chore(userbot): optimize Dockerfile with multi-stage build and static ffmpeg

- Multi-stage build: pip deps built in separate stage
- Static ffmpeg binary instead of apt package (avoid 200+ deps)
- Keep only git, mediainfo, wget via apt

.editorconfig

@@ -0,0 +1,24 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[*.{json,jsonc}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.py]
+indent_size = 4
+
+[{Makefile,makefile}]
+indent_style = tab

.gitea/workflows/prod_deploy.yaml

@@ -36,4 +36,4 @@ jobs:
             else
               echo ">>> Skipping $dir: no compose file found"
             fi
-          done
+          done

.gitignore

@@ -47,6 +47,7 @@ traefik/logs/*
 # SSL Certificates
 adguardhome/certs/*
 traefik/certs/*
+certs/
 
 # Monitoring
 monitoring/prometheus.yml
@@ -98,3 +99,11 @@ temp/*
 .env.forust
 .env.*
 !*example
+
+# kubernetes
+*/k8s/*secret*
+!*/k8s/*secret*.example
+traefik/k8s/local-tls.yaml
+converters/k8s/config.yaml
+convertx/k8s/config.yaml
+traefik/k8s/crowdsec-middleware.yaml

.hadolint.yaml

@@ -0,0 +1,10 @@
+ignored:
+  - DL3008
+  - DL3042
+  - DL3018
+  - DL3059
+trustedRegistries:
+  - docker.io
+  - ghcr.io
+  - quay.io
+  - gcr.forust.xyz

.markdownlint.json

@@ -0,0 +1,8 @@
+{
+  "default": true,
+  "MD013": false,
+  "MD024": false,
+  "MD033": false,
+  "MD041": false,
+  "MD046": false
+}

.prettierrc.yaml

@@ -0,0 +1,7 @@
+bracketSameLine: true
+htmlWhitespaceSensitivity: css
+printWidth: 120
+tabWidth: 2
+trailingComma: all
+proseWrap: preserve
+endOfLine: lf

.yamllint

@@ -0,0 +1,22 @@
+extends: default
+
+rules:
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
+  document-start: disable
+  line-length: disable
+  braces:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  brackets:
+    min-spaces-inside: 0
+    max-spaces-inside: 1
+  indentation:
+    spaces: 2
+    indent-sequences: consistent
+  truthy:
+    allowed-values:
+      - "true"
+      - "false"
+      - "on"

.zed/settings.json

@@ -0,0 +1,39 @@
+{
+  "tab_size": 2,
+  "soft_wrap": "prefer_line",
+  "preferred_line_length": 120,
+  "format_on_save": "on",
+  "languages": {
+    "YAML": {
+      "tab_size": 2,
+      "hard_tabs": false,
+      "format_on_save": "on",
+      "formatter": {
+        "language_server": { "name": "yaml-language-server" }
+      }
+    },
+    "Python": {
+      "tab_size": 4,
+      "format_on_save": "on",
+      "formatter": {
+        "language_server": { "name": "ruff" }
+      }
+    }
+  },
+  "lsp": {
+    "yaml-language-server": {
+      "settings": {
+        "yaml": {
+          "schemas": {
+            "kubernetes": ["**/k8s/*.yaml", "**/k8s/*.yml"]
+          },
+          "validate": true,
+          "completion": true,
+          "format": {
+            "enable": true
+          }
+        }
+      }
+    }
+  }
+}

adguardhome/compose.yaml

@@ -17,11 +17,11 @@ services:
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.adguard.loadbalancer.server.port=3000"
-      
+
       # Prod Router
       - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
       - "traefik.http.routers.adguard.entrypoints=websecure"
-      - "traefik.http.routers.adguard.tls=true"
+      - "traefik.http.routers.adguard.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
       - "traefik.http.routers.adguard-local.entrypoints=websecure"
@@ -31,10 +31,10 @@ services:
       - "traefik.http.routers.adguard-dev.entrypoints=websecure"
       - "traefik.http.routers.adguard-dev.tls=true"
       # DoH Router
-      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
-      - "traefik.http.routers.dns.entrypoints=websecure"
-      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
-      
+      - "traefik.http.routers.dns-over-https.rule=(Host(`dns.forust.xyz` || Host(`adguard.forust.xyz`)) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns-over-https.entrypoints=websecure"
+      - "traefik.http.routers.dns-over-https.tls.certresolver=letsencrypt"
+
       # Glance Metadata
       - glance.name=adguard
       - glance.url=https://adguard.forust.xyz/

adguardhome/k8s/adguard.yaml

@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-lb-service
+  namespace: adguard
+  annotations:
+    metallb.io/loadBalancerIPs: "192.168.80.3"
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: adguard
+  ports:
+    - name: dns-udp
+      port: 53
+      targetPort: 53
+      protocol: UDP
+    - name: dns-tcp
+      port: 53
+      targetPort: 53
+      protocol: TCP
+    - name: dot
+      port: 853
+      targetPort: 853
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-service
+  namespace: adguard
+spec:
+  selector:
+    app: adguard
+  ports:
+    - port: 3000
+      name: webui
+      targetPort: 3000
+    - port: 53
+      name: dns
+      targetPort: 53
+      protocol: UDP
+    - port: 53
+      name: dns-tcp
+      targetPort: 53
+      protocol: TCP
+    - port: 853
+      name: dot
+      targetPort: 853
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguard-deployment
+  namespace: adguard
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: adguard
+  template:
+    metadata:
+      labels:
+        app: adguard
+    spec:
+      containers:
+        - name: adguard
+          image: adguard/adguardhome:latest
+          resources:
+            limits:
+              memory: "1.5Gi"
+              cpu: "300m"
+            requests:
+              memory: "500Mi"
+              cpu: "50m"
+          ports:
+            - containerPort: 3000
+              name: webui
+            - containerPort: 53
+              name: dns
+            - containerPort: 853
+              name: dot
+          volumeMounts:
+            - name: adguard-data
+              mountPath: /opt/adguardhome/work
+              subPath: work
+            - name: adguard-data
+              mountPath: /opt/adguardhome/conf
+              subPath: conf
+            - name: adguard-certs
+              mountPath: /certs
+              readOnly: true
+      volumes:
+        - name: adguard-data
+          persistentVolumeClaim:
+            claimName: adguard-pvc
+        - name: adguard-certs
+          secret:
+            secretName: adguard-certs
+            items:
+              - key: tls.crt
+                path: fullchain.pem
+              - key: tls.key
+                path: privkey.pem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: adguard-pvc
+  namespace: adguard
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

adguardhome/k8s/ingress.yaml

@@ -0,0 +1,52 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-prod
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+      services:
+        - name: adguard-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-local
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: adguard-service
+          port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: adguard-doh
+  namespace: adguard
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
+      kind: Rule
+      middlewares:
+        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+      services:
+        - name: adguard-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt

adguardhome/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: adguard

adguardhome/k8s/secrets.yaml.example

@@ -0,0 +1,10 @@
+kubectl apply -f k8s/namespace.yaml && \
+kubectl create secret tls adguard-certs -n adguard \
+  --cert=certs/fullchain.pem \
+  --key=certs/privkey.pem --dry-run=client -o yaml > \
+  k8s/secrets.yaml
+
+#  OR WITH NO FILE CREATION:
+kubectl create secret tls adguard-certs -n adguard \
+  --cert=certs/fullchain.pem --key=certs/privkey.pem \
+  --save-config

authentik/compose.yaml

@@ -47,7 +47,7 @@ services:
       # Prod Router
       - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
       - "traefik.http.routers.authentik-server.entrypoints=websecure"
-      - "traefik.http.routers.authentik-server.tls=true"
+      - "traefik.http.routers.authentik-server.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`)"
       - "traefik.http.routers.authentik-server-local.entrypoints=websecure"

authentik/k8s/authentik.yaml

@@ -0,0 +1,93 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-server-service
+  namespace: authentik
+spec:
+  type: ClusterIP
+  selector:
+    app: authentik-server
+  ports:
+    - port: 9000
+      targetPort: 9000
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-worker-service
+  namespace: authentik
+spec:
+  type: ClusterIP
+  selector:
+    app: authentik-worker
+  ports:
+    - port: 9000
+      targetPort: 9000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-server-deployment
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authentik-server
+  template:
+    metadata:
+      labels:
+        app: authentik-server
+    spec:
+      containers:
+        - name: authentik-server
+          image: ghcr.io/goauthentik/server:2025.10.2
+          args: ["server"]
+          envFrom:
+            - configMapRef:
+                name: authentik-config
+            - secretRef:
+                name: authentik-secrets
+          ports:
+            - containerPort: 9000
+          resources:
+            requests:
+              memory: "700Mi"
+              cpu: "300m"
+            limits:
+              memory: "1.5Gi"
+              cpu: "1000m"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-worker-deployment
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authentik-worker
+  template:
+    metadata:
+      labels:
+        app: authentik-worker
+    spec:
+      containers:
+        - name: authentik-worker
+          image: ghcr.io/goauthentik/server:2025.10.2
+          args: ["worker"]
+          securityContext:
+            runAsUser: 0
+          envFrom:
+            - configMapRef:
+                name: authentik-config
+            - secretRef:
+                name: authentik-secrets
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "300m"
+            limits:
+              memory: "1Gi"
+              cpu: "700m"

