+    volumes:
+      - netbird-client:/var/lib/netbird
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/netbird", "status", "--check", "live"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    stop_grace_period: 30s
+
+volumes:
+  netbird-client:
+    name: netbird-client

netbird/compose.yaml

@@ -0,0 +1,152 @@
+name: netbird
+
+services:
+  netbird-server:
+    image: netbirdio/netbird-server:0.79.0
+    container_name: netbird-server
+    restart: unless-stopped
+    environment:
+      NETBIRD_DOMAIN: "${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
+      NETBIRD_PROXY_SUBNET: "${NETBIRD_PROXY_SUBNET:?Set NETBIRD_PROXY_SUBNET in netbird/.env (run setup.sh)}"
+    entrypoint:
+      - /bin/sh
+      - /opt/netbird/entrypoint.sh
+    command:
+      - --config
+      - /run/netbird/config.yaml
+    ports:
+      - "3478:3478/udp"
+    volumes:
+      - netbird_data:/var/lib/netbird
+      - ./config.template.yaml:/opt/netbird/config.template.yaml:ro
+      - ./entrypoint.sh:/opt/netbird/entrypoint.sh:ro
+    secrets:
+      - relay_auth_secret
+      - datastore_encryption_key
+    tmpfs:
+      - /run/netbird:mode=0700
+    healthcheck:
+      test:
+        - CMD
+        - bash
+        - -ec
+        - exec 3<>/dev/tcp/127.0.0.1/80
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    stop_grace_period: 30s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.netbird-server.loadbalancer.server.port=80"
+      - "traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80"
+      - "traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c"
+
+      # gRPC routers
+      # Prod Router
+      - "traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
+      - "traefik.http.routers.netbird-grpc.entrypoints=websecure"
+      - "traefik.http.routers.netbird-grpc.service=netbird-server-h2c"
+      - "traefik.http.routers.netbird-grpc.priority=100"
+      - "traefik.http.routers.netbird-grpc.tls=true"
+      - "traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.netbird-grpc-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
+      - "traefik.http.routers.netbird-grpc-local.entrypoints=websecure"
+      - "traefik.http.routers.netbird-grpc-local.service=netbird-server-h2c"
+      - "traefik.http.routers.netbird-grpc-local.priority=100"
+      - "traefik.http.routers.netbird-grpc-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.netbird-grpc-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
+      - "traefik.http.routers.netbird-grpc-dev.entrypoints=websecure"
+      - "traefik.http.routers.netbird-grpc-dev.service=netbird-server-h2c"
+      - "traefik.http.routers.netbird-grpc-dev.priority=100"
+      - "traefik.http.routers.netbird-grpc-dev.tls=true"
+
+      # Backend routers
+      # Prod Router
+      - "traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
+      - "traefik.http.routers.netbird-backend.entrypoints=websecure"
+      - "traefik.http.routers.netbird-backend.service=netbird-server"
+      - "traefik.http.routers.netbird-backend.priority=100"
+      - "traefik.http.routers.netbird-backend.tls=true"
+      - "traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.netbird-backend-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
+      - "traefik.http.routers.netbird-backend-local.entrypoints=websecure"
+      - "traefik.http.routers.netbird-backend-local.service=netbird-server"
+      - "traefik.http.routers.netbird-backend-local.priority=100"
+      - "traefik.http.routers.netbird-backend-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.netbird-backend-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
+      - "traefik.http.routers.netbird-backend-dev.entrypoints=websecure"
+      - "traefik.http.routers.netbird-backend-dev.service=netbird-server"
+      - "traefik.http.routers.netbird-backend-dev.priority=100"
+      - "traefik.http.routers.netbird-backend-dev.tls=true"
+    networks:
+      - proxy
+
+  dashboard:
+    image: netbirdio/dashboard:v2.90.10
+    container_name: netbird-dashboard
+    restart: unless-stopped
+    environment:
+      NETBIRD_MGMT_API_ENDPOINT: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
+      NETBIRD_MGMT_GRPC_API_ENDPOINT: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
+      AUTH_AUDIENCE: netbird-dashboard
+      AUTH_CLIENT_ID: netbird-dashboard
+      AUTH_CLIENT_SECRET: ""
+      AUTH_AUTHORITY: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}/oauth2"
+      AUTH_SUPPORTED_SCOPES: openid profile email groups
+      AUTH_REDIRECT_URI: /nb-auth
+      AUTH_SILENT_REDIRECT_URI: /nb-silent-auth
+      USE_AUTH0: "false"
+      LETSENCRYPT_DOMAIN: none
+    depends_on:
+      netbird-server:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "--show-error", "http://127.0.0.1/"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 15s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.netbird-dashboard.loadbalancer.server.port=80"
+      # Dashboard catch-all routers
+      # Prod Router
+      - "traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`)"
+      - "traefik.http.routers.netbird-dashboard.entrypoints=websecure"
+      - "traefik.http.routers.netbird-dashboard.service=netbird-dashboard"
+      - "traefik.http.routers.netbird-dashboard.priority=1"
+      - "traefik.http.routers.netbird-dashboard.tls=true"
+      - "traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.netbird-dashboard-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`)"
+      - "traefik.http.routers.netbird-dashboard-local.entrypoints=websecure"
+      - "traefik.http.routers.netbird-dashboard-local.service=netbird-dashboard"
+      - "traefik.http.routers.netbird-dashboard-local.priority=1"
+      - "traefik.http.routers.netbird-dashboard-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.netbird-dashboard-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`)"
+      - "traefik.http.routers.netbird-dashboard-dev.entrypoints=websecure"
+      - "traefik.http.routers.netbird-dashboard-dev.service=netbird-dashboard"
+      - "traefik.http.routers.netbird-dashboard-dev.priority=1"
+      - "traefik.http.routers.netbird-dashboard-dev.tls=true"
+    networks:
+      - proxy
+
+networks:
+  proxy:
+    external: true
+
+volumes:
+  netbird_data:
+    name: netbird_data
+
+secrets:
+  relay_auth_secret:
+    file: ./secrets/relay-auth-secret
+  datastore_encryption_key:
+    file: ./secrets/datastore-encryption-key

netbird/config.template.yaml

@@ -0,0 +1,26 @@
+server:
+  listenAddress: ":80"
+  exposedAddress: "https://__NETBIRD_DOMAIN__:443"
+  stunPorts:
+    - 3478
+  metricsPort: 9090
+  healthcheckAddress: ":9000"
+  logLevel: info
+  logFile: console
+  authSecret: "__NETBIRD_AUTH_SECRET__"
+  dataDir: "/var/lib/netbird"
+  disableAnonymousMetrics: true
+  auth:
+    issuer: "https://__NETBIRD_DOMAIN__/oauth2"
+    signKeyRefreshEnabled: true
+    dashboardRedirectURIs:
+      - "https://__NETBIRD_DOMAIN__/nb-auth"
+      - "https://__NETBIRD_DOMAIN__/nb-silent-auth"
+  reverseProxy:
+    trustedHTTPProxies:
+      - "__NETBIRD_PROXY_SUBNET__"
+    trustedPeers:
+      - "__NETBIRD_PROXY_SUBNET__"
+  store:
+    engine: sqlite
+    encryptionKey: "__NETBIRD_ENCRYPTION_KEY__"

netbird/k8s/certificates.yaml

@@ -0,0 +1,28 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: netbird-prod-tls
+  namespace: netbird
+spec:
+  secretName: netbird-prod-tls
+  dnsNames:
+    - nb.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: internal-wildcard-tls
+  namespace: netbird
+spec:
+  secretName: internal-wildcard-tls
+  dnsNames:
+    - "*.workstation.internal"
+    - "*.gigaforust.internal"
+    - workstation.internal
+    - gigaforust.internal
+  issuerRef:
+    name: internal-ca
+    kind: ClusterIssuer

netbird/k8s/config.yaml

@@ -0,0 +1,160 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-config
+  namespace: netbird
+data:
+  # Public hostname, rendered into the server config by entrypoint.sh.
+  NETBIRD_DOMAIN: "nb.forust.xyz"
+  NETBIRD_PROXY_SUBNET: "10.244.0.0/16"
+
+  NETBIRD_MGMT_API_ENDPOINT: "https://nb.forust.xyz"
+  NETBIRD_MGMT_GRPC_API_ENDPOINT: "https://nb.forust.xyz"
+  AUTH_AUDIENCE: "netbird-dashboard"
+  AUTH_CLIENT_ID: "netbird-dashboard"
+  AUTH_CLIENT_SECRET: ""
+  AUTH_AUTHORITY: "https://nb.forust.xyz/oauth2"
+  AUTH_SUPPORTED_SCOPES: "openid profile email groups"
+  AUTH_REDIRECT_URI: "/nb-auth"
+  AUTH_SILENT_REDIRECT_URI: "/nb-silent-auth"
+  USE_AUTH0: "false"
+  LETSENCRYPT_DOMAIN: "none"
+
+  config.template.yaml: |
+    server:
+      listenAddress: ":80"
+      exposedAddress: "https://__NETBIRD_DOMAIN__:443"
+      stunPorts:
+        - 3478
+      metricsPort: 9090
+      healthcheckAddress: ":9000"
+      logLevel: info
+      logFile: console
+      authSecret: "__NETBIRD_AUTH_SECRET__"
+      dataDir: "/var/lib/netbird"
+      disableAnonymousMetrics: true
+      auth:
+        issuer: "https://__NETBIRD_DOMAIN__/oauth2"
+        signKeyRefreshEnabled: true
+        dashboardRedirectURIs:
+          - "https://__NETBIRD_DOMAIN__/nb-auth"
+          - "https://__NETBIRD_DOMAIN__/nb-silent-auth"
+      reverseProxy:
+        trustedHTTPProxies:
+          - "__NETBIRD_PROXY_SUBNET__"
+        trustedPeers:
+          - "__NETBIRD_PROXY_SUBNET__"
+      store:
+        engine: sqlite
+        encryptionKey: "__NETBIRD_ENCRYPTION_KEY__"
+
+  entrypoint.sh: |
+    #!/bin/sh
+    set -eu
+
+    umask 077
+
+    TEMPLATE_PATH=/opt/netbird/config.template.yaml
+    RENDERED_PATH=/run/netbird/config.yaml
+    RELAY_SECRET_PATH=/run/secrets/relay_auth_secret
+    ENCRYPTION_KEY_PATH=/run/secrets/datastore_encryption_key
+
+    is_valid_proxy_subnet() {
+      candidate="$1"
+      case "$candidate" in
+        0.0.0.0/0)
+          return 1
+          ;;
+        */*)
+          address="${candidate%%/*}"
+          prefix="${candidate#*/}"
+          ;;
+        *)
+          return 1
+          ;;
+      esac
+
+      case "$prefix" in
+        0|[1-9]|[1-2][0-9]|3[0-2]) ;;
+        *)
+          return 1
+          ;;
+      esac
+
+      old_ifs="$IFS"
+      IFS=.
+      # shellcheck disable=SC2086
+      set -- $address
+      IFS="$old_ifs"
+      [ "$#" -eq 4 ] || return 1
+
+      for octet do
+        case "$octet" in
+          0|[1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]) ;;
+          *)
+            return 1
+            ;;
+        esac
+      done
+    }
+
+    read_secret() {
+      secret_path="$1"
+
+      if [ ! -r "$secret_path" ]; then
+        echo "Required secret is not readable: $secret_path" >&2
+        exit 1
+      fi
+
+      secret_value="$(cat "$secret_path")"
+      if [ -z "$secret_value" ]; then
+        echo "Required secret is empty: $secret_path" >&2
+        exit 1
+      fi
+
+      printf '%s' "$secret_value"
+    }
+
+    if [ -z "${NETBIRD_DOMAIN:-}" ]; then
+      echo "NETBIRD_DOMAIN must be set" >&2
+      exit 1
+    fi
+
+    case "$NETBIRD_DOMAIN" in
+      *[!A-Za-z0-9.-]*)
+        echo "NETBIRD_DOMAIN contains unsupported characters" >&2
+        exit 1
+        ;;
+    esac
+
+    if [ -z "${NETBIRD_PROXY_SUBNET:-}" ] || [ "$NETBIRD_PROXY_SUBNET" = "auto" ]; then
+      echo "NETBIRD_PROXY_SUBNET must be an explicit IPv4 CIDR; run netbird/setup.sh first" >&2
+      exit 1
+    fi
+    if ! is_valid_proxy_subnet "$NETBIRD_PROXY_SUBNET"; then
+      echo "NETBIRD_PROXY_SUBNET must be a non-default IPv4 CIDR, for example 172.20.0.0/16" >&2
+      exit 1
+    fi
+
+    if [ "$#" -ne 2 ] || [ "$1" != "--config" ] || [ "$2" != "$RENDERED_PATH" ]; then
+      echo "Expected: --config $RENDERED_PATH" >&2
+      exit 1
+    fi
+
+    relay_secret="$(read_secret "$RELAY_SECRET_PATH")"
+    encryption_key="$(read_secret "$ENCRYPTION_KEY_PATH")"
+
+    mkdir -p "$(dirname "$RENDERED_PATH")"
+    sed \
+      -e "s|__NETBIRD_DOMAIN__|${NETBIRD_DOMAIN}|g" \
+      -e "s|__NETBIRD_AUTH_SECRET__|${relay_secret}|g" \
+      -e "s|__NETBIRD_ENCRYPTION_KEY__|${encryption_key}|g" \
+      -e "s|__NETBIRD_PROXY_SUBNET__|${NETBIRD_PROXY_SUBNET}|g" \
+      "$TEMPLATE_PATH" >"$RENDERED_PATH"
+
+    if grep -q '__NETBIRD_' "$RENDERED_PATH"; then
+      echo "Rendered NetBird configuration still contains unresolved placeholders" >&2
+      exit 1
+    fi
+
+    exec /go/bin/netbird-server "$@"

netbird/k8s/ingress.yaml

@@ -0,0 +1,83 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird-prod
+  namespace: netbird
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nb.forust.xyz`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
+      kind: Rule
+      priority: 100
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
+      services:
+        - name: netbird-server-service
+          port: 80
+          scheme: h2c
+    - match: Host(`nb.forust.xyz`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      kind: Rule
+      priority: 100
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
+      services:
+        - name: netbird-server-service
+          port: 80
+    - match: Host(`nb.forust.xyz`)
+      kind: Rule
+      priority: 1
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
+      services:
+        - name: netbird-dashboard-service
+          port: 80
+  tls:
+    secretName: netbird-prod-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbird-local
+  namespace: netbird
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
+      kind: Rule
+      priority: 100
+      services:
+        - name: netbird-server-service
+          port: 80
+          scheme: h2c
+    - match: (Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      kind: Rule
+      priority: 100
+      services:
+        - name: netbird-server-service
+          port: 80
+    - match: Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)
+      kind: Rule
+      priority: 1
+      services:
+        - name: netbird-dashboard-service
+          port: 80
+  tls:
+    secretName: internal-wildcard-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteUDP
+metadata:
+  name: netbird-stun
+  namespace: netbird
+spec:
+  entryPoints:
+    - netbird-stun
+  routes:
+    - services:
+        - name: netbird-server-service
+          port: 3478

netbird/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird

netbird/k8s/netbird.yaml

@@ -0,0 +1,181 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-server-service
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-server
+  ports:
+    - port: 80
+      name: http
+      targetPort: 80
+      protocol: TCP
+    - port: 3478
+      name: stun
+      targetPort: 3478
+      protocol: UDP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-dashboard-service
+  namespace: netbird
+spec:
+  selector:
+    app: netbird-dashboard
+  ports:
+    - port: 80
+      name: http
+      targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-server-deployment
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-server
+  template:
+    metadata:
+      labels:
+        app: netbird-server
+    spec:
+      containers:
+        - name: netbird-server
+          image: netbirdio/netbird-server:0.79.0
+          command: ["/bin/sh", "/opt/netbird/entrypoint.sh", "--config", "/run/netbird/config.yaml"]
+          envFrom:
+            - configMapRef:
+                name: netbird-config
+          ports:
+            - containerPort: 80
+              name: http
+              protocol: TCP
+            - containerPort: 3478
+              name: stun
+              protocol: UDP
+          volumeMounts:
+            - name: netbird-data
+              mountPath: /var/lib/netbird
+            - name: netbird-files
+              mountPath: /opt/netbird
+              readOnly: true
+            - name: netbird-secrets
+              mountPath: /run/secrets/relay_auth_secret
+              subPath: relay_auth_secret
+              readOnly: true
+            - name: netbird-secrets
+              mountPath: /run/secrets/datastore_encryption_key
+              subPath: datastore_encryption_key
+              readOnly: true
+            - name: netbird-run
+              mountPath: /run/netbird
+          readinessProbe:
+            tcpSocket:
+              port: 80
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            tcpSocket:
+              port: 80
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+      volumes:
+        - name: netbird-data
+          persistentVolumeClaim:
+            claimName: netbird-pvc
+        - name: netbird-files
+          configMap:
+            name: netbird-config
+            defaultMode: 0755
+            items:
+              - key: config.template.yaml
+                path: config.template.yaml
+              - key: entrypoint.sh
+                path: entrypoint.sh
+        - name: netbird-secrets
+          secret:
+            secretName: netbird-secrets
+            items:
+              - key: relay_auth_secret
+                path: relay_auth_secret
+              - key: datastore_encryption_key
+                path: datastore_encryption_key
+        - name: netbird-run
+          emptyDir:
+            medium: Memory
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-dashboard-deployment
+  namespace: netbird
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbird-dashboard
+  template:
+    metadata:
+      labels:
+        app: netbird-dashboard
+    spec:
+      containers:
+        - name: dashboard
+          image: netbirdio/dashboard:v2.90.10
+          envFrom:
+            - configMapRef:
+                name: netbird-config
+          ports:
+            - containerPort: 80
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 5
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "300m"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbird-pvc
+  namespace: netbird
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

netbird/k8s/secrets.yaml.example

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: netbird-secrets
+  namespace: netbird
+type: Opaque
+stringData:
+  # hex, 64 chars: openssl rand -hex 32
+  relay_auth_secret: "REPLACE_ME"
+  # base64, 44 chars: openssl rand -base64 32
+  datastore_encryption_key: "REPLACE_ME"

