jake-admin/panopticons-charts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial Commit

Browse Source
This commit is contained in:
Super User
2026-08-14 13:49:47 -04:00
commit 643024b01c
30 changed files with 571 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
.gitignore vendored Normal file
View File

@@ -0,0 +1,24 @@
#K3s Secrets
bootstrap/token
bootstrap/get_helm.sh
charts/
*.kubeconfig
kubeconfig
k3s.yaml
#Cloudflare variables
*.json
!**/kustomization.json
.cloudflared/
#TLS Certs
*.crt
*.key
*.pem
#Secret Manifests
**/secret.yaml
**/secrets.yaml
*-secret.yaml

9
apps/argocd/apps/gitea.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: gitea
namespace: argocd
spec:
project: default
source:

20
apps/argocd/ingress.yaml Normal file
View File

@@ -0,0 +1,20 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: argocd
namespace: argocd
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
ingressClassName: traefik
rules:
- host: argo.panopticons.org
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: argocd-server
port:
number: 80

21
apps/cloudflared/configmap.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: cloudflared-config
namespace: cloudflared
data:
config.yaml: |
tunnel: 63418c8c-38c2-45db-968b-7f3fab3c75a6
credentials-file: /etc/cloudflared/creds/credentials.json
ingress:
- hostname: jellyfin.panopticons.org
service: http://10.0.20.52:8096
- hostname: plex.panopticons.org
service: http://10.0.20.53:32400
- hostname: "*.panopticons.org"
service: https://traefik.kube-system.svc.cluster.local:443
originRequest:
noTLSVerify: true
- service: http_status:404

67
apps/cloudflared/deployment.yaml Normal file
View File

@@ -0,0 +1,67 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: cloudflared
namespace: cloudflared
spec:
replicas: 2
selector:
matchLabels:
app: cloudflared
template:
metadata:
labels:
app: cloudflared
spec:
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
fsGroup: 65532
seccompProfile:
type: RuntimeDefault
containers:
- name: cloudflared
image: cloudflare/cloudflared:2025.4.0
args:
- tunnel
- --config
- /etc/cloudflared/config.yaml
- --metrics
- 0.0.0.0:2000
- --protocol
- http2
- --no-autoupdate
- run
volumeMounts:
- name: config
mountPath: /etc/cloudflared/config.yaml
subPath: config.yaml
- name: creds
mountPath: /etc/cloudflared/creds
readOnly: true
resources:
requests:
memory: "256Mi"
cpu: "100m"
limits:
memory: "512Mi"
cpu: "500m"
livenessProbe:
httpGet:
path: /ready
port: 2000
initialDelaySeconds: 10
periodSeconds: 10
securityContext:
allowPrivilegeEscalation: False
capabilities:
drop:
- ALL
volumes:
- name: config
configMap:
name: cloudflared-config
- name: creds
secret:
secretName: tunnel-credentials

38
apps/gitea/deployment.yaml Normal file
View File

@@ -0,0 +1,38 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: gitea
namespace: gitea
spec:
replicas: 1
selector:
matchLabels:
app: gitea
template:
metadata:
labels:
app: gitea
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
containers:
- name: gitea
image: gitea/gitea:latest-rootless
ports:
- containerPort: 3000
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /data
name: gitea-data
volumes:
- name: gitea-data
persistentVolumeClaim:
claimName: gitea-pvc

24
apps/gitea/ingress.yaml Normal file
View File

@@ -0,0 +1,24 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: gitea
namespace: gitea
annotations:
cert-manager.io/cluster-issuer: letsencrypt-cloudflare
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
tls:
- hosts:
- git.panopticons.org
secretName: wildcard-panopticon-org-tls
rules:
- host: git.panopticons.org
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: gitea
port:
number: 3000

12
apps/gitea/pvc.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: gitea-pvc
namespace: gitea
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi

12
apps/gitea/service.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: Service
metadata:
name: gitea
namespace: gitea
spec:
ports:
- port: 3000
targetPort: 3000
selector:
app: gitea

42
apps/homepage/deployment.yaml Normal file
View File

@@ -0,0 +1,42 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: homepage
namespace: homepage
spec:
replicas: 1
selector:
matchLabels:
app: homepage
template:
metadata:
labels:
app: homepage
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: homepage
image: linuxserver/heimdall:latest
env:
- name: PUID
value: "1000"
- name: PGID
value: "1000"
- name: TZ
value: "America/Los_Angeles"
ports:
- containerPort: 80
volumeMounts:
- mountPath: /config
name: homepage-data
volumes:
- name: homepage-data
persistentVolumeClaim:
claimName: homepage-pvc

24
apps/homepage/ingress.yaml Normal file
View File

@@ -0,0 +1,24 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: homepage
namespace: homepage
annotations:
cert-manager.io/cluster-issuer: letsencrypt-cloudflare
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
tls:
- hosts:
- home.panopticons.org
secretName: wildcard-panopticon-org-tls
rules:
- host: home.panopticons.org
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: homepage
port:
number: 80