authentik/k8s/config.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-config
+  namespace: authentik
+data:
+  AUTHENTIK_IMAGE: ghcr.io/goauthentik/server
+  AUTHENTIK_TAG: "2025.10.2"
+  AUTHENTIK_POSTGRESQL__HOST: authentik-postgres-service
+  AUTHENTIK_POSTGRESQL__NAME: authentik
+  AUTHENTIK_ERROR_REPORTING__ENABLED: "true"

authentik/k8s/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik-prod
+  namespace: authentik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+      services:
+        - name: authentik-server-service
+          port: 9000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: authentik-local
+  namespace: authentik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth.workstation.internal`) || Host(`auth.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: authentik-server-service
+          port: 9000

authentik/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik

authentik/k8s/postgresql.yaml

@@ -0,0 +1,66 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-postgres-service
+  namespace: authentik
+spec:
+  clusterIP: None
+  selector:
+    app: authentik-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: authentik-postgres-statefulset
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app: authentik-postgres
+  serviceName: authentik-postgres-service
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: authentik-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: docker.io/library/postgres:15-alpine
+          env:
+            - name: POSTGRES_DB
+              value: authentik
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: authentik-secrets
+                  key: AUTHENTIK_POSTGRESQL__USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: authentik-secrets
+                  key: AUTHENTIK_POSTGRESQL__PASSWORD
+          ports:
+            - containerPort: 5432
+              name: postgres
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "200m"
+            limits:
+              memory: "1Gi"
+              cpu: "500m"
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 5Gi

authentik/k8s/secrets.yaml.example

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: authentik-secrets
+  namespace: authentik
+type: Opaque
+stringData:
+  AUTHENTIK_SECRET_KEY: ""
+  AUTHENTIK_POSTGRESQL__PASSWORD: ""
+  AUTHENTIK_POSTGRESQL__USER: authentik
+  AUTHENTIK_BOOTSTRAP_PASSWORD: authentik

cfddns/compose.yaml

@@ -5,7 +5,7 @@ services:
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true
-    network_mode: 'host'
+    network_mode: "host"
     # https://github.com/timothymiller/cloudflare-ddns#-quick-start
     environment:
       - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN:?Cloudflare API token is required}

cfddns/k8s/.gitignore

@@ -0,0 +1 @@
+secret.yaml

cfddns/k8s/deployment.yaml

@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cfddns
+  labels:
+    app: cfddns
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cfddns
+  template:
+    metadata:
+      labels:
+        app: cfddns
+    spec:
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      containers:
+        - name: cloudflare-ddns
+          image: timothyjmiller/cloudflare-ddns:latest
+          imagePullPolicy: Always
+          resources:
+            requests:
+              memory: "20Mi"
+              cpu: "30m"
+            limits:
+              memory: "64Mi"
+              cpu: "50m"
+          envFrom:
+            - secretRef:
+                name: cfddns-secrets

cfddns/k8s/secret.yaml.example

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cfddns-secrets
+type: Opaque
+stringData:
+  CLOUDFLARE_API_TOKEN: your_token
+  DOMAINS: "example.com,www.example.com"
+  IP4_PROVIDER: cloudflare.trace
+  IP6_PROVIDER: none
+  UPDATE_CRON: "@every 5m"
+  UPDATE_ON_START: "true"
+  DELETE_ON_STOP: "false"
+  DELETE_ON_FAILURE: "true"
+  TTL: "1"
+  PROXIED: "true"
+  EMOJI: "true"
+  REJECT_CLOUDFLARE_IPS: "true"

checkmk/compose.yaml

@@ -21,7 +21,7 @@ services:
       # Prod Router
       - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
       - "traefik.http.routers.checkmk.entrypoints=websecure"
-      - "traefik.http.routers.checkmk.tls=true"
+      - "traefik.http.routers.checkmk.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
       - "traefik.http.routers.checkmk-local.entrypoints=websecure"

checkmk/k8s/checkmk.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: checkmk-service
+  namespace: checkmk
+spec:
+  selector:
+    app: checkmk
+  ports:
+    - port: 5000
+      targetPort: 5000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: checkmk-deployment
+  namespace: checkmk
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: checkmk
+  template:
+    metadata:
+      labels:
+        app: checkmk
+    spec:
+      containers:
+        - name: checkmk
+          image: checkmk/check-mk-raw:2.4.0-latest
+          envFrom:
+            - secretRef:
+                name: checkmk-secrets
+            - configMapRef:
+                name: checkmk-config
+          ports:
+            - containerPort: 5000
+          volumeMounts:
+            - name: sites
+              mountPath: /omd/sites
+            - name: tmp
+              mountPath: /opt/omd/sites/cmk/tmp
+          resources:
+            requests:
+              memory: "2Gi"
+              cpu: "600m"
+            limits:
+              memory: "5Gi"
+              cpu: "4"
+      volumes:
+        - name: sites
+          persistentVolumeClaim:
+            claimName: checkmk-sites-pvc
+        - name: tmp
+          emptyDir:
+            medium: Memory
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: checkmk-sites-pvc
+  namespace: checkmk
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

checkmk/k8s/config.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: checkmk-config
+  namespace: checkmk
+data:
+  TZ: Europe/Bratislava
+  CMK_SITE_ID: cmk

checkmk/k8s/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: checkmk-prod
+  namespace: checkmk
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`cmk.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: checkmk-service
+          port: 5000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: checkmk-local
+  namespace: checkmk
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`cmk.workstation.internal`) || Host(`cmk.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: checkmk-service
+          port: 5000

checkmk/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: checkmk

checkmk/k8s/secrets.yaml.example

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: checkmk-secrets
+  namespace: checkmk
+type: Opaque
+stringData:
+  CMK_PASSWORD: "password"

converters/.env.example

@@ -0,0 +1,9 @@
+ACCOUNT_REGISTRATION=false
+HTTP_ALLOWED=false
+ALLOW_UNAUTHENTICAED=false
+AUTO_DELETE_EVERY_N_HOURS=24
+WEBROOT=/convert
+HIDE_HISTORY=false
+LANGUAGE=en
+UNAUTHED_USER_SHARING=false
+MAX_CONVERT_PROCESS=0

converters/compose.yaml

@@ -0,0 +1,70 @@
+services:
+  convertx:
+    container_name: convertx
+    image: ghcr.io/c4illin/convertx:latest
+    restart: unless-stopped
+    ports:
+      - "9992:3000"
+    # https://github.com/C4illin/ConvertX#environment-variables
+    environment:
+      - JWT_SECRET=$(JWT_SECRET)
+      - ACCOUNT_REGISTRATION=$(ACCOUNT_REGISTRATION:-false)
+      - HTTP_ALLOWED=$(HTTP_ALLOWED:-false)
+      - ALLOW_UNAUTHENTICATED=$(ALLOW_UNAUTHENTICATED:-false)
+      - AUTO_DELETE_EVERY_N_HOURS=$(AUTO_DELETE_EVERY_N_HOURS:-24)
+      - WEBROOT=$(WEBROOT)
+      - HIDE_HISTORY=$(HIDE_HISTORY:-false)
+      - LANGUAGE=$(LANGUAGE:-en)
+      - UNAUTHENTICATED_USER_SHARING=$(UNAUTHENTICATED_USER_SHARING:-false)
+      - MAX_CONVERT_PROCESS=$(MAX_CONVERT_PROCESS:-0)
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.convertx.loadbalancer.server.port=3000"
+      # Prod Router
+      - "traefik.http.routers.convertx.rule=(Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx.entrypoints=websecure"
+      - "traefik.http.routers.convertx.priority=50"
+      - "traefik.http.routers.convertx.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.convertx-local.rule=Host(`workstation.internal`) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx-local.entrypoints=websecure"
+      - "traefik.http.routers.convertx-local.priority=50"
+      - "traefik.http.routers.convertx-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.convertx-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`/convert`)"
+      - "traefik.http.routers.convertx-dev.entrypoints=websecure"
+      - "traefik.http.routers.convertx-dev.priority=50"
+      - "traefik.http.routers.convertx-dev.tls=true"
+    networks:
+      - proxy
+    volumes:
+      - data:/app/data
+
+  bentopdf:
+    container_name: bentopdf
+    image: bentopdf/bentopdf:latest
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.bentopdf.loadbalancer.server.port=8080"
+
+      # Prod router
+      - "traefik.http.routers.bentopdf.rule=Host(`pdf.forust.xyz`)"
+      - "traefik.http.routers.bentopdf.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.bentopdf.tls=true"
+      # Local router
+      - "traefik.http.routers.bentopdf-local.rule=Host(`pdf.wokstation.internal`)"
+      - "traefik.http.routers.bentopdf-local.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf-local.tls=true"
+      # Dev router
+      - "traefik.http.routers.bentopdf-dev.rule=Host(`pdf.gigaforust.internal`)"
+      - "traefik.http.routers.bentopdf-dev.entrypoints=websecure"
+      - "traefik.http.routers.bentopdf-dev.tls=true"
+    networks:
+      - proxy
+networks:
+  proxy:
+    external: true
+volumes:
+  data:

converters/k8s/bentopdf.yaml

@@ -0,0 +1,42 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: bentopdf-service
+  namespace: converters
+spec:
+  selector:
+    app: bentopdf
+  ports:
+    - port: 8080
+      targetPort: 8080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bentopdf-deployment
+  namespace: converters
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: bentopdf
+  template:
+    metadata:
+      labels:
+        app: bentopdf
+    spec:
+      containers:
+        - image: bentopdf/bentopdf:latest
+          imagePullPolicy: Always
+          name: bentopdf
+          ports:
+            - containerPort: 8080
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+              ephemeral-storage: "100Mi"
+            limits:
+              memory: "700Mi"
+              cpu: "700m"
+              ephemeral-storage: "5Gi"

converters/k8s/config.yaml.example

@@ -0,0 +1,16 @@
+# test manifest with docker and k8s config keys mismatch
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: convertx-config
+  namespace: converters
+data:
+  ACCOUNT_REGISTRATION: "false"
+  HTTP_ALLOWED: "false"
+  ALLOW_UNAUTHENTICAED: "false"
+  AUTO_DELETE_EVERY_N_HOURS: "24"
+  WEBROOT: "/convert"
+  HIDE_HISTORY: "false"
+  LANGUAGE: "en"
+  UNAUTHED_USER_SHARING: "false"
+  MAX_CONVERT_PROCESS: "0"

converters/k8s/convertx.yaml

@@ -0,0 +1,63 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: convertx-service
+  namespace: converters
+spec:
+  selector:
+    app: convertx
+  ports:
+    - port: 3000
+      targetPort: 3000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: convertx-deployment
+  namespace: converters
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: convertx
+  template:
+    metadata:
+      labels:
+        app: convertx
+    spec:
+      containers:
+        - image: ghcr.io/c4illin/convertx:latest
+          name: convertx
+          envFrom:
+            - configMapRef:
+                name: convertx-config
+            - secretRef:
+                name: convertx-secrets
+          ports:
+            - containerPort: 3000
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          resources:
+            requests:
+              memory: "250Mi"
+              cpu: "100m"
+            limits:
+              cpu: "1500m"
+              memory: "1.5Gi"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: convertx-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: convertx-pvc
+  namespace: converters
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

converters/k8s/ingress.yaml

@@ -0,0 +1,65 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-prod
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)
+      kind: Rule
+      priority: 50
+      services:
+        - name: convertx-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: convertx-local
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`workstation.internal`) || Host(`gigaforust.internal`)) && PathPrefix(`/convert`)
+      kind: Rule
+      priority: 50
+      services:
+        - name: convertx-service
+          port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bentopdf-prod
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pdf.forust.xyz`)
+      kind: Rule
+      services:
+        - name: bentopdf-service
+          port: 8080
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: bentopdf-local
+  namespace: converters
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pdf.workstation.internal`) || Host(`pdf.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: bentopdf-service
+          port: 8080

converters/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: converters

converters/k8s/secrets.yaml.example

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: convertx-secrets
+  namespace: converters
+type: Opaque
+stringData:
+  jwt-secret: ""

crowdsec/k8s/crowdsec-middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: crowdsec-bouncer
+  namespace: crowdsec
+spec:
+  plugin:
+    crowdsec-bouncer:
+      enabled: true
+      LogLevel: INFO
+      CrowdsecMode: live
+      CrowdsecLapiScheme: http
+      CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
+      CrowdsecLapiKeyFile: "/etc/traefik/secrets/traefik-api-key"

crowdsec/k8s/crowdsec-values.yaml

@@ -0,0 +1,57 @@
+container_runtime: containerd
+agent:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+  extraVolumes:
+    - name: journal-dir
+      hostPath:
+        path: /var/log/journal
+        type: DirectoryOrCreate
+    - name: run-journal-dir
+      hostPath:
+        path: /run/log/journal
+        type: DirectoryOrCreate
+  extraVolumeMounts:
+    - name: journal-dir
+      mountPath: /var/log/journal
+      readOnly: true
+    - name: run-journal-dir
+      mountPath: /run/log/journal
+      readOnly: true
+
+  acquisition:
+    - namespace: traefik
+      podName: "*traefik*"
+      program: traefik
+      poll_without_inotify: true
+
+  acquisitionCustom: |
+    - source: journalctl
+      journalctl_filter:
+        - _SYSTEMD_UNIT=sshd.service
+      labels:
+        type: syslog
+
+  resources:
+    requests:
+      cpu: 50m
+      memory: 100Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi
+
+lapi:
+  env:
+    - name: COLLECTIONS
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+  service:
+    type: NodePort
+    nodePort: 30011
+  resources:
+    requests:
+      cpu: 50m
+      memory: 150Mi
+    limits:
+      cpu: 200m
+      memory: 500Mi

dockmon/compose.yaml

@@ -1,46 +1,46 @@
 services:
-   dockmon:
-      image: darthnorse/dockmon:latest
-      container_name: dockmon
-      restart: unless-stopped
-      # ports:
-      #    - 8000:443
-      volumes:
-         - data:/app/data
-         - /var/run/docker.sock:/var/run/docker.sock
-      healthcheck:
-         test: [ "CMD", "curl", "-k", "-f", "https://localhost:443/health" ]
-         interval: 30s
-         timeout: 10s
-         retries: 3
-      labels:
-         - "traefik.enable=true"
-         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
-         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
-         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
+  dockmon:
+    image: darthnorse/dockmon:latest
+    container_name: dockmon
+    restart: unless-stopped
+    # ports:
+    #   - 8000:443
+    volumes:
+      - data:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    healthcheck:
+      test: ["CMD", "curl", "-k", "-f", "https://localhost:443/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.dockmon.loadbalancer.server.port=443"
+      - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+      - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
 
-         # Prod Router
-         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
-         - "traefik.http.routers.dockmon.entrypoints=websecure"
-         - "traefik.http.routers.dockmon.middlewares=security-headers@file"
-         - "traefik.http.routers.dockmon.tls=true"
-         # Local Router
-         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
-         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-local.tls=true"
-         # Dev Router
-         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
-         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-dev.tls=true"
+      # Prod Router
+      - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
+      - "traefik.http.routers.dockmon.entrypoints=websecure"
+      - "traefik.http.routers.dockmon.middlewares=security-headers@file"
+      - "traefik.http.routers.dockmon.tls.certresolver=letsencrypt"
+      # Local Router
+      - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
+      - "traefik.http.routers.dockmon-local.entrypoints=websecure"
+      - "traefik.http.routers.dockmon-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
+      - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
+      - "traefik.http.routers.dockmon-dev.tls=true"
 