netbox/.env.example

@@ -0,0 +1,32 @@
+POSTGRES_DB=netbox
+POSTGRES_USER=netbox
+POSTGRES_PASSWORD=CHANGE_ME_POSTGRES_PASSWORD
+
+DB_NAME=netbox
+DB_USER=netbox
+DB_PASSWORD=CHANGE_ME_POSTGRES_PASSWORD
+DB_HOST=postgres
+DB_PORT=5432
+DB_SSLMODE=disable
+
+REDIS_HOST=redis
+REDIS_PORT=6379
+REDIS_PASSWORD=CHANGE_ME_REDIS_PASSWORD
+REDIS_DATABASE=0
+REDIS_CACHE_HOST=redis-cache
+REDIS_CACHE_PORT=6379
+REDIS_CACHE_PASSWORD=CHANGE_ME_REDIS_CACHE_PASSWORD
+REDIS_CACHE_DATABASE=1
+
+ALLOWED_HOSTS=localhost,127.0.0.1,[::1],netbox.forust.xyz,netbox.workstation.internal
+CSRF_TRUSTED_ORIGINS=https://netbox.forust.xyz,https://netbox.workstation.internal
+
+SECRET_KEY=CHANGE_ME_DJANGO_SECRET_KEY
+API_TOKEN_PEPPER_1=CHANGE_ME_API_TOKEN_PEPPER
+TIME_ZONE=Europe/Bratislava
+TZ=Europe/Bratislava
+
+SKIP_SUPERUSER=false
+SUPERUSER_NAME=admin
+SUPERUSER_EMAIL=admin@example.com
+SUPERUSER_PASSWORD=CHANGE_ME_SUPERUSER_PASSWORD

netbox/README.md

@@ -0,0 +1,96 @@
+# NetBox
+
+NetBox for homelab documentation and visualization. Two runtimes are available:
+
+| Runtime | Manifest       | Purpose                                                        |
+| ------- | -------------- | -------------------------------------------------------------- |
+| Docker  | `compose.yaml` | Local stand on `127.0.0.1:8000` (no public exposure)           |
+| k8s     | `k8s/`         | Homelab service on `netbox.forust.xyz` (and the internal name) |
+
+Both use the same image (`netboxcommunity/netbox:v4.7-5.1.1`) and Valkey for tasks
+plus a second logical database for caching. The Docker stand keeps its own
+PostgreSQL container, while the k8s deployment uses the shared `database` cluster
+(`postgres.database.svc.cluster.local:5432`, role/database `netbox`); only Valkey
+stays a per-service StatefulSet.
+
+## Docker Compose
+
+```bash
+cp .env.example .env
+# replace CHANGE_ME
+docker compose up -d
+```
+
+The UI is available at <http://localhost:8000>. The port is bound to `127.0.0.1`
+intentionally, so this stand is not exposed on the LAN or public interfaces.
+
+The `netbox` service is also attached to the external `proxy` network and carries
+Traefik labels for `netbox.forust.xyz` and `netbox.workstation.internal`. Those
+labels only take effect while the Docker Traefik stack is running; it is currently
+stopped, and the live ingress path in this homelab is the k8s Traefik.
+
+Inspect startup and health with:
+
+```bash
+docker compose ps
+docker compose logs -f netbox
+```
+
+Stop it with `docker compose down`; data is kept in the named volumes
+`netbox-postgres`, `netbox-media-files`, `netbox-reports-files`,
+`netbox-scripts-files` and `netbox-redis-data`.
+
+## Kubernetes
+
+`k8s/` is deployed in the homelab cluster and serves `netbox.forust.xyz` publicly
+plus `netbox.workstation.internal` / `netbox.gigaforust.internal` internally. To
+rebuild it from scratch:
+
+```bash
+# 1. shared PostgreSQL: the password lives in the shared secret, NetBox keeps a copy
+kubectl -n database patch secret postgres-shared-secrets \
+  --type merge -p '{"stringData":{"NETBOX_DB_PASSWORD":"<same value>"}}'
+kubectl -n database exec postgres17-0 -- psql -U postgres -d postgres \
+  -c 'CREATE ROLE netbox LOGIN PASSWORD ...' -c 'CREATE DATABASE netbox OWNER netbox'
+
+# 2. secrets first: the deploy workflow never applies *secret*.yaml
+cp k8s/secrets.yaml.example k8s/secrets.yaml   # replace CHANGE_ME
+kubectl apply -f k8s/secrets.yaml
+
+# 3. manifests
+kubectl apply -f k8s/
+```
+
+The shared cluster is reached at `postgres.database.svc.cluster.local:5432`. Its
+NetworkPolicy (`postgres/k8s/network-policy.yaml`) must list the `netbox` namespace
+or connections are dropped, and `postgres/initdb/01-create-databases.sh` already
+creates the role and database on a fresh data directory. NetBox has no PostgreSQL
+StatefulSet of its own — only `netbox-valkey`.
+
+`netbox.forust.xyz` resolves to this host (`78.98.72.122`) through the `DOMAINS`
+list in the `default/cfddns` secret. cert-manager issues `netbox-prod-tls` with the
+`letsencrypt-prod` issuer, the internal route uses `internal-wildcard-tls`.
+
+Resources are permanent again now that the first-boot migrations are complete:
+the web container reserves `100m`/`512Mi` and is capped at `2` CPU/`2Gi`, the
+worker reserves `50m`/`256Mi` and is capped at `1` CPU/`1Gi`, and Valkey reserves
+`25m`/`64Mi` and is capped at `250m`/`256Mi`. The deliberately generous CPU caps
+leave enough headroom for future schema migrations without letting one process
+consume the whole node.
+
+The first start applies ~810 migrations, each in its own transaction with DDL and
+a commit; every later start is a no-op. The startup probe allows 15 minutes and
+`progressDeadlineSeconds` is 1800 for the same reason. Probes run inside the pod
+and explicitly set `Host: netbox.forust.xyz`; a kubelet `httpGet.host` field would
+replace the probe destination with that public hostname and bypass the pod.
+
+## Secrets
+
+- `netbox/.env` (compose) and `netbox/k8s/secrets.yaml` (k8s) are gitignored. Only
+  `.env.example` and `k8s/secrets.yaml.example` are committed.
+- `netbox/configuration/configuration.py` is env-driven: hosts, database, Redis and
+  the Django keys all come from the environment, so the same settings file works in
+  both runtimes. The k8s copy lives in the `netbox-settings` ConfigMap
+  (`k8s/settings.yaml`) and must be kept in sync with the file.
+- Rotating `SECRET_KEY` invalidates all sessions; rotating `API_TOKEN_PEPPER_1`
+  invalidates every API token.

netbox/compose.yaml

@@ -0,0 +1,137 @@
+services:
+  netbox:
+    image: docker.io/netboxcommunity/netbox:v4.7-5.1.1
+    container_name: netbox
+    restart: unless-stopped
+    user: "netbox:root"
+    ports:
+      - "127.0.0.1:8000:8080"
+    env_file:
+      - .env
+    environment:
+      GRANIAN_WORKERS: "2"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+      redis-cache:
+        condition: service_healthy
+    volumes:
+      - ./configuration:/etc/netbox/config:z,ro
+      - netbox-media-files:/opt/netbox/netbox/media
+      - netbox-reports-files:/opt/netbox/netbox/reports
+      - netbox-scripts-files:/opt/netbox/netbox/scripts
+    networks:
+      - default
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.netbox.loadbalancer.server.port=8080"
+
+      # Prod Router
+      - "traefik.http.routers.netbox.rule=Host(`netbox.forust.xyz`)"
+      - "traefik.http.routers.netbox.entrypoints=websecure"
+      - "traefik.http.routers.netbox.middlewares=security-headers@file"
+      - "traefik.http.routers.netbox.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.netbox-local.rule=Host(`netbox.workstation.internal`)"
+      - "traefik.http.routers.netbox-local.entrypoints=websecure"
+      - "traefik.http.routers.netbox-local.tls=true"
+    healthcheck:
+      test: ["CMD", "/opt/netbox/health.sh"]
+      start_period: 600s
+      timeout: 5s
+      interval: 15s
+      retries: 10
+
+  netbox-worker:
+    image: docker.io/netboxcommunity/netbox:v4.7-5.1.1
+    container_name: netbox-worker
+    restart: unless-stopped
+    user: "netbox:root"
+    command:
+      - /opt/netbox/venv/bin/python
+      - /opt/netbox/netbox/manage.py
+      - rqworker
+    env_file:
+      - .env
+    depends_on:
+      netbox:
+        condition: service_healthy
+    volumes:
+      - ./configuration:/etc/netbox/config:z,ro
+      - netbox-media-files:/opt/netbox/netbox/media
+      - netbox-reports-files:/opt/netbox/netbox/reports
+      - netbox-scripts-files:/opt/netbox/netbox/scripts
+    healthcheck:
+      test: ["CMD-SHELL", "ps -ef | grep -q '[r]qworker'"]
+      start_period: 30s
+      timeout: 5s
+      interval: 15s
+      retries: 10
+
+  postgres:
+    image: docker.io/postgres:18.6-alpine
+    container_name: netbox-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: "${POSTGRES_DB:?POSTGRES_DB must be set}"
+      POSTGRES_USER: "${POSTGRES_USER:?POSTGRES_USER must be set}"
+      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}"
+    volumes:
+      - netbox-postgres:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", 'pg_isready -q -t 2 -d "$${POSTGRES_DB}" -U "$${POSTGRES_USER}"']
+      start_period: 20s
+      timeout: 5s
+      interval: 10s
+      retries: 10
+
+  redis:
+    image: docker.io/valkey/valkey:9.1.2-alpine
+    container_name: netbox-redis
+    restart: unless-stopped
+    command:
+      - sh
+      - -c
+      - valkey-server --appendonly yes --requirepass "$$REDIS_PASSWORD"
+    environment:
+      REDIS_PASSWORD: "${REDIS_PASSWORD:?REDIS_PASSWORD must be set}"
+    volumes:
+      - netbox-redis-data:/data
+    healthcheck:
+      test: ["CMD-SHELL", 'valkey-cli --pass "$${REDIS_PASSWORD}" ping | grep -q PONG']
+      start_period: 5s
+      timeout: 5s
+      interval: 5s
+      retries: 10
+
+  redis-cache:
+    image: docker.io/valkey/valkey:9.1.2-alpine
+    container_name: netbox-redis-cache
+    restart: unless-stopped
+    command:
+      - sh
+      - -c
+      - valkey-server --requirepass "$$REDIS_CACHE_PASSWORD"
+    environment:
+      REDIS_CACHE_PASSWORD: "${REDIS_CACHE_PASSWORD:?REDIS_CACHE_PASSWORD must be set}"
+    healthcheck:
+      test: ["CMD-SHELL", 'valkey-cli --pass "$${REDIS_CACHE_PASSWORD}" ping | grep -q PONG']
+      start_period: 5s
+      timeout: 5s
+      interval: 5s
+      retries: 10
+
+volumes:
+  netbox-media-files:
+  netbox-reports-files:
+  netbox-scripts-files:
+  netbox-postgres:
+  netbox-redis-data:
+
+networks:
+  default:
+  proxy:
+    external: true

netbox/configuration/configuration.py

@@ -0,0 +1,48 @@
+import os
+
+
+def _csv(name, default=""):
+    return [item.strip() for item in os.environ.get(name, default).split(",") if item.strip()]
+
+
+ALLOWED_HOSTS = _csv("ALLOWED_HOSTS", "localhost,127.0.0.1,[::1]")
+CSRF_TRUSTED_ORIGINS = _csv("CSRF_TRUSTED_ORIGINS")
+USE_X_FORWARDED_HOST = True
+SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
+DATABASES = {
+    "default": {
+        "NAME": os.environ["DB_NAME"],
+        "USER": os.environ["DB_USER"],
+        "PASSWORD": os.environ["DB_PASSWORD"],
+        "HOST": os.environ["DB_HOST"],
+        "PORT": os.environ.get("DB_PORT", "5432"),
+        "OPTIONS": {"sslmode": os.environ.get("DB_SSLMODE", "disable")},
+        "CONN_MAX_AGE": int(os.environ.get("DB_CONN_MAX_AGE", "300")),
+    }
+}
+
+REDIS = {
+    "tasks": {
+        "HOST": os.environ["REDIS_HOST"],
+        "PORT": int(os.environ.get("REDIS_PORT", "6379")),
+        "PASSWORD": os.environ["REDIS_PASSWORD"],
+        "DATABASE": int(os.environ.get("REDIS_DATABASE", "0")),
+        "SSL": False,
+    },
+    "caching": {
+        "HOST": os.environ["REDIS_CACHE_HOST"],
+        "PORT": int(os.environ.get("REDIS_CACHE_PORT", "6379")),
+        "PASSWORD": os.environ["REDIS_CACHE_PASSWORD"],
+        "DATABASE": int(os.environ.get("REDIS_CACHE_DATABASE", "1")),
+        "SSL": False,
+    },
+}
+
+SECRET_KEY = os.environ["SECRET_KEY"]
+API_TOKEN_PEPPERS = {1: os.environ["API_TOKEN_PEPPER_1"]}
+TIME_ZONE = os.environ.get("TIME_ZONE", "UTC")
+MEDIA_ROOT = "/opt/netbox/netbox/media"
+REPORTS_ROOT = "/opt/netbox/netbox/reports"
+SCRIPTS_ROOT = "/opt/netbox/netbox/scripts"
+CENSUS_REPORTING_ENABLED = False

netbox/k8s/certificates.yaml

@@ -0,0 +1,28 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: netbox-prod-tls
+  namespace: netbox
+spec:
+  secretName: netbox-prod-tls
+  dnsNames:
+    - netbox.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: internal-wildcard-tls
+  namespace: netbox
+spec:
+  secretName: internal-wildcard-tls
+  dnsNames:
+    - "*.workstation.internal"
+    - "*.gigaforust.internal"
+    - workstation.internal
+    - gigaforust.internal
+  issuerRef:
+    name: internal-ca
+    kind: ClusterIssuer

netbox/k8s/config.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbox-config
+  namespace: netbox
+data:
+  DB_HOST: "postgres.database.svc.cluster.local"
+  DB_PORT: "5432"
+  DB_SSLMODE: "disable"
+  REDIS_HOST: "netbox-valkey"
+  REDIS_PORT: "6379"
+  REDIS_DATABASE: "0"
+  REDIS_CACHE_HOST: "netbox-valkey"
+  REDIS_CACHE_PORT: "6379"
+  REDIS_CACHE_DATABASE: "1"
+  TIME_ZONE: "Europe/Bratislava"
+  TZ: "Europe/Bratislava"
+  GRANIAN_WORKERS: "2"
+  ALLOWED_HOSTS: "netbox.forust.xyz,netbox.workstation.internal,netbox.gigaforust.internal"
+  CSRF_TRUSTED_ORIGINS: "https://netbox.forust.xyz,https://netbox.workstation.internal,https://netbox.gigaforust.internal"
+  SKIP_SUPERUSER: "false"

netbox/k8s/ingress.yaml

@@ -0,0 +1,36 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbox-prod
+  namespace: netbox
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`netbox.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
+      services:
+        - name: netbox-service
+          port: 8080
+  tls:
+    secretName: netbox-prod-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netbox-local
+  namespace: netbox
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`netbox.workstation.internal`) || Host(`netbox.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: netbox-service
+          port: 8080
+  tls:
+    secretName: internal-wildcard-tls

netbox/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbox

netbox/k8s/netbox.yaml

@@ -0,0 +1,204 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbox-service
+  namespace: netbox
+spec:
+  selector:
+    app: netbox
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbox-deployment
+  namespace: netbox
+  labels:
+    app: netbox
+spec:
+  replicas: 1
+  progressDeadlineSeconds: 300
+  selector:
+    matchLabels:
+      app: netbox
+  strategy:
+    # ReadWriteOnce PVC
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: netbox
+    spec:
+      containers:
+        - name: netbox
+          image: docker.io/netboxcommunity/netbox:v4.7-5.1.1
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: netbox-config
+            - secretRef:
+                name: netbox-secrets
+          volumeMounts:
+            - name: netbox-config
+              mountPath: /etc/netbox/config
+              readOnly: true
+            - name: netbox-media
+              mountPath: /opt/netbox/netbox/media
+            - name: netbox-reports
+              mountPath: /opt/netbox/netbox/reports
+            - name: netbox-scripts
+              mountPath: /opt/netbox/netbox/scripts
+          startupProbe:
+            exec:
+              command:
+                - /opt/netbox/venv/bin/python
+                - -c
+                - >-
+                  exec /usr/bin/curl --fail --silent --show-error --max-time 4
+                  --header 'Host: netbox.forust.xyz'
+                  http://127.0.0.1:8080/login/ >/dev/null
+            failureThreshold: 90
+            periodSeconds: 10
+          readinessProbe:
+            exec:
+              command:
+                - /opt/netbox/venv/bin/python
+                - -c
+                - >-
+                  exec /usr/bin/curl --fail --silent --show-error --max-time 4
+                  --header 'Host: netbox.forust.xyz'
+                  http://127.0.0.1:8080/login/ >/dev/null
+            periodSeconds: 10
+          livenessProbe:
+            exec:
+              command:
+                - /opt/netbox/venv/bin/python
+                - -c
+                - >-
+                  exec /usr/bin/curl --fail --silent --show-error --max-time 4
+                  --header 'Host: netbox.forust.xyz'
+                  http://127.0.0.1:8080/login/ >/dev/null
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "512Mi"
+            limits:
+              cpu: "2"
+              memory: "2Gi"
+      volumes:
+        - name: netbox-config
+          configMap:
+            name: netbox-settings
+        - name: netbox-media
+          persistentVolumeClaim:
+            claimName: netbox-media-pvc
+        - name: netbox-reports
+          persistentVolumeClaim:
+            claimName: netbox-reports-pvc
+        - name: netbox-scripts
+          persistentVolumeClaim:
+            claimName: netbox-scripts-pvc
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbox-worker-deployment
+  namespace: netbox
+  labels:
+    app: netbox-worker
+spec:
+  replicas: 1
+  progressDeadlineSeconds: 300
+  selector:
+    matchLabels:
+      app: netbox-worker
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: netbox-worker
+    spec:
+      containers:
+        - name: netbox-worker
+          image: docker.io/netboxcommunity/netbox:v4.7-5.1.1
+          command:
+            - /opt/netbox/venv/bin/python
+            - netbox/manage.py
+            - rqworker
+          workingDir: /opt/netbox
+          envFrom:
+            - configMapRef:
+                name: netbox-config
+            - secretRef:
+                name: netbox-secrets
+          volumeMounts:
+            - name: netbox-config
+              mountPath: /etc/netbox/config
+              readOnly: true
+            - name: netbox-media
+              mountPath: /opt/netbox/netbox/media
+            - name: netbox-reports
+              mountPath: /opt/netbox/netbox/reports
+            - name: netbox-scripts
+              mountPath: /opt/netbox/netbox/scripts
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "256Mi"
+            limits:
+              cpu: "1"
+              memory: "1Gi"
+      volumes:
+        - name: netbox-config
+          configMap:
+            name: netbox-settings
+        - name: netbox-media
+          persistentVolumeClaim:
+            claimName: netbox-media-pvc
+        - name: netbox-reports
+          persistentVolumeClaim:
+            claimName: netbox-reports-pvc
+        - name: netbox-scripts
+          persistentVolumeClaim:
+            claimName: netbox-scripts-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbox-media-pvc
+  namespace: netbox
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbox-reports-pvc
+  namespace: netbox
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netbox-scripts-pvc
+  namespace: netbox
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 1Gi

netbox/k8s/secrets.yaml.example

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: netbox-secrets
+  namespace: netbox
+type: Opaque
+stringData:
+  DB_NAME: "netbox"
+  DB_USER: "netbox"
+  DB_PASSWORD: "CHANGE_ME_POSTGRES_PASSWORD"
+  REDIS_PASSWORD: "CHANGE_ME_VALKEY_PASSWORD"
+  REDIS_CACHE_PASSWORD: "CHANGE_ME_VALKEY_PASSWORD"
+  VALKEY_PASSWORD: "CHANGE_ME_VALKEY_PASSWORD"
+  SECRET_KEY: "CHANGE_ME_DJANGO_SECRET_KEY"
+  API_TOKEN_PEPPER_1: "CHANGE_ME_API_TOKEN_PEPPER"
+  SUPERUSER_NAME: "admin"
+  SUPERUSER_EMAIL: "admin@example.com"
+  SUPERUSER_PASSWORD: "CHANGE_ME_SUPERUSER_PASSWORD"

netbox/k8s/settings.yaml

@@ -0,0 +1,56 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbox-settings
+  namespace: netbox
+data:
+  # Sync wit netbox/configuration/configuration.py (the Docker mounts that file).
+  configuration.py: |
+    import os
+
+
+    def _csv(name, default=""):
+        return [item.strip() for item in os.environ.get(name, default).split(",") if item.strip()]
+
+
+    ALLOWED_HOSTS = _csv("ALLOWED_HOSTS", "localhost,127.0.0.1,[::1]")
+    CSRF_TRUSTED_ORIGINS = _csv("CSRF_TRUSTED_ORIGINS")
+    USE_X_FORWARDED_HOST = True
+    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
+    DATABASES = {
+        "default": {
+            "NAME": os.environ["DB_NAME"],
+            "USER": os.environ["DB_USER"],
+            "PASSWORD": os.environ["DB_PASSWORD"],
+            "HOST": os.environ["DB_HOST"],
+            "PORT": os.environ.get("DB_PORT", "5432"),
+            "OPTIONS": {"sslmode": os.environ.get("DB_SSLMODE", "disable")},
+            "CONN_MAX_AGE": int(os.environ.get("DB_CONN_MAX_AGE", "300")),
+        }
+    }
+
+    REDIS = {
+        "tasks": {
+            "HOST": os.environ["REDIS_HOST"],
+            "PORT": int(os.environ.get("REDIS_PORT", "6379")),
+            "PASSWORD": os.environ["REDIS_PASSWORD"],
+            "DATABASE": int(os.environ.get("REDIS_DATABASE", "0")),
+            "SSL": False,
+        },
+        "caching": {
+            "HOST": os.environ["REDIS_CACHE_HOST"],
+            "PORT": int(os.environ.get("REDIS_CACHE_PORT", "6379")),
+            "PASSWORD": os.environ["REDIS_CACHE_PASSWORD"],
+            "DATABASE": int(os.environ.get("REDIS_CACHE_DATABASE", "1")),
+            "SSL": False,
+        },
+    }
+
+    SECRET_KEY = os.environ["SECRET_KEY"]
+    API_TOKEN_PEPPERS = {1: os.environ["API_TOKEN_PEPPER_1"]}
+    TIME_ZONE = os.environ.get("TIME_ZONE", "UTC")
+    MEDIA_ROOT = "/opt/netbox/netbox/media"
+    REPORTS_ROOT = "/opt/netbox/netbox/reports"
+    SCRIPTS_ROOT = "/opt/netbox/netbox/scripts"
+    CENSUS_REPORTING_ENABLED = False

netbox/k8s/valkey.yaml

@@ -0,0 +1,82 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbox-valkey
+  namespace: netbox
+  labels:
+    app: netbox-valkey
+spec:
+  clusterIP: None
+  selector:
+    app: netbox-valkey
+  ports:
+    - name: valkey
+      port: 6379
+      targetPort: valkey
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: netbox-valkey
+  namespace: netbox
+  labels:
+    app: netbox-valkey
+spec:
+  serviceName: netbox-valkey
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbox-valkey
+  template:
+    metadata:
+      labels:
+        app: netbox-valkey
+    spec:
+      containers:
+        - name: valkey
+          image: docker.io/valkey/valkey:9.1.2-alpine
+          command:
+            - sh
+            - -c
+            - valkey-server --appendonly yes --save 30 1 --loglevel warning --requirepass "$VALKEY_PASSWORD"
+          env:
+            - name: VALKEY_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: netbox-secrets
+                  key: VALKEY_PASSWORD
+          ports:
+            - name: valkey
+              containerPort: 6379
+          volumeMounts:
+            - name: valkey-data
+              mountPath: /data
+          startupProbe:
+            exec:
+              command: ["sh", "-c", 'valkey-cli --pass "$VALKEY_PASSWORD" ping | grep -q PONG']
+            failureThreshold: 20
+            periodSeconds: 5
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", 'valkey-cli --pass "$VALKEY_PASSWORD" ping | grep -q PONG']
+            periodSeconds: 10
+          livenessProbe:
+            exec:
+              command: ["sh", "-c", 'valkey-cli --pass "$VALKEY_PASSWORD" ping | grep -q PONG']
+            initialDelaySeconds: 20
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: "25m"
+              memory: "64Mi"
+            limits:
+              cpu: "250m"
+              memory: "256Mi"
+  volumeClaimTemplates:
+    - metadata:
+        name: valkey-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi

postgres/README.md

@@ -1,7 +1,7 @@
 # Shared PostgreSQL
 
 This directory contains the shared PostgreSQL 17 deployment for Authentik,
-Gitea, Netronome, and Statuspage. It creates one database and one login role
+Gitea, NetBox, Netronome, and Statuspage. It creates one database and one login role
 per service. Per-service standalone databases were removed after the
 migration (Sep 2026); Penpot stays on its own compose PostgreSQL (archived,
 not part of the shared instance).
@@ -12,6 +12,7 @@ not part of the shared instance).
 | ---------- | ------------------- | -------------------------------------- |
 | Authentik  | 2025.10.x           | Supported (Authentik requires 14+)     |
 | Gitea      | 1.27.3              | Supported (Gitea requires 12+)         |
+| NetBox     | 4.7.x               | Supported (NetBox 4.x requires 13+)    |
 | Netronome  | 0.14.0              | Supported (upstream's example uses 17) |
 | Statuspage | custom              | Supported                              |
 

postgres/initdb/01-create-databases.sh

@@ -3,6 +3,7 @@ set -euo pipefail
 
 : "${AUTHENTIK_DB_PASSWORD:?AUTHENTIK_DB_PASSWORD is required}"
 : "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
+: "${NETBOX_DB_PASSWORD:?NETBOX_DB_PASSWORD is required}"
 : "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
 : "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
 : "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}"
@@ -23,6 +24,7 @@ SQL
 
 create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
 create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
+create_role_and_database netbox netbox "$NETBOX_DB_PASSWORD"
 create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
 create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"
 create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD"

postgres/k8s/network-policy.yaml

@@ -17,6 +17,9 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: gitea
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: netbox
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: netronome

postgres/k8s/postgres.yaml

@@ -113,6 +113,7 @@ data:
 
     : "${AUTHENTIK_DB_PASSWORD:?AUTHENTIK_DB_PASSWORD is required}"
     : "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
+    : "${NETBOX_DB_PASSWORD:?NETBOX_DB_PASSWORD is required}"
     : "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
     : "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
     : "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}"
@@ -133,6 +134,7 @@ data:
 
     create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
     create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
+    create_role_and_database netbox netbox "$NETBOX_DB_PASSWORD"
     create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
     create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"
     create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD"

postgres/k8s/secrets.yaml.example

@@ -8,6 +8,7 @@ stringData:
   POSTGRES_ADMIN_PASSWORD: ""
   AUTHENTIK_DB_PASSWORD: ""
   GITEA_DB_PASSWORD: ""
+  NETBOX_DB_PASSWORD: ""
   NETRONOME_DB_PASSWORD: ""
   PENPOT_DB_PASSWORD: ""
   STATUSPAGE_DB_PASSWORD: ""

rackpeek/compose.yaml

@@ -0,0 +1,34 @@
+services:
+  rackpeek:
+    image: docker.io/aptacode/rackpeek:v2.1.0
+    container_name: rackpeek
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8080:8080"
+    environment:
+      TZ: "Europe/Bratislava"
+    volumes:
+      - rackpeek-config:/app/config
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.rackpeek.loadbalancer.server.port=8080"
+
+      # Local Router
+      - "traefik.http.routers.rackpeek-local.rule=Host(`rackpeek.workstation.internal`) || Host(`rack.workstation.internal`) || Host(`rackpeek.gigaforust.internal`) || Host(`rack.gigaforust.internal`)"
+      - "traefik.http.routers.rackpeek-local.entrypoints=websecure"
+      - "traefik.http.routers.rackpeek-local.tls=true"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/health || exit 1"]
+      start_period: 15s
+      timeout: 5s
+      interval: 30s
+      retries: 3
+
+volumes:
+  rackpeek-config:
+
+networks:
+  proxy:
+    external: true

rackpeek/k8s/certificates.yaml

@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: internal-wildcard-tls
+  namespace: rackpeek
+spec:
+  secretName: internal-wildcard-tls
+  dnsNames:
+    - "*.workstation.internal"
+    - "*.gigaforust.internal"
+    - workstation.internal
+    - gigaforust.internal
+  issuerRef:
+    name: internal-ca
+    kind: ClusterIssuer

rackpeek/k8s/ingress.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: rackpeek-local
+  namespace: rackpeek
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`rackpeek.workstation.internal`) || Host(`rack.workstation.internal`) || Host(`rackpeek.gigaforust.internal`) || Host(`rack.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: rackpeek-service
+          port: 8080
+  tls:
+    secretName: internal-wildcard-tls

rackpeek/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rackpeek

rackpeek/k8s/rackpeek.yaml

@@ -0,0 +1,89 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rackpeek-service
+  namespace: rackpeek
+spec:
+  selector:
+    app: rackpeek
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rackpeek-deployment
+  namespace: rackpeek
+  labels:
+    app: rackpeek
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: rackpeek
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: rackpeek
+    spec:
+      securityContext:
+        # Image runs as uid/gid 1654
+        fsGroup: 1654
+      containers:
+        - name: rackpeek
+          image: docker.io/aptacode/rackpeek:v2.1.0
+          ports:
+            - name: http
+              containerPort: 8080
+          env:
+            - name: RPK_YAML_DIR
+              value: "/app/config"
+            - name: TZ
+              value: "Europe/Bratislava"
+          volumeMounts:
+            - name: rackpeek-config
+              mountPath: /app/config
+          startupProbe:
+            httpGet:
+              path: /health
+              port: http
+            failureThreshold: 30
+            periodSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 30
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+      volumes:
+        - name: rackpeek-config
+          persistentVolumeClaim:
+            claimName: rackpeek-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: rackpeek-pvc
+  namespace: rackpeek
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: local-path-retain
+  resources:
+    requests:
+      storage: 2Gi

termix/compose.yaml

@@ -1,6 +1,6 @@
 services:
   termix:
-    image: ghcr.io/lukegus/termix:2.7.1
+    image: ghcr.io/lukegus/termix:2.8.0
     container_name: termix
     restart: unless-stopped
     # ports:

termix/k8s/termix.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: termix
-          image: ghcr.io/lukegus/termix:2.7.1
+          image: ghcr.io/lukegus/termix:2.8.0
           envFrom:
             - configMapRef:
                 name: termix-config

traefik/compose.yaml

@@ -20,6 +20,7 @@ services:
       - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entryPoints.websecure.address=:443"
+      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
       - "--entryPoints.websecure.http.middlewares=error-pages@docker"
       - "--entryPoints.websecure.http.tls=true"
       - "--entryPoints.ssh.address=:2221"

traefik/k8s/traefik-values.yaml

@@ -86,6 +86,12 @@ ports:
     protocol: UDP
     expose:
       default: true
+  netbird-stun:
+    port: 3478
+    exposedPort: 3478
+    protocol: UDP
+    expose:
+      default: true
   checkmk-agent:
     port: 8000
     protocol: TCP