argocd and cert-manager

argocd/ingress.yaml

@@ -0,0 +1,25 @@
+# argocd-ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd
+  namespace: argocd
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - argocd.rogi.casa
+    secretName: argocd-tls
+  rules:
+  - host: argocd.rogi.casa
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: argocd-server
+            port:
+              number: 80

cert-manager/cluster-issuer.yaml

@@ -0,0 +1,15 @@
+# cluster-issuer.yaml
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: roger@ruxu.dev
+    privateKeySecretRef:
+      name: letsencrypt-prod-key
+    solvers:
+    - http01:
+        ingress:
+          ingressClassName: traefik

cert-manager/install.sh

@@ -0,0 +1,2 @@
+kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml
+kubectl wait --for=condition=available --timeout=120s deployment/cert-manager -n cert-manager

gitea/gitea-ingress.yaml

@@ -0,0 +1,25 @@
+# gitea-ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea
+  namespace: gitea
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - git.rogi.casa
+    secretName: gitea-tls
+  rules:
+  - host: git.rogi.casa
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: gitea
+            port:
+              number: 80

ingress.yaml

@@ -59,16 +59,6 @@ spec:
               name: open-webui-service
               port:
                 number: 80
-  - host: nas.rogi.casa
-    http:
-      paths:
-        - pathType: Prefix
-          backend:
-            service:
-              name: external-ip
-              port:
-                number: 80
-          path: /
   - host: gym.rogi.casa
     http:
       paths:
@@ -281,3 +271,37 @@ spec:
               name: argocd-server
               port:
                 number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nas-ingress
+  namespace: default
+  annotations:
+    # Use Traefik as the ingress controller (default in k3s)
+    kubernetes.io/ingress.class: "traefik"
+    # Enable SSL redirect
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    # Optional: enable compression
+    traefik.ingress.kubernetes.io/compress: "true"
+    # Allow large file uploads (5GB) for NAS
+    traefik.ingress.kubernetes.io/max-request-body-bytes: "5368709120"
+    cert-manager.io/issuer: prod-issuer
+    cert-manager.io/issuer-kind: OriginIssuer
+    cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com
+spec:
+  tls:
+    - hosts:
+      - "*.rogi.casa"
+      secretName: rogicasa-tls
+  rules:
+  - host: nas.rogi.casa
+    http:
+      paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: external-ip
+              port:
+                number: 80

myorg-assistant/deployment.yaml

@@ -27,9 +27,9 @@ spec:
               git clone ${GIT_REPO_URL} /data/myorg
               cd /data/myorg
               git config user.name "${GIT_USERNAME}"
-              git config user.email "${GIT_USERNAME}@users.noreply.github.com"
+              git config user.email "${GIT_USERNAME}@rogi.casa"
               git config credential.helper store
-              echo "https://${GIT_USERNAME}:${GIT_TOKEN}@github.com" > ~/.git-credentials
+              echo "https://${GIT_USERNAME}:${GIT_TOKEN}@gitea.rogi.casa" > ~/.git-credentials
             else
               echo "Repository already exists, pulling latest changes..."
               cd /data/myorg
@@ -54,11 +54,12 @@ spec:
         volumeMounts:
         - name: myorg-data
           mountPath: /data/myorg
-      
+      imagePullSecrets:
+      - name: gitea-registry
       containers:
       - name: myorg-assistant
-        image: myorg-assistant:latest
+        image: gitea.rogi.casa/roger/myorg-assistant/myorg-assistant:5215cd9
-        imagePullPolicy: IfNotPresent
+        imagePullPolicy: Always
         command: ["./start.sh"]
         ports:
         - containerPort: 8000
@@ -158,11 +159,8 @@ spec:
             cpu: "500m"
         
         livenessProbe:
-          exec:
+          tcpSocket:
-            command:
+            port: 8000
-            - sh
-            - -c
-            - "ps aux | grep 'python -m src.main bot' | grep -v grep"
           initialDelaySeconds: 30
           periodSeconds: 30
           timeoutSeconds: 5

myorg-assistant/ingress.yaml

@@ -1,15 +1,25 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: myorg-assistant-ingress
+  name: myorg-ingress
   namespace: default
   annotations:
+    # Use Traefik as the ingress controller (default in k3s)
     kubernetes.io/ingress.class: "traefik"
-    # Add SSL/TLS annotations if needed
+    # Enable SSL redirect
-    # cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/redirect-entry-point: https
+    # Optional: enable compression
+    traefik.ingress.kubernetes.io/compress: "true"
+    cert-manager.io/issuer: prod-issuer
+    cert-manager.io/issuer-kind: OriginIssuer
+    cert-manager.io/issuer-group: cert-manager.k8s.cloudflare.com
 spec:
+  tls:
+    - hosts:
+      - "*.rogi.casa"
+      secretName: rogicasa-tls
   rules:
-  - host: myorg.yourdomain.com  # Replace with your domain
+  - host: myorg.rogi.casa
     http:
       paths:
       - path: /
@@ -19,8 +29,3 @@ spec:
             name: myorg-assistant-service
             port:
               number: 8000
-  # Optional: TLS configuration
-  # tls:
-  # - hosts:
-  #   - myorg.yourdomain.com
-  #   secretName: myorg-tls-secret

pihole/pihole.yaml

@@ -113,7 +113,7 @@ metadata:
   labels:
     app: pihole
 spec:
-  type: LoadBalancer  # Change to NodePort or ClusterIP as needed
+  type: LoadBalancer
   ports:
   - port: 53
     targetPort: 53