-         # Glance Metadata
-         - glance.name=dockmon
-         - glance.url=https://dockmon.forust.xyz/
-         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
-      networks:
-         - proxy
+      # Glance Metadata
+      - glance.name=dockmon
+      - glance.url=https://dockmon.forust.xyz/
+      - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
+    networks:
+      - proxy
 volumes:
-   data:
+  data:
 networks:
-   proxy:
-      external: true
+  proxy:
+    external: true

dockmon/k8s/dockmon.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dockmon-service
+  namespace: dockmon
+spec:
+  clusterIP: None
+  selector:
+    app: dockmon
+  ports:
+    - port: 443
+      targetPort: 443
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: dockmon-statefulset
+  namespace: dockmon
+spec:
+  serviceName: dockmon-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dockmon
+  template:
+    metadata:
+      labels:
+        app: dockmon
+    spec:
+      containers:
+        - name: dockmon
+          image: darthnorse/dockmon:latest
+          ports:
+            - containerPort: 443
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 443
+              scheme: HTTPS
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "200m"
+            limits:
+              memory: "1.5Gi"
+              cpu: "700m "
+      volumes:
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi

dockmon/k8s/ingress.yaml

@@ -0,0 +1,44 @@
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: dockmon-transport
+  namespace: dockmon
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-prod
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`dockmon.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: security-headers@file
+      services:
+        - name: dockmon-service
+          port: 443
+          serversTransport: dockmon-transport
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dockmon-local
+  namespace: dockmon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`dockmon.workstation.internal`) || Host(`dockmon.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: dockmon-service
+          port: 443
+          serversTransport: dockmon-transport

dockmon/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dockmon

downtify/compose.yaml

@@ -11,11 +11,11 @@ services:
       - "traefik.enable=true"
       - "traefik.http.services.downtify.loadbalancer.server.port=8000"
 
-      # Prod Router 
+      # Prod Router
       - "traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)"
       - "traefik.http.routers.downtify.entrypoints=websecure"
       - "traefik.http.routers.downtify.middlewares=security-chain@file"
-      - "traefik.http.routers.downtify.tls=true"
+      - "traefik.http.routers.downtify.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`)"
       - "traefik.http.routers.downtify-local.entrypoints=websecure"

downtify/k8s/downtify.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: downtify-service
+  namespace: downtify
+spec:
+  selector:
+    app: downtify
+  ports:
+    - port: 8000
+      targetPort: 8000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: downtify-deployment
+  namespace: downtify
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: downtify
+  template:
+    metadata:
+      labels:
+        app: downtify
+    spec:
+      containers:
+        - name: downtify
+          image: ghcr.io/henriquesebastiao/downtify:latest
+          ports:
+            - containerPort: 8000
+          volumeMounts:
+            - name: downloads
+              mountPath: /downloads
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "200m"
+            limits:
+              memory: "1Gi"
+              cpu: "1"
+      volumes:
+        - name: downloads
+          persistentVolumeClaim:
+            claimName: downtify-downloads-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: downtify-downloads-pvc
+  namespace: downtify
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

downtify/k8s/ingress.yaml

@@ -0,0 +1,34 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: downtify-prod
+  namespace: downtify
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`downtify.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: security-chain@file
+      services:
+        - name: downtify-service
+          port: 8000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: downtify-local
+  namespace: downtify
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`downtify.workstation.internal`) || Host(`downtify.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: downtify-service
+          port: 8000

downtify/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: downtify

edu_master/compose.yaml

@@ -5,7 +5,7 @@ services:
     volumes:
       - redis-data:/data
     healthcheck:
-      test: [ "CMD", "redis-cli", "ping" ]
+      test: ["CMD", "redis-cli", "ping"]
       interval: 5s
       timeout: 3s
       retries: 5
@@ -25,7 +25,7 @@ services:
       redis:
         condition: service_healthy
     healthcheck:
-      test: [ "CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1" ]
+      test: ["CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1"]
       interval: 30s
       timeout: 5s
       retries: 10

errorpages/k8s/error-pages.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: error-pages-service
+  namespace: error-pages
+spec:
+  selector:
+    app: error-pages
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: error-pages-deployment
+  namespace: error-pages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: error-pages
+  template:
+    metadata:
+      labels:
+        app: error-pages
+    spec:
+      containers:
+        - name: error-pages
+          image: gcr.forust.xyz/forust/error-pages:latest
+          ports:
+            - containerPort: 80
+---

errorpages/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: error-pages

gitea/compose.yaml

@@ -12,7 +12,7 @@ services:
       - GITEA__database__USER=gitea
       - GITEA__database__PASSWD=gitea
       - GITEA__database__NAME=gitea
-      #Server
+      # Server
       - GITEA__server__ROOT_URL=https://gitea.forust.xyz
       - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
       - GITEA__server__SSH_PORT=2221
@@ -36,7 +36,7 @@ services:
       # Prod Router
       - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
       - "traefik.http.routers.gitea.entrypoints=websecure"
-      - "traefik.http.routers.gitea.tls=true"
+      - "traefik.http.routers.gitea.tls.certresolver"
       # Local Router
       - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`)"
       - "traefik.http.routers.gitea-local.entrypoints=websecure"
@@ -53,7 +53,6 @@ services:
       - "traefik.http.routers.gitea-registry.rule=Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)"
       - "traefik.http.routers.gitea-registry.entrypoints=websecure"
       - "traefik.http.routers.gitea-registry.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.gitea-registry.tls=true"
     ports:
       - "2221:22"
     networks:

gitea/k8s/config.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-config
+  namespace: gitea
+data:
+  GITEA__server__DOMAIN: "gitea.forust.xyz"
+  GITEA__server__ROOT_URL: "https://gitea.forust.xyz"
+  GITEA__server__SSH_DOMAIN: "gitssh.forust.xyz"
+  GITEA__server__SSH_PORT: "2221"
+
+  GITEA__database__DB_TYPE: "postgres"
+  GITEA__database__HOST: "gitea-postgres-service:5432"
+  GITEA__database__NAME: "gitea"
+  GITEA__security__REVERSE_PROXY_LIMIT: "1"
+  GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "*"
+
+  GITEA__mailer__ENABLED: "false"
+  USER_UID: "1000"
+  USER_GID: "1000"

gitea/k8s/gitea.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-service
+  namespace: gitea
+spec:
+  selector:
+    app: gitea
+  ports:
+    - port: 3000
+      name: http
+      targetPort: 3000
+    - port: 2221
+      name: ssh
+      targetPort: 22
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-deployment
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea
+  template:
+    metadata:
+      labels:
+        app: gitea
+    spec:
+      containers:
+        - name: gitea
+          image: docker.gitea.com/gitea:1.26
+          envFrom:
+            - configMapRef:
+                name: gitea-config
+            - secretRef:
+                name: gitea-secrets
+          ports:
+            - containerPort: 3000
+              name: http
+            - containerPort: 2221
+              name: ssh
+          volumeMounts:
+            - name: gitea-data
+              mountPath: /data
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "300m"
+            limits:
+              memory: "1.5Gi"
+              cpu: "1300m"
+      volumes:
+        - name: gitea-data
+          persistentVolumeClaim:
+            claimName: gitea-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-pvc
+  namespace: gitea
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+---

gitea/k8s/ingress.yaml

@@ -0,0 +1,64 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-prod
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+      services:
+        - name: gitea-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-local
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.workstation.internal`) || Host(`gitea.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: gitea-service
+          port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-registry
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
+      kind: Rule
+      services:
+        - name: gitea-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  entryPoints:
+    - ssh
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: gitea-service
+          port: 2221

gitea/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea

gitea/k8s/postgres.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-postgres-service
+  namespace: gitea
+spec:
+  clusterIP: None
+  selector:
+    app: gitea-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gitea-postgres-statefulset
+  namespace: gitea
+spec:
+  selector:
+    matchLabels:
+      app: gitea-postgres
+  serviceName: gitea-postgres-service
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: gitea-postgres
+    spec:
+      containers:
+        - name: gitea-postgres
+          image: postgres:14
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: GITEA__database__USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: GITEA__database__PASSWD
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: GITEA__database__USER
+          ports:
+            - containerPort: 5432
+              name: postgres
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi

gitea/k8s/secrets.yaml.example

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-secrets
+  namespace: gitea
+type: Opaque
+stringData:
+  GITEA__database__USER: "gitea"
+  GITEA__database__PASSWD: "gitea"

glance/compose.yaml

@@ -15,19 +15,22 @@ services:
       - "traefik.services.glance.loadbalancer.server.port=8080"
 
       # Prod Router
-      - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
+      - "traefik.http.routers.glance.rule=(Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/glance`)"
       - "traefik.http.routers.glance.entrypoints=websecure"
-      - "traefik.http.routers.glance.tls=true"
+      - "traefik.http.routers.glance.priority=50"
+      - "traefik.http.routers.glance.tls.certresolver=letsencrypt"
       # Local Router
-      - "traefik.http.routers.glance-local.rule=Host(`glance.workstation.internal`)"
+      - "traefik.http.routers.glance-local.rule=Host(`workstation.internal`) && PathPrefix(`/glance`)"
       - "traefik.http.routers.glance-local.entrypoints=websecure"
+      - "traefik.http.routers.glance-local.priority=50"
       - "traefik.http.routers.glance-local.tls=true"
       # Dev Router
-      - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
+      - "traefik.http.routers.glance-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`/glance`)"
       - "traefik.http.routers.glance-dev.entrypoints=websecure"
+      - "traefik.http.routers.glance-dev.priority=50"
       - "traefik.http.routers.glance-dev.tls=true"
     networks:
       - proxy
 networks:
   proxy:
-    external: true
+    external: true

glance/config/home.yml

@@ -64,7 +64,6 @@
               name: Apple
             - symbol: MSFT
               name: Microsoft
-        
 
         - type: releases
           cache: 1d

glance/config/monitor.yml

@@ -1,15 +1,13 @@
 - name: Monitoring
   columns:
-  - size: small
-    widgets:
-      - type: dns-stats
-        service: adguard
-        url: http://adguardhome:3000
-        username: forust
-        password: ${ADGUARD_PASSWORD}
-  - size: full
-    widgets:
-      - type: docker-containers
-        hide-by-default: false
-        
-  
+    - size: small
+      widgets:
+        - type: dns-stats
+          service: adguard
+          url: http://adguardhome:3000
+          username: forust
+          password: ${ADGUARD_PASSWORD}
+    - size: full
+      widgets:
+        - type: docker-containers
+          hide-by-default: false

glance/k8s/glance-config.yaml

@@ -0,0 +1,211 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: glance-assets
+  namespace: glance
+data:
+  # Инжектируем твой брутализм напрямую в ассеты
+  user.css: |
+    :root {
+        --bg-color: #050505;
+        --text-color: #e0e0e0;
+        --accent: #ffffff;
+        --dim: #666666;
+        --font-mono: 'Courier New', Courier, monospace;
+    }
+
+    /* Принудительно ставим моноширинный шрифт для всего дашборда */
+    body, id, main, div, span, p, a, h1, h2, h3 {
+        font-family: var(--font-mono) !important;
+        letter-spacing: -0.5px;
+    }
+
+    /* Ломаем закругления Glance и делаем жесткие рамки */
+    .widget, .card, main div, [class*="widget"], [class*="card"] {
+        border-radius: 0px !important;
+        border: 1px solid var(--dim) !important;
+        box-shadow: none !important;
+        background-color: var(--bg-color) !important;
+    }
+
+    /* Стилизация ссылок под ховер-эффект из твоего style.css */
+    a {
+        color: var(--text-color) !important;
+        text-decoration: none !important;
+        border-bottom: 1px solid var(--dim) !important;
+        transition: all 0.2s;
+    }
+    a:hover {
+        background-color: var(--text-color) !important;
+        color: var(--bg-color) !important;
+        border-color: var(--text-color) !important;
+    }
+
+    /* Кастомизация заголовков внутри модулей */
+    h2, .widget-title, [class*="title"] {
+        text-transform: uppercase;
+        font-weight: bold;
+    }
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: glance-config
+  namespace: glance
+data:
+  glance.yml: |
+    server:
+      assets-path: /app/assets
+      proxied: true
+      base-url: /glance
+    theme:
+      # Перевели #050505 и #e0e0e0 в формат HSL для Glance
+      background-color: 0 0 2       # Истинно черный фон
+      primary-color: 0 0 88         # Светло-серый текст
+      contrast-multiplier: 1.4
+      positive-color: 140 50 50     # Зеленый для UP-сервисов (не вырвиглазный)
+      negative-color: 0 70 50       # Красный для упавших сайтов
+      custom-css-file: /assets/user.css
+    pages:
+      - $include: home.yml
+      - $include: docker.yml
+      - $include: monitor.yml
+
+  home.yml: |
+    - name: Home
+      columns:
+        - size: small
+          widgets:
+            - type: clock
+              hour-format: 24h
+              timezones:
+                - timezone: Europe/Bratislava
+                  label: Bratislava
+                - timezone: Europe/Kyiv
+                  label: Kyiv
+                - timezone: Europe/Moscow
+                  label: St. Petersburg
+            - type: calendar
+              first-day-of-week: monday
+            - type: rss
+              limit: 10
+              collapse-after: 3
+              cache: 12h
+              feeds:
+                - url: https://selfh.st/rss/
+                  title: selfh.st
+        - size: full
+          widgets:
+            - type: group
+              widgets:
+                - type: hacker-news
+                - type: lobsters
+            - type: videos
+              channels:
+                - UCXuqSBlHAE6Xw-yeJA0Tunw
+                - UCR-DXc1voovS8nhAvccRZhg
+                - UCsBjURrPoezykLs9EqgamOA
+                - UCBJycsmduvYEL83R_U4JriQ
+                - UCHnyfMqiRRG1u-2MsSQLbXA
+            - type: group
+              widgets:
+                - type: reddit
+                  subreddit: technology
+                  show-thumbnails: true
+                - type: reddit
+                  subreddit: selfhosted
+                  show-thumbnails: true
+        - size: small
+          widgets:
+            - type: weather
+              location: London, United Kingdom
+              units: metric
+              hour-format: 12h
+              hide-location: true
+            - type: markets
+              markets:
+                - symbol: SPY
+                  name: S&P 500
+                - symbol: BTC-USD
+                  name: Bitcoin
+                - symbol: NVDA
+                  name: NVIDIA
+                - symbol: AAPL
+                  name: Apple
+                - symbol: MSFT
+                  name: Microsoft
+            - type: releases
+              cache: 1d
+              repositories:
+                - glanceapp/glance
+                - go-gitea/gitea
+                - nextcloud/all-in-one
+
+  docker.yml: |
+    - name: Docker
+      columns:
+        - size: full
+          widgets:
+            - type: docker-containers
+              hide-by-default: false
+
+  monitor.yml: |
+    - name: Monitoring
+      columns:
+        - size: small
+          widgets:
+            - type: dns-stats
+              service: adguard
+              url: http://adguard-service.adguard.svc.cluster.local:3000
+              username: forust
+              password: ${ADGUARD_PASSWORD}
+        - size: full
+          widgets:
+            - type: monitor
+              title: Services Status
+              cache: 1m
+              sites:
+                - title: forust.xyz
+                  url: https://forust.xyz
+                - title: dns.forust.xyz
+                  url: https://dns.forust.xyz
+                - title: www.lk-tour.com.ua
+                  url: https://www.lk-tour.com.ua
+                - title: lk-tour.com.ua
+                  url: https://lk-tour.com.ua
+                # - title: gitssh.forust.xyz
+                  # url: https://gitssh.forust.xyz
+                # - title: gcr.forust.xyz
+                  # url: https://gcr.forust.xyz/v2/
+                - title: gitea.forust.xyz
+                  url: https://gitea.forust.xyz
+                - title: nextcloud.forust.xyz
+                  url: https://nextcloud.forust.xyz
+                - title: mc.forust.xyz
+                  url: https://mc.forust.xyz/map
+                - title: auth.forust.xyz
+                  url: https://auth.forust.xyz
+                - title: metube.forust.xyz
+                  url: https://metube.forust.xyz
+                - title: dockmon.forust.xyz
+                  url: https://dockmon.forust.xyz
+                - title: portainer.forust.xyz
+                  url: https://portainer.forust.xyz
+                - title: termix.forust.xyz
+                  url: https://termix.forust.xyz
+                - title: uptime.forust.xyz
+                  url: https://uptime.forust.xyz
+                - title: cmk.forust.xyz
+                  url: https://cmk.forust.xyz
+                - title: search.forust.xyz
+                  url: https://search.forust.xyz
+                - title: status.forust.xyz
+                  url: https://status.forust.xyz
+                - title: traefik.forust.xyz
+                  url: https://traefik.forust.xyz
+                - title: media.forust.xyz
+                  url: https://media.forust.xyz
+                - title: wfs.forust.xyz
+                  url: https://wfs.forust.xyz
+                - title: forust.xyz/convert
+                  url: https://forust.xyz/convert

glance/k8s/glance.yaml

@@ -0,0 +1,78 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: glance-service
+  namespace: glance
+spec:
+  selector:
+    app: glance
+  ports:
+    - port: 8080
+      targetPort: 8080
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: glance-deployment
+  namespace: glance
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: glance
+  template:
+    metadata:
+      labels:
+        app: glance
+    spec:
+      containers:
+        - name: glance
+          image: glanceapp/glance
+          envFrom:
+            - secretRef:
+                name: glance-secrets
+          ports:
+            - containerPort: 8080
+          volumeMounts:
+            - name: glance-config
+              mountPath: /app/config/glance.yml
+              subPath: glance.yml
+            - name: glance-config
+              mountPath: /app/config/home.yml
+              subPath: home.yml
+            - name: glance-config
+              mountPath: /app/config/docker.yml
+              subPath: docker.yml
+            - name: glance-config
+              mountPath: /app/config/monitor.yml
+              subPath: monitor.yml
+            - name: glance-assets
+              mountPath: /app/assets/user.css
+              subPath: user.css
+            - name: docker-socket
+              mountPath: /var/run/docker.sock
+            - name: localtime
+              mountPath: /etc/localtime
+              readOnly: true
+          resources:
+            requests:
+              memory: "30Mi"
+              cpu: "20m"
+            limits:
+              memory: "100Mi"
+              cpu: "50m"
+      volumes:
+        - name: glance-config
+          configMap:
+            name: glance-config
+        - name: glance-assets
+          configMap:
+            name: glance-config
+        - name: docker-socket
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
+        - name: localtime
+          hostPath:
+            path: /etc/localtime
+            type: File

glance/k8s/ingress.yaml

@@ -0,0 +1,47 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: glance-prod
+  namespace: glance
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/glance`)
+      kind: Rule
+      priority: 50
+      middlewares:
+        - name: glance-stripprefix
+      services:
+        - name: glance-service
+          port: 8080
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: glance-local
+  namespace: glance
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`glance.workstation.internal`) || Host(`glance.gigaforust.internal`)) && PathPrefix(`/glance`)
+      kind: Rule
+      middlewares:
+        - name: glance-stripprefix
+      priority: 50
+      services:
+        - name: glance-service
+          port: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: glance-stripprefix
+  namespace: glance
+spec:
+  stripPrefix:
+    prefixes:
+      - /glance

glance/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: glance

headscale/compose.yaml

@@ -4,6 +4,9 @@ services:
     restart: unless-stopped
     container_name: headscale-server
     command: serve
+    ports:
+      - 18080:8080
+      - 19090:9090
     networks:
       - proxy
     volumes:
@@ -21,7 +24,7 @@ services:
       - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
       - "traefik.http.routers.headscale.entrypoints=websecure"
       - "traefik.http.routers.headscale.service=headscale"
-      - "traefik.http.routers.headscale.tls=true"
+      - "traefik.http.routers.headscale.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
       - "traefik.http.routers.headscale-local.entrypoints=websecure"
@@ -54,7 +57,7 @@ services:
     container_name: headplane
     restart: unless-stopped
     ports:
-      - '3000:3000'
+      - "13000:3000"
     volumes:
       - ./config/headplane.yaml:/etc/headplane/config.yaml
       - ./config/headscale.yaml:/etc/headscale/config.yaml
@@ -65,6 +68,8 @@ services:
   web:
     image: goodieshq/headscale-admin:latest
     restart: unless-stopped
+    ports:
+      - 10080:80
     labels:
       - "traefik.enable=true"
       - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
@@ -73,7 +78,7 @@ services:
       - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
       - "traefik.http.routers.headscale-ui.entrypoints=websecure"
       - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
-      - "traefik.http.routers.headscale-ui.tls=true"
+      - "traefik.http.routers.headscale-ui.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
       - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"

headscale/config/headscale.yaml.example

@@ -33,7 +33,9 @@ derp:
   auto_update_enabled: true
   update_frequency: 24h
 disable_check_updates: false
-ephemeral_node_inactivity_timeout: 30m
+node:
+  ephemeral:
+    inactivity_timeout: 30m
 database:
   type: sqlite
   debug: false
@@ -76,4 +78,3 @@ unix_socket: /var/run/headscale/headscale.sock
 unix_socket_permission: "0770"
 logtail:
   enabled: false
-randomize_client_port: false

headscale/config/policy.json.example

@@ -8,7 +8,8 @@
     "tagOwners": {},
     "hosts": {},
     "acls": [
-        {
+{
+    "randomizeClientPort": false,
             "#ha-meta": {
                 "name": "users",
                 "open": true

headscale/k8s/external-service.yaml

@@ -0,0 +1,59 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-server-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 8080
+      targetPort: 18080
+      name: http
+    - port: 9090
+      targetPort: 19090
+      name: metrics
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headscale-server-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headscale-server-external
+addressType: IPv4
+ports:
+  - port: 18080
+    protocol: TCP
+    name: http
+  - port: 19090
+    protocol: TCP
+    name: metrics
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: headscale-ui-external
+  namespace: headscale
+spec:
+  ports:
+    - port: 80
+      targetPort: 10080
+      name: http
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: headscale-ui-external
+  namespace: headscale
+  labels:
+    kubernetes.io/service-name: headscale-ui-external
+addressType: IPv4
+ports:
+  - port: 10080
+    protocol: TCP
+    name: http
+endpoints:
+  - addresses:
+      - "192.168.88.100"

headscale/k8s/ingress.yaml

@@ -0,0 +1,106 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-server-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: headscale-server-external
+          port: 8080
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-server-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 8080
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-ui-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: security-chain@file
+      services:
+        - name: headscale-ui-external
+          port: 80
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-ui-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/admin`)
+      kind: Rule
+      services:
+        - name: headscale-ui-external
+          port: 80
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-metrics-prod
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: headscale-server-external
+          port: 9090
+  tls:
+    certResolver: letsencrypt
+    domains:
+      - main: hs.forust.xyz
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headscale-metrics-local
+  namespace: headscale
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/metrics`)
+      kind: Rule
+      services:
+        - name: headscale-server-external
+          port: 9090

headscale/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: headscale

homepages/compose.yaml

@@ -17,16 +17,19 @@ services:
       - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
 
       # Prod Router
-      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
+      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`) || Host(`www.forust.xyz`)"
       - "traefik.http.routers.forust-homepage.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage.tls=true"
+      - "traefik.http.routers.forust-homepage.priority=10"
+      - "traefik.http.routers.forust-homepage.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`)"
       - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-local.priority=10"
       - "traefik.http.routers.forust-homepage-local.tls=true"
       # Dev Router
       - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
       - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-dev.priority=10"
       - "traefik.http.routers.forust-homepage-dev.tls=true"
   xdfnx:
     build:
@@ -44,10 +47,9 @@ services:
       - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
 
       # Prod Router
-      - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`)"
+      - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`) || Host(`www.xdfnx.cfd`)"
       - "traefik.http.routers.xdfnx.entrypoints=websecure"
       - "traefik.http.routers.xdfnx.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.xdfnx.tls=true"
       # Local Router
       - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`)"
       - "traefik.http.routers.xdfnx-local.entrypoints=websecure"

homepages/forust_files/index.html

@@ -20,47 +20,73 @@
 
         <hr>
 
-        <section id="socials">
-            <h2>./socials</h2>
-            <ul class="link-list">
-                <li>
-                    <i class="fab fa-github"></i>
-                    <a href="https://github.com/mr-forust" target="_blank">github/mr-forust</a>
-                </li>
-                <li>
-                    <i class="fas fa-flag"></i>
-                    <a href="https://tryhackme.com/p/MrForust" target="_blank">tryhackme/MrForust</a>
-                </li>
-                <li>
-                    <i class="fab fa-telegram-plane"></i>
-                    <a href="https://t.me/MrForust" target="_blank">telegram/MrForust</a>
-                </li>
-                <li>
-                    <i class="fab fa-discord"></i>
-                    <span>discord/mr.forust</span>
-                </li>
-                <li>
-                    <i class="fas fa-envelope"></i>
-                    <a href="mailto:contact@forust.xyz">mail/contact@forust.xyz</a>
-                </li>
-                <li>
-                    <i class="fa-solid fa-key"></i>
-                    <a href=".well-known/pgp-key.asc">security/PGP Key</a>
-                </li>
-                <li>
-                    <p class="comment"># PGP Key Fingerprint: A777 7CB7 D9C4 0A97 443D CCF0 7A3D A455 F820 5B82</p>
-                </li>
-            </ul>
-        </section>
+        <div class="grid-2">
+            <section id="socials">
+                <h2>./socials</h2>
+                <ul class="link-list">
+                    <li>
+                        <i class="fab fa-github"></i>
+                        <a href="https://github.com/mr-forust" target="_blank">github/mr-forust</a>
+                    </li>
+                    <li>
+                        <i class="fas fa-flag"></i>
+                        <a href="https://tryhackme.com/p/MrForust" target="_blank">tryhackme/MrForust</a>
+                    </li>
+                    <li>
+                        <i class="fab fa-telegram-plane"></i>
+                        <a href="https://t.me/MrForust" target="_blank">telegram/MrForust</a>
+                    </li>
+                    <li>
+                        <i class="fab fa-discord"></i>
+                        <span>discord/mr.forust</span>
+                    </li>
+                    <li>
+                        <i class="fas fa-envelope"></i>
+                        <a href="mailto:contact@forust.xyz">mail/contact@forust.xyz</a>
+                    </li>
+                    <li>
+                        <i class="fa-solid fa-key"></i>
+                        <a href=".well-known/pgp-key.asc">security/PGP Key</a>
+                    </li>
+                    <li>
+                        <p class="comment"># PGP Key Fingerprint: A777 7CB7 D9C4 0A97 443D CCF0 7A3D A455 F820 5B82</p>
+                    </li>
+                </ul>
+            </section>
+
+            <section id="tools">
+                <h2>./tools</h2>
+                <ul class="link-list">
+                    <li>
+                        <i class="fa fa-pie-chart"></i>
+                        <a href="https://forust.xyz/glance" target="_blank">forust/dashboard</a>
+                    </li>
+                    <li>
+                        <i class="fa fa-refresh"></i>
+                        <a href="https://forust.xyz/convert" target="_blank">forust/converter</a>
+                    </li>
+                    <li>
+                        <i class="fa-solid fa-file-pdf"></i>
+                        <a href="https://pdf.forust.xyz" target="_blank">pdf.forust.xyz</a>
+                    </li>
+                </ul>
+            </section>
+        </div>
 
         <section id="stack">
-            <h2>./skills_and_tools</h2>
+            <h2>./skills</h2>
             <div class="grid-2">
                 <div>
                     <div class="skill-item">
                         <span>ArchLinux # btw</span>
                         <span class="level">[#######...]</span>
                     </div>
+                    <div class="skill-item">
+                        <span>Kubernetes</span> <span class="level">[###.......]</span>
+                    </div>
+                    <div class="skill-item">
+                        <span>Docker</span> <span class="level">[####......]</span>
+                    </div>
                     <div class="skill-item">
                         <span>Docker Compose</span> <span class="level">[#####.....]</span>
                     </div>
@@ -70,9 +96,6 @@
                     <div class="skill-item">
                         <span>Burpsuite</span> <span class="level">[#####.....]</span>
                     </div>
-                    <div class="skill-item">
-                        <span>Docker</span> <span class="level">[####......]</span>
-                    </div>
                     <div class="skill-item">
                         <span>Steganography</span> <span class="level">[####......]</span>
                     </div>
@@ -157,6 +180,10 @@
                     <a href="https://github.com/unhappychoice/gitlogue" target="_blank">unhappychoice/gitlogue</a>
                     <span class="comment">// nice git log visualizer</span>
                 </li>
+                <li>
+                    <a href="https://github.com/tstack/lnav" target="_blank">tstack/lnav</a>
+                    <span class="comment">// powerful log reader</span>
+                </li>
                 <li>
                     <a href="https://github.com/mountain-loop/yaak" target="_blank">mountain-loop/yaak</a>
                     <span class="comment">// modern, fancy api client</span>

homepages/k8s/homepages.yaml

@@ -0,0 +1,81 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: forust-homepage-service
+  namespace: homepages
+spec:
+  selector:
+    app: forust-homepage
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: forust-homepage-deployment
+  namespace: homepages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: forust-homepage
+  template:
+    metadata:
+      labels:
+        app: forust-homepage
+    spec:
+      containers:
+        - name: forust-homepage
+          image: gcr.forust.xyz/forust/forust-homepage:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+          resources:
+            requests:
+              memory: "10Mi"
+              cpu: "20m"
+            limits:
+              memory: "100Mi"
+              cpu: "50m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: xdfnx-homepage-service
+  namespace: homepages
+spec:
+  selector:
+    app: xdfnx-homepage
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: xdfnx-homepage-deployment
+  namespace: homepages
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: xdfnx-homepage
+  template:
+    metadata:
+      labels:
+        app: xdfnx-homepage
+    spec:
+      containers:
+        - name: xdfnx-homepage
+          image: gcr.forust.xyz/forust/xdfnx-homepage:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+          resources:
+            requests:
+              memory: "10Mi"
+              cpu: "20m"
+            limits:
+              memory: "100Mi"
+              cpu: "50m"

homepages/k8s/ingress.yaml

@@ -0,0 +1,69 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: forust-homepage-prod
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`forust.xyz`) || Host(`www.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      priority: 10
+      services:
+        - name: forust-homepage-service
+          port: 80
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: forust-homepage-local
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`landing.workstation.internal`) || Host(`landing.gigaforust.internal`)
+      kind: Rule
+      priority: 10
+      services:
+        - name: forust-homepage-service
+          port: 80
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xdfnx-homepage-prod
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`xdfnx.cfd`) || Host(`www.xdfnx.cfd`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: xdfnx-homepage-service
+          port: 80
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xdfnx-homepage-local
+  namespace: homepages
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`xdfnx.workstation.internal`) || Host(`xdfnx.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: xdfnx-homepage-service
+          port: 80

homepages/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: homepages

kener/compose.yaml

@@ -23,7 +23,7 @@ services:
       # Prod Router
       - "traefik.http.routers.kener.rule=Host(`status.forust.xyz`)"
       - "traefik.http.routers.kener.entrypoints=websecure"
-      - "traefik.http.routers.kener.tls=true"
+      - "traefik.http.routers.kener.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.kener-local.rule=Host(`status.workstation.internal`)"
       - "traefik.http.routers.kener-local.entrypoints=websecure"
@@ -42,7 +42,7 @@ services:
     volumes:
       - redis:/data
     healthcheck:
-      test: [ "CMD", "redis-cli", "ping" ]
+      test: ["CMD", "redis-cli", "ping"]
       interval: 6s
       timeout: 5s
       retries: 5

kener/k8s/config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kener-config
+  namespace: kener
+data:
+  ORIGIN: "https://status.forust.xyz"
+  REDIS_URL: "redis://kener-redis-service:6379"
+  TZ: "Etc/UTC"

kener/k8s/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: kener-prod
+  namespace: kener
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`status.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+      services:
+        - name: kener-service
+          port: 3000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: kener-local
+  namespace: kener
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`status.workstation.internal`) || Host(`status.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: kener-service
+          port: 3000

kener/k8s/kener.yaml

@@ -0,0 +1,80 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kener-service
+  namespace: kener
+spec:
+  selector:
+    app: kener
+  ports:
+    - port: 3000
+      targetPort: 3000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kener-deployment
+  namespace: kener
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kener
+  template:
+    metadata:
+      labels:
+        app: kener
+    spec:
+      containers:
+        - name: kener
+          image: rajnandan1/kener:4.1.0
+          envFrom:
+            - configMapRef:
+                name: kener-config
+            - secretRef:
+                name: kener-secrets
+          resources:
+            requests:
+              memory: "300Mi"
+              cpu: "350m"
+            limits:
+              memory: "2Gi"
+              cpu: "1"
+          ports:
+            - containerPort: 3000
+          volumeMounts:
+            - name: kener-db
+              mountPath: /app/database
+            - name: kener-uploads
+              mountPath: /app/uploads
+      volumes:
+        - name: kener-db
+          persistentVolumeClaim:
+            claimName: kener-db-pvc
+        - name: kener-uploads
+          persistentVolumeClaim:
+            claimName: kener-uploads-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: kener-db-pvc
+  namespace: kener
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: kener-uploads-pvc
+  namespace: kener
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

kener/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kener

kener/k8s/redis.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kener-redis-service
+  namespace: kener
+spec:
+  clusterIP: None
+  selector:
+    app: kener-redis
+  ports:
+    - name: redis
+      port: 6379
+      targetPort: 6379
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: kener-redis
+  namespace: kener
+spec:
+  serviceName: kener-redis-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kener-redis
+  template:
+    metadata:
+      labels:
+        app: kener-redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          ports:
+            - containerPort: 6379
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+  volumeClaimTemplates:
+    - metadata:
+        name: redis-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi

kener/k8s/secrets.yaml.example

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kener-secrets
+  namespace: kener
+type: Opaque
+stringData:
+  KENER_SECRET_KEY: ""

metube/compose.yaml

@@ -20,7 +20,7 @@ services:
       - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
       - "traefik.http.routers.metube.entrypoints=websecure"
       - "traefik.http.routers.metube.middlewares=security-chain@file"
-      - "traefik.http.routers.metube.tls=true"
+      - "traefik.http.routers.metube.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`)"
       - "traefik.http.routers.metube-local.entrypoints=websecure"

metube/k8s/config.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: metube-config
+  namespace: metube
+data:
+  DOWNLOAD_MODE: "limited"
+  MAX_CONCURRENT_DOWNLOADS: "3"
+  DELETE_FILE_ON_TRASHCAN: "true"
+  DEFAULT_OPTION_PLAYLIST_STRICT_MODE: "true"
+  CLEAR_COMPLETED_AFTER: "600" # 10 min

metube/k8s/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: metube-prod
+  namespace: metube
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`metube.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: security-headers@file
+      services:
+        - name: metube-service
+          port: 8081
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: metube-local
+  namespace: metube
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`metube.workstation.internal`) || Host(`metube.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: metube-service
+          port: 8081

metube/k8s/metube.yaml

@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: metube-service
+  namespace: metube
+spec:
+  selector:
+    app: metube
+  ports:
+    - port: 8081
+      targetPort: 8081
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: metube-deployment
+  namespace: metube
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: metube
+  template:
+    metadata:
+      labels:
+        app: metube
+    spec:
+      containers:
+        - name: metube
+          image: ghcr.io/alexta69/metube
+          envFrom:
+            - configMapRef:
+                name: metube-config
+          ports:
+            - containerPort: 8081
+          volumeMounts:
+            - name: downloads
+              mountPath: /downloads
+          resources:
+            requests:
+              memory: "600Mi"
+              cpu: "400m"
+            limits:
+              memory: "2Gi"
+              cpu: "1700m"
+      volumes:
+        - name: downloads
+          emptyDir:
+            sizeLimit: 20Gi

metube/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metube

n8n/compose.yaml

@@ -32,7 +32,7 @@ services:
       # Prod Router
       - "traefik.http.routers.n8n.rule=Host(`n8n.forust.xyz`)"
       - "traefik.http.routers.n8n.entrypoints=websecure"
-      - "traefik.http.routers.n8n.tls=true"
+      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.n8n-local.rule=Host(`n8n.workstation.internal`)"
       - "traefik.http.routers.n8n-local.entrypoints=websecure"
@@ -54,4 +54,4 @@ networks:
 
 volumes:
   node-data:
-  files:
+  files:

n8n/k8s/config.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: n8n-config
+  namespace: n8n
+data:
+  N8N_PORT: "5678"
+  N8N_RUNNERS_ENABLED: "true"
+  NODE_ENV: production
+  GENERIC_TIMEZONE: Europe/Bratislava
+  TZ: Europe/Bratislava
+  N8N_SECURE_COOKIE: "false"
+  N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE: "true"
+  N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: "true"

n8n/k8s/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: n8n-prod
+  namespace: n8n
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`n8n.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+      services:
+        - name: n8n-service
+          port: 5678
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: n8n-local
+  namespace: n8n
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`n8n.workstation.internal`) || Host(`n8n.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: n8n-service
+          port: 5678

n8n/k8s/n8n.yaml

@@ -0,0 +1,78 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: n8n-service
+  namespace: n8n
+spec:
+  selector:
+    app: n8n
+  ports:
+    - port: 5678
+      targetPort: 5678
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n-deployment
+  namespace: n8n
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: n8n
+  template:
+    metadata:
+      labels:
+        app: n8n
+    spec:
+      containers:
+        - name: n8n
+          image: docker.n8n.io/n8nio/n8n
+          envFrom:
+            - configMapRef:
+                name: n8n-config
+          ports:
+            - containerPort: 5678
+          volumeMounts:
+            - name: n8n-node-data
+              mountPath: /home/node/.n8n
+            - name: n8n-files
+              mountPath: /files
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "150m"
+            limits:
+              memory: "5Gi"
+              cpu: "1500m"
+      volumes:
+        - name: n8n-node-data
+          persistentVolumeClaim:
+            claimName: n8n-node-pvc
+        - name: n8n-files
+          persistentVolumeClaim:
+            claimName: n8n-files-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-node-pvc
+  namespace: n8n
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-files-pvc
+  namespace: n8n
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

n8n/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: n8n

netronome/compose.yaml

@@ -16,7 +16,7 @@ services:
       # Prod Router
       - "traefik.http.routers.netronome.rule=Host(`nm.forust.xyz`)"
       - "traefik.http.routers.netronome.entrypoints=websecure"
-      - "traefik.http.routers.netronome.tls=true"
+      - "traefik.http.routers.netronome.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.netronome-local.rule=Host(`nm.workstation.internal`)"
       - "traefik.http.routers.netronome-local.entrypoints=websecure"
@@ -41,7 +41,7 @@ services:
     volumes:
       - data:/var/lib/postgresql/data
     healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -U netronome" ]
+      test: ["CMD-SHELL", "pg_isready -U netronome"]
       interval: 5s
       timeout: 5s
       retries: 5
@@ -51,7 +51,6 @@ services:
 volumes:
   data:
 
-
 networks:
   proxy:
     external: true

netronome/k8s/config.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netronome-config
+  namespace: netronome
+data:
+  NETRONOME__DB_TYPE: "postgres"
+  NETRONOME__DB_HOST: "netronome-postgres-service"
+  NETRONOME__DB_PORT: "5432"
+  NETRONOME__DB_NAME: "netronome"
+  NETRONOME__DB_SSLMODE: "disable"
+  NETRONOME__HOST: "0.0.0.0"
+  NETRONOME__PORT: "7575"
+  NETRONOME__BASE_URL: "/"

netronome/k8s/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netronome-prod
+  namespace: netronome
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nm.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+      services:
+        - name: netronome-service
+          port: 7575
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: netronome-local
+  namespace: netronome
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`nm.workstation.internal`) || Host(`nm.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: netronome-service
+          port: 7575

netronome/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netronome

netronome/k8s/netronome.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netronome-service
+  namespace: netronome
+spec:
+  selector:
+    app: netronome
+  ports:
+    - port: 7575
+      protocol: TCP
+      targetPort: 7575
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netronome-deployment
+  namespace: netronome
+  labels:
+    app: netronome
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netronome
+  template:
+    metadata:
+      labels:
+        app: netronome
+    spec:
+      containers:
+        - name: netronome
+          image: ghcr.io/autobrr/netronome:latest
+          ports:
+            - name: netronome-port
+              protocol: TCP
+              containerPort: 7575
+          envFrom:
+            - configMapRef:
+                name: netronome-config
+          env:
+            - name: NETRONOME__DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: netronome-secrets
+                  key: NETRONOME__DB_USER
+            - name: NETRONOME__DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: netronome-secrets
+                  key: NETRONOME__DB_PASSWORD
+          resources:
+            requests:
+              memory: "100Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"

netronome/k8s/postgres.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netronome-postgres-service
+  namespace: netronome
+spec:
+  selector:
+    app: netronome-postgres
+  ports:
+    - protocol: TCP
+      port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: netronome-postgres
+  namespace: netronome
+spec:
+  serviceName: "netronome-postgres-service"
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netronome-postgres
+  template:
+    metadata:
+      labels:
+        app: netronome-postgres
+    spec:
+      containers:
+        - name: netronome-postgres
+          image: postgres:17-alpine
+          ports:
+            - name: postgres-port
+              protocol: TCP
+              containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: netronome-secrets
+                  key: NETRONOME__DB_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: netronome-secrets
+                  key: NETRONOME__DB_PASSWORD
+            - name: POSTGRES_DB
+              valueFrom:
+                configMapKeyRef:
+                  name: netronome-config
+                  key: NETRONOME__DB_NAME
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "500m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          volumeMounts:
+            - name: netronome-pg-data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: netronome-pg-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi

nextcloud/compose.yaml

@@ -5,16 +5,14 @@ services:
     restart: unless-stopped
     container_name: nextcloud-aio-mastercontainer # Do not change
     volumes:
-      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # Do not change (backup) 
-      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config # Do not change (backup)
+      - /var/run/docker.sock:/var/run/docker.sock
       - /dev/dri:/dev/dri
+    ports:
+      - 8888:8080
     networks:
       - nextcloud-aio
       - proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
-      # ports:
-      # - 8081:80 # may be removed if under reverse-proxy
-      # - 8443:8443 
-      # - 8888:8080 # AIO
 
     labels:
       - "traefik.enable=true"
@@ -27,7 +25,7 @@ services:
       # - "traefik.http.routers.nextcloud-aio.rule=Host(`naio.forust.xyz`)"
       # - "traefik.http.routers.nextcloud-aio.entrypoints=websecure"
       # - "traefik.http.routers.nextcloud-aio.middlewares=security-chain@file"
-      # - "traefik.http.routers.nextcloud-aio.tls=true"
+      # - "traefik.http.routers.nextcloud-aio.tls.certresolver=letsencrypt"
       # Local Router
       - "traefik.http.routers.nextcloud-aio-local.rule=Host(`naio.workstation.internal`)"
       - "traefik.http.routers.nextcloud-aio-local.entrypoints=websecure"