12
apps/homepage/pvc.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: homepage-pvc
namespace: homepage
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

12
apps/homepage/service.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: Service
metadata:
name: homepage
namespace: homepage
spec:
ports:
- port: 80
targetPort: 80
selector:
app: homepage

28
apps/jellyseerr/deployment.yaml Normal file
View File

@@ -0,0 +1,28 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: jellyseerr
namespace: jellyseerr
spec:
replicas: 1
selector:
matchLabels:
app: jellyseerr
template:
metadata:
labels:
app: jellyseerr
spec:
containers:
- name: jellyseerr
image: fallenbagel/jellyseerr:latest
ports:
- containerPort: 5055
volumeMounts:
- mountPath: /app/config
name: jellyseerr-data
volumes:
- name: jellyseerr-data
persistentVolumeClaim:
claimName: jellyseerr-pvc

24
apps/jellyseerr/ingress.yaml Normal file
View File

@@ -0,0 +1,24 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: jellyseerr
namespace: jellyseerr
annotations:
cert-manager.io/cluster-issuer: letsencrypt-cloudflare
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
tls:
- hosts:
- requests.panopticons.org
secretName: wildcard-panopticon-org-tls
rules:
- host: requests.panopticons.org
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: jellyseerr
port:
number: 80

12
apps/jellyseerr/pvc.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: jellyseerr-pvc
namespace: jellyseerr
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi

12
apps/jellyseerr/service.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: Service
metadata:
name: jellyseerr
namespace: jellyseerr
spec:
ports:
- port: 80
targetPort: 5055
selector:
app: jellyseerr

38
apps/uptime-kuma/deployment.yaml Normal file
View File

@@ -0,0 +1,38 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: uptime-kuma
namespace: uptime-kuma
spec:
replicas: 1
selector:
matchLabels:
app: uptime-kuma
template:
metadata:
labels:
app: uptime-kuma
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
containers:
- name: uptime-kuma
image: louislam/uptime-kuma:2-slim-rootless
ports:
- containerPort: 3001
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts:
- mountPath: /data
name: uptime-kuma-data
volumes:
- name: uptime-kuma-data
persistentVolumeClaim:
claimName: uptime-kuma-pvc

24
apps/uptime-kuma/ingress.yaml Normal file
View File

@@ -0,0 +1,24 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: uptime-kuma
namespace: uptime-kuma
annotations:
cert-manager.io/cluster-issuer: letsencrypt-cloudflare
traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
tls:
- hosts:
- status.panopticons.org
secretName: wildcard-panopticon-org-tls
rules:
- host: status.panopticons.org
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: uptime-kuma
port:
number: 3001

12
apps/uptime-kuma/pvc.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: uptime-kuma-pvc
namespace: uptime-kuma
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi

12
apps/uptime-kuma/service.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: v1
kind: Service
metadata:
name: uptime-kuma
namespace: uptime-kuma
spec:
ports:
- port: 3001
targetPort: 3001
selector:
app: uptime-kuma

16
cluster/cert-manager/letsencrypt.yaml Normal file
View File

@@ -0,0 +1,16 @@
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: letsencrypt-cloudflare
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: jakebutler@jakebutler.me
privateKeySecretRef:
name: letsencrypt-cloudflare-key
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cloudflare-api-token
key: api-token

8
cluster/ingress/ingress.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
ingress:
- hostname: "*.panopticons.org"
service: https://ingress-nginx-controller.ingress-nginx.svc.cluster.local:443
originRequest:
noTLSVerify: true
- service: http_status:404

14
cluster/metallb/metallb-pool.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
name: lan-pool
namespace: metallb-system
spec:
addresses:
- 192.168.0.200-192.168.0.220
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
name: l2
namespace: metallb-system

6
cluster/namespaces/cloudflared.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: cloudflared
labels:
name: cloudflared

10
cluster/namespaces/gitea.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: v1
kind: Namespace
metadata:
name: gitea
labels:
name: gitea
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted

10
cluster/namespaces/homepage.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: v1
kind: Namespace
metadata:
name: homepage
labels:
name: homepage
pod-security.kubernetes.io/enforce: baseline
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted

10
cluster/namespaces/jellyseerr.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: v1
kind: Namespace
metadata:
name: jellyseerr
labels:
name: jellyseerr
pod-security.kubernetes.io/enforce: baseline
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted

8
cluster/namespaces/portainer.yaml Normal file
View File

@@ -0,0 +1,8 @@
---
# Source: portainer/templates/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
name: portainer
labels:
pod-security.kubernetes.io/enforce: privileged

10
cluster/namespaces/uptime-kuma.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: v1
kind: Namespace
metadata:
name: uptime-kuma
labels:
name: uptime-kuma
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted