Initial Commit

cluster/cert-manager/letsencrypt.yaml

@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer  
+metadata:
+  name: letsencrypt-cloudflare
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: jakebutler@jakebutler.me
+    privateKeySecretRef:
+      name: letsencrypt-cloudflare-key
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token

cluster/ingress/ingress.yaml

@@ -0,0 +1,8 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+ingress:
+  - hostname: "*.panopticons.org"
+    service: https://ingress-nginx-controller.ingress-nginx.svc.cluster.local:443
+    originRequest:
+      noTLSVerify: true
+  - service: http_status:404

cluster/metallb/metallb-pool.yaml

@@ -0,0 +1,14 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: lan-pool
+  namespace: metallb-system
+spec:
+  addresses:
+  - 192.168.0.200-192.168.0.220
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: l2
+  namespace: metallb-system

cluster/namespaces/cloudflared.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudflared
+  labels:
+    name: cloudflared

cluster/namespaces/gitea.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
+  labels:
+    name: gitea
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted
+

cluster/namespaces/homepage.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: homepage
+  labels:
+    name: homepage
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted
+

cluster/namespaces/jellyseerr.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jellyseerr
+  labels:
+    name: jellyseerr
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted
+

cluster/namespaces/portainer.yaml

@@ -0,0 +1,8 @@
+---
+# Source: portainer/templates/namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: portainer
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

cluster/namespaces/uptime-kuma.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: uptime-kuma
+  labels:
+    name: uptime-kuma
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted
+