template for lampa service

.docs/storage-audit-instruction.md

@@ -1,191 +0,0 @@
-# Инструкция: Анализ хранилища Kubernetes и настройка NFS
-
-## Цель
-Проанализировать текущую конфигурацию хранилища Kubernetes и подготовить план внедрения NFS StorageClass для сохранения данных при удалении namespace.
-
-## 1. Собрать информацию о кластере
-
-### 1.1. Версия Kubernetes и тип дистрибутива
-```bash
-kubectl version --short
-# или
-kubectl version
-```
-
-Определить, используется ли k3s, k8s, microk8s и т.д.:
-```bash
-# Проверить наличие k3s
-which k3s
-# Проверить процесс
-ps aux | grep -E 'kube|k3s'
-```
-
-### 1.2. StorageClass
-```bash
-kubectl get storageclass -o wide
-```
-
-Запомнить:
-- `PROVISIONER` — какой драйвер используется
-- `RECLAIMPOLICY` — Delete или Retain
-- Какой StorageClass помечен как `(default)`
-
-### 1.3. Существующие PV и PVC
-```bash
-kubectl get pv -o wide
-kubectl get pvc --all-namespaces
-```
-
-Посмотреть, какие PVC привязаны к каким PV, и какой reclaimPolicy у PV.
-
-### 1.4. Нода и диски
-```bash
-# Список нод
-kubectl get nodes -o wide
-
-# На каждой ноде (через ssh или локально):
-lsblk
-df -h
-cat /etc/fstab
-```
-
-Определить:
-- Есть ли отдельный раздел/диск для данных
-- Куда смонтированы разделы
-- Сколько свободного места
-- Есть ли монтирование NTFS-разделов (как `/media/forust/Programs`)
-
-### 1.5. Где local-path хранит данные (для k3s)
-```bash
-ls -la /var/lib/rancher/k3s/storage/ 2>/dev/null
-# или для microk8s
-ls -la /var/snap/microk8s/common/ 2>/dev/null
-```
-
-## 2. Анализ: сохраняются ли данные при удалении namespace?
-
-| Сценарий | Результат |
-|---|---|
-| `kubectl delete ns <ns>` | Все PVC в namespace удаляются |
-| PVC → PV c `reclaimPolicy: Delete` | PV и данные удалены |
-| PVC → PV c `reclaimPolicy: Retain` | PV остаётся (статус Released), данные целы |
-
-**Вывод:** Если reclaimPolicy в StorageClass = `Delete`, то данные **пропадут**. Если `Retain` — сохранятся.
-
-## 3. План внедрения NFS
-
-### 3.1. Проверить, установлен ли NFS
-```bash
-which nfsstat exportfs mount.nfs
-systemctl status nfs-server 2>/dev/null || systemctl status nfs-kernel-server 2>/dev/null
-```
-
-### 3.2. Выбрать директорию для NFS-экспорта
-
-Варианты (выбрать подходящий):
-- `/var/lib/k8s-nfs/` — на корневом разделе
-- `<путь к отдельному разделу>/k8s-nfs/` — если есть отдельный диск/раздел
-- Не рекомендуется использовать NTFS-раздел (проблемы с правами и производительностью)
-
-Требования:
-- Файловая система: ext4 или xfs (не ntfs!)
-- Достаточно свободного места
-- Права: `755`, владелец root
-
-### 3.3. Установить NFS-сервер
-
-```bash
-# Debian/Ubuntu
-apt update && apt install -y nfs-kernel-server
-
-# RHEL/Fedora
-dnf install -y nfs-utils
-```
-
-### 3.4. Настроить экспорт
-
-Создать директорию:
-```bash
-mkdir -p /var/lib/k8s-nfs
-chmod 755 /var/lib/k8s-nfs
-```
-
-Добавить в `/etc/exports`:
-```
-/var/lib/k8s-nfs *(rw,sync,no_subtree_check,no_root_squash)
-```
-
-Применить:
-```bash
-exportfs -rav
-```
-
-Проверить:
-```bash
-showmount -e localhost
-```
-
-### 3.5. Выбрать способ интеграции с Kubernetes
-
-#### Вариант A: nfs-subdir-external-provisioner (проще)
-```bash
-helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
-helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
-  --namespace kube-system \
-  --set nfs.server=127.0.0.1 \
-  --set nfs.path=/var/lib/k8s-nfs \
-  --set storageClass.name=nfs \
-  --set storageClass.defaultClass=false \
-  --set storageClass.reclaimPolicy=Retain
-```
-
-#### Вариант B: NFS CSI Driver
-```bash
-helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
-helm install csi-driver-nfs csi-driver-nfs/csi-driver-nfs --namespace kube-system
-```
-
-После установки CSI драйвера создать StorageClass:
-```yaml
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: nfs
-provisioner: nfs.csi.k8s.io
-parameters:
-  server: 127.0.0.1
-  share: /var/lib/k8s-nfs
-reclaimPolicy: Retain
-volumeBindingMode: Immediate
-```
-
-### 3.6. Проверить результат
-```bash
-kubectl get storageclass
-kubectl get pods -n kube-system | grep -E 'nfs|provisioner'
-```
-
-## 4. Итоговая конфигурация
-
-После внедрения в кластере будет два StorageClass:
-
-| Имя | Provisioner | ReclaimPolicy | Назначение |
-|---|---|---|---|
-| `local-path` (default) | rancher.io/local-path | Delete | Временные данные, stateless |
-| `nfs` | nfs-subdir-external-provisioner или nfs.csi.k8s.io | Retain | Данные, которые нужно сохранять |
-
-**Главное преимущество:** PVC c `storageClassName: nfs` при удалении namespace сохраняют данные на диске, так как NFS-провизор использует `reclaimPolicy: Retain` или файлы физически остаются в NFS-экспорте.
-
-## 5. Ответы на частые вопросы
-
-**В:** Не упадёт ли local-path при установке NFS?
-**О:** Нет, они независимы. local-path продолжает работать как обычно.
-
-**В:** Данные NFS и local-path будут на одном диске?
-**О:** Да, можно настроить оба на одном разделе, в разных каталогах.
-
-**В:** Что если у меня несколько нод?
-**О:** NFS сервер нужно поднять на одной ноде, а с других нод должна быть доступна шари. Для multi-node лучше использовать отдельный сервер или distributed storage (Longhorn, Rook/Ceph).
-
-**В:** Можно ли использовать существующий NTFS-раздел для NFS?
-**О:** Не рекомендуется — NTFS не поддерживает права Linux (no_root_squash не сработает корректно), возможны проблемы с блокировками и производительностью.

.editorconfig

@@ -1,24 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
-
-[*.{yml,yaml}]
-indent_size = 2
-
-[*.{json,jsonc}]
-indent_size = 2
-
-[*.md]
-trim_trailing_whitespace = false
-
-[*.py]
-indent_size = 4
-
-[{Makefile,makefile}]
-indent_style = tab

.gitea/actionlint.yaml

@@ -1,10 +0,0 @@
-# actionlint configuration. Passed explicitly from the ci workflow:
-#   actionlint -config-file .gitea/actionlint.yaml .gitea/workflows/*.yaml
-#
-# The self-hosted act_runner registers custom labels that actionlint cannot know
-# about, so declare them here instead of silencing the whole runner-label check.
-self-hosted-runner:
-  labels:
-    - arch
-    - homelab
-    - prod

.gitea/workflows/ci.yaml

@@ -1,757 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches:
-      - "**"
-  pull_request:
-  workflow_dispatch:
-
-# Every job here is checkout plus local tools. The token needs to read the tree
-# and nothing else, and saying so keeps a future step that reaches for the API
-# from quietly holding a token that can write to the repository.
-permissions:
-  contents: read
-
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-env:
-  REGISTRY: gcr.forust.xyz
-
-jobs:
-  lint-compose:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      # Structure check for every committed Compose file, active or not.
-      # Interpolation, env-file and bind-mount resolution are all switched off,
-      # because inactive stacks have no .env here and would only fail on their
-      # ${VAR:?} guards. Active stacks get the full check with interpolation in
-      # the deploy workflow, where the real .env files live.
-      - name: Validate Compose files
-        shell: bash
-        run: |
-          set -euo pipefail
-          source .gitea/workflows/compose-lint.sh
-
-          mapfile -t safe_flags < <(compose_safe_flags)
-          echo "docker compose config ${safe_flags[*]-}"
-
-          mapfile -t files < <(compose_files)
-          if [ "${#files[@]}" -eq 0 ]; then
-            echo "No Compose files found."
-            exit 0
-          fi
-
-          failed=0
-          for f in "${files[@]}"; do
-            if ! out="$(validate_compose_file "$f" ${safe_flags[@]+"${safe_flags[@]}"} 2>&1)"; then
-              failed=1
-              echo "::error file=${f}::$(printf '%s' "$out" | head -1)"
-            fi
-          done
-
-          if [ "$failed" -ne 0 ]; then
-            echo "Compose validation failed."
-            exit 1
-          fi
-          echo "checked ${#files[@]} Compose file(s)"
-
-  lint-actionlint:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Lint Gitea Actions workflows with actionlint
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh actionlint)"
-          export PATH="$tools_dir:$PATH"
-          actionlint -config-file .gitea/actionlint.yaml -color .gitea/workflows/*.yaml
-
-  lint-shellcheck:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Lint shell scripts with ShellCheck
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck)"
-          export PATH="$tools_dir:$PATH"
-          # userbot/ is a git subtree synced from forust/userbot, so its shell
-          # scripts are upstream's to maintain, not ours. Linting them would let a
-          # routine subtree pull turn the deploy gate red on code we do not own.
-          mapfile -t scripts < <(
-            git ls-files '*.sh' ':(glob)**/*.bash' ':!userbot/**'
-          )
-          if [ "${#scripts[@]}" -eq 0 ]; then
-            echo "No shell scripts found."
-            exit 0
-          fi
-          shellcheck --external-sources --source-path=SCRIPTDIR --severity=style "${scripts[@]}"
-
-  lint-prettier:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Check formatting with Prettier
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh prettier)"
-          export PATH="$tools_dir:$PATH"
-
-          mapfile -t prettier_files < <(
-            git ls-files \
-              | grep -E '\.(md|json|ya?ml|html|css)$' \
-              | grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
-          )
-
-          if [ "${#prettier_files[@]}" -eq 0 ]; then
-            echo "No Prettier-managed files found."
-            exit 0
-          fi
-
-          prettier --check --ignore-unknown "${prettier_files[@]}"
-
-  lint-ruff:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Lint and format-check Python with Ruff
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh ruff)"
-          export PATH="$tools_dir:$PATH"
-          ruff check .
-          ruff format --check .
-
-  lint-yaml:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Lint YAML syntax
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh yamllint)"
-          export PATH="$tools_dir:$PATH"
-
-          mapfile -t yaml_files < <(
-            git ls-files '*.yaml' '*.yml' \
-              ':!node_modules/**' \
-              ':!**/.venv/**'
-          )
-
-          if [ "${#yaml_files[@]}" -eq 0 ]; then
-            echo "No YAML files found."
-            exit 0
-          fi
-
-          yamllint -c .yamllint "${yaml_files[@]}"
-
-  lint-dockerfiles:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Lint Dockerfiles
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh hadolint)"
-          export PATH="$tools_dir:$PATH"
-
-          mapfile -t dockerfiles < <(
-            git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
-          )
-
-          if [ "${#dockerfiles[@]}" -eq 0 ]; then
-            echo "No Dockerfiles found."
-            exit 0
-          fi
-
-          hadolint -c .hadolint.yaml "${dockerfiles[@]}"
-
-  # Known, accepted, and recorded. Each line is a real advisory against a
-  # package we build into the panel image, kept in this workflow rather than in
-  # the package manifest so that a subtree sync from forust/userbot cannot
-  # silently widen the exemption.
-  #
-  # starlette is the reason this job is not simply "fail on everything":
-  # fastapi 0.115.12 pins `starlette<0.47.0`, and the fixes for the last four
-  # below need 0.49.1 through 1.3.1, so clearing them means a jump from fastapi
-  # 0.115.12 to 0.141.x. That is upstream's call, not a drive-by in a lint
-  # commit. Of the seven, four are reachable here in principle: 1942 is a
-  # crafted Range header hitting FileResponse, and the panel serves its built
-  # SPA through exactly that; 249 is request.form() ignoring max_fields for
-  # x-www-form-urlencoded, which is the login form; 1941 is a large multipart
-  # body blocking the event loop; 161 and 248 are unvalidated Host and request
-  # path reaching request.url. 2280 needs HTTPEndpoint, which the panel does
-  # not use, and 2281 is Windows-only, and this deploys on Linux.
-  #
-  # The panel answers on userbot.workstation.internal and has no public
-  # forust.xyz route, which is what keeps the four reachable ones from being
-  # an internet-facing DoS. It still manages Telegram credentials.
-  #
-  # Deleting an entry here is how you accept a new advisory, so the diff says
-  # so out loud.
-  scan-deps:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Audit the Python dependencies that ship in the image
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh pip-audit)"
-          export PATH="$tools_dir:$PATH"
-          # requirements.txt, not requirements-dev.txt: this is what the image
-          # installs, and the test tooling is not a shipped attack surface.
-          pip-audit -r userbot/panel/backend/requirements.txt --strict \
-            --ignore-vuln CVE-2025-67720 \
-            --ignore-vuln PYSEC-2026-161 \
-            --ignore-vuln PYSEC-2026-1941 \
-            --ignore-vuln PYSEC-2026-1942 \
-            --ignore-vuln PYSEC-2026-2280 \
-            --ignore-vuln PYSEC-2026-2281 \
-            --ignore-vuln PYSEC-2026-248 \
-            --ignore-vuln PYSEC-2026-249
-
-      # devDependencies are excluded on purpose. `npm audit` on the full tree
-      # reports 7 findings, and every one of them is a build- or test-time
-      # package: the esbuild CORS advisory needs a vite dev server serving to
-      # the internet, and nanoid's infinite loop needs a custom generator
-      # called with size 0, which postcss does not do. None of them are in the
-      # 91 kB bundle the panel serves. The one production finding, devalue
-      # via svelte, is moderate, which is where --audit-level draws the line;
-      # this fails on the next high or critical one.
-      - name: Audit the production npm dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          # The pinned node, not whatever the runner has. Its system node is a
-          # rolling Arch package: during this very push its npm was missing
-          # entirely, and an hour later it was npm 12 on node 26. Both are the
-          # wrong major anyway — the panel image is node:22-alpine.
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh node)"
-          export PATH="$tools_dir:$PATH"
-          cd userbot/panel/frontend
-          npm ci
-          npm audit --omit=dev --audit-level=high
-
-  test-backend:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      # 25 tests over the panel's pydantic models, its auth flow, the SPA
-      # fallback and the Kubernetes client it shells out with. They existed and
-      # had never been executed by anything.
-      #
-      # Note that userbot/ is a subtree synced from forust/userbot, so a routine
-      # sync can turn this red on upstream's code. Unlike the shellcheck job,
-      # which skips that tree because style disagreements there are ours to
-      # lose, a failing test here is a real defect in a service we deploy.
-      - name: Run the panel backend test suite
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh uv)"
-          export PATH="$tools_dir:$PATH"
-
-          # A venv in a temp dir rather than a checked-out one: the runner is
-          # shared, and a leftover .venv would let a dependency the
-          # requirements no longer pin still satisfy an import.
-          #
-          # --python is not optional. uv otherwise takes whatever interpreter it
-          # finds first, and which one that is depends on the machine: this
-          # runner runs jobs on the host, where the only interpreter is 3.14,
-          # and pyrogram's sync.py calls the bare asyncio.get_event_loop() that
-          # 3.14 no longer auto-creates, so three tests fail at collection. The
-          # image is python:3.13-slim, so 3.13 is also the version worth
-          # testing: uv fetches a managed build of it when the host has none,
-          # which is what makes this job independent of the runner.
-          venv="$(mktemp -d)/venv"
-          uv venv --python 3.13 --quiet "$venv"
-          uv pip install --quiet --python "$venv/bin/python" \
-            -r userbot/panel/backend/requirements-dev.txt
-
-          # `python -m`, not bare `pytest`: the tests import `app.*` relative to
-          # the backend directory, which only works if the cwd is on sys.path,
-          # and only `python -m` puts it there.
-          cd userbot/panel/backend
-          "$venv/bin/python" -m pytest tests/ -q
-
-  test-frontend:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      # One `npm ci` for both checks below: it is by far the slowest part of
-      # this job, and a second one would learn nothing the first did not.
-      #
-      # `npm ci`, not `npm install`, for the same reason the Dockerfile uses it:
-      # the lockfile is what makes the tree that gets checked the tree that
-      # gets shipped.
-      - name: Type-check and test the panel frontend
-        shell: bash
-        run: |
-          set -euo pipefail
-          # The pinned node, not whatever the runner has. Its system node is a
-          # rolling Arch package: during this very push its npm was missing
-          # entirely, and an hour later it was npm 12 on node 26. Both are the
-          # wrong major anyway — the panel image is node:22-alpine.
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh node)"
-          export PATH="$tools_dir:$PATH"
-          cd userbot/panel/frontend
-          npm ci
-
-          # svelte-check has been a devDependency all along with no script
-          # pointing at it, so the type errors it reports had nowhere to
-          # surface. It is clean today, which is the only reason it can be a
-          # gate: it stops at whatever upstream introduces rather than
-          # reporting a backlog we inherited.
-          npm run check
-          npm test
-
-  validate:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 20
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Validate Kubernetes manifests against JSON schemas
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh kubeconform)"
-          export PATH="$tools_dir:$PATH"
-
-          mapfile -t manifests < <(
-            git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
-              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
-          )
-
-          if [ "${#manifests[@]}" -eq 0 ]; then
-            echo "No Kubernetes manifests found."
-            exit 0
-          fi
-
-          kubeconform \
-            -strict \
-            -ignore-missing-schemas \
-            -summary \
-            "${manifests[@]}"
-
-      # kubeconform has no schemas for CRDs, so every IngressRoute, Certificate,
-      # PrometheusRule, Middleware, ServersTransport and ServiceMonitor is silently
-      # skipped above. The live API server knows the real CRD schemas (and runs the
-      # cert-manager / Traefik admission webhooks), so validate there too.
-      #
-      # Only services marked with a k8s/active marker are checked: server-side
-      # dry-run needs the target namespace to exist, and inactive services are not
-      # deployed. Services being enabled for the first time are still covered by
-      # the JSON-schema pass above.
-      #
-      # Main pushes only. `--dry-run=server` persists nothing, but it does execute
-      # the admission webhooks of the production API server, so anyone able to open
-      # a pull request would be able to run arbitrary manifest content through
-      # cert-manager and Traefik. A pull request has nothing to gain from it either:
-      # only main is ever deployed, and this job runs to completion before the
-      # deploy workflow is allowed to start, so a bad CRD is still caught before
-      # anything reaches the cluster -- just on the push rather than on the PR.
-      - name: Note the server-side check is not running here
-        if: github.event_name == 'pull_request' || github.ref != 'refs/heads/main'
-        shell: bash
-        run: |
-          echo "::notice::Skipping the server-side dry-run. It executes the cert-manager and" \
-            "Traefik admission webhooks against the production API server, so it is limited" \
-            "to pushes to main. CRDs are still schema-checked by kubeconform above, and the" \
-            "server-side pass still runs on main before the deploy."
-
-      - name: Validate active manifests against the live API server
-        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if ! kubectl get --raw='/readyz' --request-timeout=10s >/dev/null 2>&1; then
-            echo "::warning::Cluster unreachable — skipped server-side validation of CRDs (IngressRoute, Certificate, PrometheusRule). Review manifest changes manually."
-            exit 0
-          fi
-
-          mapfile -t k8s_dirs < <(
-            git ls-files '*.yaml' '*.yml' \
-              | grep -E '(^|/)k8s/' \
-              | sed -E 's#((^|.*/)k8s)/.*#\1#' \
-              | sort -u
-          )
-
-          manifests=()
-          kustomize_apps=()
-          for dir in "${k8s_dirs[@]}"; do
-            if [ ! -f "${dir}/active" ]; then
-              echo "skip (no k8s/active): ${dir}"
-              continue
-            fi
-            if [ -f "${dir}/overlays/prod/kustomization.yaml" ]; then
-              kustomize_apps+=("${dir}/overlays/prod")
-            elif [ -f "${dir}/base/kustomization.yaml" ]; then
-              kustomize_apps+=("${dir}/base")
-            else
-              while IFS= read -r f; do
-                [ -n "$f" ] && manifests+=("$f")
-              done < <(
-                git ls-files "${dir}/*.yaml" "${dir}/*.yml" \
-                  | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
-              )
-            fi
-          done
-
-          echo "server-side dry-run: ${#manifests[@]} manifests, ${#kustomize_apps[@]} kustomize apps"
-          failed=0
-          for m in ${manifests[@]+"${manifests[@]}"}; do
-            if ! out="$(kubectl apply --dry-run=server -f "$m" 2>&1)"; then
-              failed=1
-              echo "::error file=${m}::$(printf '%s' "$out" | head -1)"
-            fi
-          done
-          for k in ${kustomize_apps[@]+"${kustomize_apps[@]}"}; do
-            if ! out="$(kubectl apply -k "$k" --dry-run=server 2>&1)"; then
-              failed=1
-              echo "::error file=${k}::$(printf '%s' "$out" | head -1)"
-            fi
-          done
-
-          if [ "$failed" -ne 0 ]; then
-            echo "Server-side validation failed. The API server (or an admission webhook) rejected these manifests."
-            exit 1
-          fi
-          echo "server-side dry-run: all active manifests accepted by the API server"
-
-  build:
-    needs:
-      # scan-deps and the two test jobs were missing here, so a commit with a
-      # known-vulnerable dependency or a failing test still moved the :prod tag.
-      # The deploy was blocked either way - it requires the whole workflow to
-      # have succeeded - but the tag had already moved, and the next deploy to
-      # run resolved it. Publishing and passing the checks are the same gate.
-      [
-        lint-actionlint,
-        lint-shellcheck,
-        lint-compose,
-        lint-prettier,
-        lint-ruff,
-        lint-yaml,
-        lint-dockerfiles,
-        scan-deps,
-        test-backend,
-        test-frontend,
-        validate,
-      ]
-    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 60
-    outputs:
-      services: ${{ steps.services.outputs.services }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-        with:
-          fetch-depth: 0
-
-      - name: Detect changed docker-built services
-        id: services
-        shell: bash
-        run: |
-          set -euo pipefail
-          base="${{ github.event.before }}"
-          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
-            base="$(git rev-list --max-parents=0 HEAD)"
-          fi
-
-          # A failed diff used to leave changed_files empty, which reads exactly
-          # like "nothing to build": the job went green having built nothing and
-          # the tag never moved. The status is checked, not assumed.
-          if ! changed="$(git diff --name-only "$base" "${GITHUB_SHA}")"; then
-            echo "::error::cannot diff ${base}..${GITHUB_SHA}"
-            exit 1
-          fi
-          mapfile -t changed_files <<<"$changed"
-
-          services=()
-
-          add_service() {
-            local name="$1"
-            local seen=0
-            for existing in "${services[@]}"; do
-              if [ "$existing" = "$name" ]; then
-                seen=1
-                break
-              fi
-            done
-            if [ "$seen" -eq 0 ]; then
-              services+=("$name")
-            fi
-          }
-
-          for file in "${changed_files[@]}"; do
-            case "$file" in
-              dtek_notif/*)
-                add_service dtek_notif
-                ;;
-              errorpages/*)
-                add_service errorpages
-                ;;
-              userbot/*)
-                add_service userbot
-                ;;
-              homepages/*)
-                add_service homepages
-                ;;
-              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
-                add_service edu_master
-                ;;
-            esac
-          done
-
-          if [ "${#services[@]}" -eq 0 ]; then
-            echo "No docker-built services changed."
-            echo "services=" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          printf '%s\n' "${services[@]}" | tee /tmp/services.txt
-          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
-
-      - name: Log in to registry
-        if: steps.services.outputs.services != ''
-        shell: bash
-        # Through env, not by substitution into the script. A secret written
-        # into a run: block is pasted into the shell source before bash parses
-        # it, so a password containing a quote, a backtick or $(...) becomes
-        # code that runs. Masking the value in the log does not prevent that.
-        env:
-          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          set -euo pipefail
-          printf '%s' "$REGISTRY_PASSWORD" | docker login "${REGISTRY}" \
-            -u "$REGISTRY_USERNAME" \
-            --password-stdin
-
-      - name: Build and push changed images
-        if: steps.services.outputs.services != ''
-        shell: bash
-        run: |
-          # This step was the one run: block in the workflow without it, and it
-          # is the one that cannot afford it: a docker push that failed partway
-          # through the loop used to be followed by more pushes, the loop's exit
-          # status came from the last one, and the job went green with half the
-          # images missing from the registry.
-          set -euo pipefail
-          IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
-
-          # Tags for this push. The commit-pinned name is the point of this
-          # step: the deploy resolves it in preference to :prod, so a deploy
-          # that sat in the queue behind a later push still gets the build of
-          # the commit CI validated, instead of whatever :prod points at by the
-          # time it runs. See render_pinned in deploy-lib.sh.
-          commit_tag=""
-          if [ "${GITHUB_REF_NAME}" = "main" ]; then
-            commit_tag="sha-${GITHUB_SHA:0:12}"
-          fi
-
-          set_tags() {
-            tags=()
-            case "${GITHUB_REF_NAME}" in
-              main) tags+=("main" "prod") ;;
-              dev) tags+=("dev") ;;
-            esac
-            if [ -n "$commit_tag" ]; then
-              tags+=("$commit_tag")
-            fi
-          }
-
-          for service in "${services[@]}"; do
-            case "$service" in
-              dtek_notif)
-                image="${REGISTRY}/forust/dtek-notif"
-                set_tags
-                build_args=()
-                for tag in "${tags[@]}"; do
-                  build_args+=(-t "${image}:${tag}")
-                done
-                docker build \
-                  --cache-from "type=registry,ref=${image}:buildcache" \
-                  --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
-                  "${build_args[@]}" dtek_notif
-                for tag in "${tags[@]}"; do
-                  docker push "${image}:${tag}"
-                done
-                ;;
-              errorpages)
-                image="${REGISTRY}/forust/error-pages"
-                set_tags
-                build_args=()
-                for tag in "${tags[@]}"; do
-                  build_args+=(-t "${image}:${tag}")
-                done
-                docker build \
-                  --cache-from "type=registry,ref=${image}:buildcache" \
-                  --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
-                  "${build_args[@]}" errorpages
-                for tag in "${tags[@]}"; do
-                  docker push "${image}:${tag}"
-                done
-                ;;
-              userbot)
-                set_tags
-                for target in runtime panel; do
-                  case "$target" in
-                    runtime)
-                      context="userbot"
-                      image="${REGISTRY}/forust/userbot"
-                      ;;
-                    panel)
-                      context="userbot/panel"
-                      image="${REGISTRY}/forust/userbot-panel"
-                      ;;
-                  esac
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build \
-                    --cache-from "type=registry,ref=${image}:buildcache" \
-                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
-                    "${build_args[@]}" "$context"
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
-              homepages)
-                for variant in forust xdfnx; do
-                  case "$variant" in
-                    forust)
-                      image="${REGISTRY}/forust/forust-homepage"
-                      ;;
-                    xdfnx)
-                      image="${REGISTRY}/forust/xdfnx-homepage"
-                      ;;
-                  esac
-                  set_tags
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build \
-                    --cache-from "type=registry,ref=${image}:buildcache" \
-                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
-                    "${build_args[@]}" -f "homepages/Dockerfile.${variant}" homepages
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
-              edu_master)
-                for variant in session-keeper webinar-checker; do
-                  case "$variant" in
-                    session-keeper)
-                      context="edu_master/phpsessid-bot"
-                      image="${REGISTRY}/forust/session-keeper"
-                      ;;
-                    webinar-checker)
-                      context="edu_master/webinar-checker"
-                      image="${REGISTRY}/forust/webinar-checker"
-                      ;;
-                  esac
-                  set_tags
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build \
-                    --cache-from "type=registry,ref=${image}:buildcache" \
-                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
-                    "${build_args[@]}" "$context"
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
-            esac
-          done
-
-      # Every image the tree names has to carry the commit-pinned name, not only
-      # the ones this push rebuilt. A push that touches nothing but manifests
-      # builds nothing, and its deploy would then find no commit-pinned tag to
-      # resolve and quietly fall back to the moving :prod - which is the whole
-      # failure the commit-pinned name exists to remove.
-      #
-      # Re-tagging copies the manifest list and transfers no layers, so pinning
-      # six images that already exist costs six registry writes.
-      #
-      # The list is derived from the tree rather than written out here, so an
-      # image added to a manifest is covered without a second place to update.
-      - name: Pin the commit name on the images this push did not rebuild
-        if: github.ref_name == 'main'
-        shell: bash
-        run: |
-          set -euo pipefail
-          commit_tag="sha-${GITHUB_SHA:0:12}"
-          mapfile -t repos < <(
-            git grep -hoE 'gcr\.forust\.xyz/forust/[A-Za-z0-9._-]+' -- '*.yaml' '*.yml' \
-              | sort -u
-          )
-          if [ "${#repos[@]}" -eq 0 ]; then
-            echo "No own images referenced by the tree."
-            exit 0
-          fi
-          echo "pinning ${#repos[@]} image(s) to $commit_tag"
-          for repo in "${repos[@]}"; do
-            if docker buildx imagetools inspect "$repo:$commit_tag" >/dev/null 2>&1; then
-              echo "  already built by this push: ${repo##*/}"
-              continue
-            fi
-            if ! docker buildx imagetools inspect "$repo:prod" >/dev/null 2>&1; then
-              echo "  WARNING: ${repo##*/} has no :prod to pin and no build produced it"
-              continue
-            fi
-            docker buildx imagetools create --tag "$repo:$commit_tag" "$repo:prod"
-            echo "  pinned ${repo##*/}"
-          done

.gitea/workflows/compose-lint.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# Shared helpers for validating Compose files. Sourced both by steps in
-# .gitea/workflows/ci.yaml and by deploy-lib.sh on the workstation.
-#
-# Two levels of checking, matching how the repo is structured:
-#
-#   general  every committed Compose file, active or not. Pure structure check:
-#            no ${VAR} interpolation, no .env lookup, no bind-mount path
-#            resolution. Disabled stacks deliberately have no .env in the repo
-#            and no values on the CI runner, so a full `config` run would fail on
-#            their `${VAR:?}` guards for reasons that have nothing to do with the
-#            change under review.
-#
-#   full     active stacks only, with interpolation and env-file resolution, so
-#            required variables and referenced files are actually resolved. Needs
-#            the gitignored .env files, so this only runs in the deploy workflow
-#            on the workstation.
-#
-# This file is meant to be sourced, not executed.
-
-# All committed Compose files, including the ones deploy never starts.
-compose_files() {
-  git ls-files \
-    '*/compose.yaml' '*/compose.yml' 'compose.yaml' 'compose.yml' \
-    '*/docker-compose.yaml' '*/docker-compose.yml'
-}
-
-# Prints the flags that turn `docker compose config` into the general check.
-# Probed rather than hardcoded so an older Compose without --no-env-resolution
-# still gets the flags it does support.
-compose_safe_flags() {
-  local help flag
-  help="$(docker compose config --help 2>/dev/null || true)"
-  for flag in --no-interpolate --no-env-resolution --no-path-resolution; do
-    if printf '%s' "$help" | grep -q -- "$flag"; then
-      printf '%s\n' "$flag"
-    fi
-  done
-}
-
-# validate_compose_file <file> [extra docker compose config flags...]
-validate_compose_file() {
-  local file="$1"
-  shift
-  docker compose -f "$file" config --quiet "$@"
-}

.gitea/workflows/deploy.yaml

@@ -1,192 +0,0 @@
-name: deploy
-
-on:
-  # Deploy only what CI already validated. workflow_run is used instead of
-  # workflow_dispatch so a red lint/validate run can never reach the cluster.
-  workflow_run:
-    workflows: [ci]
-    types: [completed]
-  workflow_dispatch:
-
-# The deploy jobs read the tree, then reach the cluster over SSH with the
-# deploy key. The Actions token itself is not part of that path, so it gets
-# read-only contents and no more.
-permissions:
-  contents: read
-
-concurrency:
-  group: deploy-main
-  # Queue instead of cancelling. Cancelling a run kills the apply job mid-loop and
-  # takes the verify job down with it, so a superseded deploy would leave the
-  # cluster half-applied and unchecked — the exact failure the verify job exists
-  # to catch. kubectl apply and docker compose up are both idempotent, so letting
-  # the older run finish and then deploying the newer commit costs little.
-  cancel-in-progress: false
-
-env:
-  DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
-  DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
-  DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
-  DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
-  DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-  APPLY_PRUNE: ${{ vars.APPLY_PRUNE }}
-  # workflow_run's own GITHUB_SHA points at the branch head, not at the commit the
-  # finished ci run checked. Pin the exact validated commit instead, so a push
-  # landing mid-deploy cannot make the workstation deploy something else. Also
-  # what the verify job checks the snapshot against. Empty for workflow_dispatch,
-  # which falls back to the current origin/main.
-  DEPLOY_SHA: ${{ github.event.workflow_run.head_sha }}
-
-jobs:
-  preflight:
-    if: >-
-      github.event_name != 'workflow_run' ||
-      (github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.head_branch == 'main')
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Fetch and reset workstation
-        shell: bash
-        run: |
-          set -euo pipefail
-          ./.gitea/workflows/ssh-run.sh preflight
-
-  validate:
-    needs: [preflight]
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    timeout-minutes: 20
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Dry-run manifests and check Secrets
-        shell: bash
-        run: |
-          set -euo pipefail
-          ./.gitea/workflows/ssh-run.sh validate
-
-  apply-k8s:
-    needs: [validate]
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    # Apply only, no verification, so this is just the work itself: snapshot,
-    # then sequential `helm upgrade --atomic --timeout 10m`, then the apply loop.
-    # Verification has its own job and its own budget.
-    #
-    # 45 is roughly four times the measured cost of the stage, which is
-    # deliberately not raised on a theory:
-    #
-    #   helm, healthy          3 no-op upgrades              ~3-5 min
-    #   helm, one release bad  --atomic spends its 10m,      ~10-15 min
-    #                            then rolls that one back
-    #   apply loop             ~40 manifests, 4 of which     ~1 min
-    #                           resolve an image digest
-    #   restart_stale_images   7.6s to find 8 workloads,     ~0.5 min
-    #                           9.8s to resolve their digests
-    #
-    # The helm figure is one release, not three: `set -e` aborts
-    # upgrade_helm_releases on the first failure, so a broken release costs
-    # 10m and the other two are never attempted. Multiplying 10m by three
-    # overstates the worst case by 20 minutes.
-    #
-    # The 45 minutes this was last raised to 45 were still not enough, and the
-    # job logs for those runs no longer exist, so what actually consumed the
-    # budget is not known - the two measurable candidates above account for
-    # ~15 of it. The one unbounded thing left in this stage is
-    # `docker manifest inspect` at deploy-lib.sh:236, which has no timeout
-    # against a registry with a known hang mode. Bound it, and make the stage
-    # announce what it is working on, before spending any of that on a larger
-    # ceiling: a stage that is killed with a diagnosable last line is a bug
-    # report, one that vanishes is not.
-    timeout-minutes: 45
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Apply Kubernetes manifests
-        shell: bash
-        run: |
-          set -euo pipefail
-          ./.gitea/workflows/ssh-run.sh apply-k8s
-
-  apply-compose:
-    needs: [validate]
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    timeout-minutes: 30
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Redeploy docker compose stacks
-        shell: bash
-        run: |
-          set -euo pipefail
-          ./.gitea/workflows/ssh-run.sh apply-compose
-
-  # Watches the workloads this deploy changed and rolls back the ones that never
-  # became healthy. Runs even when the apply jobs failed, timed out or were
-  # cancelled — that is the whole point of splitting it out. `always()` is what
-  # lets it start after a failed dependency; the needs on apply-compose are a
-  # barrier, so verification begins only once both applies are done.
-  verify-k8s:
-    needs: [apply-k8s, apply-compose]
-    if: >-
-      always() &&
-      needs.apply-k8s.result != 'skipped' &&
-      needs.apply-compose.result != 'skipped'
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    # Not raised, because the arithmetic does not close.
-    #
-    # 32 workloads are under management and the wave width is 8, so the verify
-    # itself is 4 waves of ROLLOUT_TIMEOUT (300s) = 20 minutes worst case, when
-    # every rollout times out rather than converging. That is already 20 of 30.
-    #
-    # The other 10 would have to absorb rollback, and rollback_workloads is a
-    # serial `while read` loop at 300s per failed workload. 10 minutes buys two.
-    # Any larger number is buying a bigger multiple of an unbounded term rather
-    # than covering a known cost: 60 minutes buys eight, and 60 minutes is
-    # therefore not a bound, it is a guess with two digits.
-    #
-    # The number becomes derivable the moment rollback uses the same wave width
-    # as the verify: 32 failures then cost 4 waves = 20 minutes instead of 160,
-    # and 45 covers verify plus rollback at full width. That change is to the
-    # recovery path and is not folded into a timeout edit.
-    timeout-minutes: 30
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Verify workloads and roll back on failure
-        shell: bash
-        run: |
-          set -euo pipefail
-          ./.gitea/workflows/ssh-run.sh verify-k8s
-
-  # Asks the public route of every active service whether it is actually
-  # serving, which the rollout check above structurally cannot: a pod can
-  # converge and still be crash-looping, or be listening on a port no Service
-  # points at, or answer 500.
-  #
-  # `always()` for the same reason verify-k8s has it, and it runs after that job
-  # specifically because a rollback is when a route most needs re-checking. The
-  # needs is a barrier, not a filter: whether verify-k8s passed, failed or was
-  # cancelled, the probes are what say whether the cluster is serving, and
-  # suppressing them on a rollback would hide the one run where the answer
-  # matters most.
-  smoke:
-    needs: [verify-k8s]
-    if: always() && needs.verify-k8s.result != 'skipped'
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      - name: Probe the public route of every active service
-        shell: bash
-        run: |
-          set -euo pipefail
-          ./.gitea/workflows/ssh-run.sh smoke

.gitea/workflows/install-ci-tools.sh

@@ -1,233 +0,0 @@
-#!/usr/bin/env bash
-# Installs the pinned CI tools into "$TOOLS_DIR/bin" and echoes that directory
-# on stdout, so callers can do:
-#
-#   export PATH="$(bash .gitea/workflows/install-ci-tools.sh kubeconform shellcheck):$PATH"
-#
-# Versions come from tool-versions.env next to this script and are kept fresh by
-# Renovate. Re-running is cheap: an already-installed tool at the pinned version
-# is left alone.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=tool-versions.env
-. "$here/tool-versions.env"
-
-TOOLS_DIR="${TOOLS_DIR:-${RUNNER_TEMP:-/tmp}/homelab-tools}"
-BIN_DIR="$TOOLS_DIR/bin"
-mkdir -p "$BIN_DIR"
-
-arch="$(uname -m)"
-# Upstream projects disagree on arch spelling: kubeconform and actionlint use
-# Go names (amd64/arm64), shellcheck uses uname names (x86_64/aarch64), node
-# uses neither (x64/arm64), and hadolint mixes the two in a single release
-# (x86_64 but arm64).
-case "$arch" in
-  x86_64 | amd64)
-    goarch=amd64
-    sharch=x86_64
-    nodearch=x64
-    hadolintarch=x86_64
-    ;;
-  aarch64 | arm64)
-    goarch=arm64
-    sharch=aarch64
-    nodearch=arm64
-    hadolintarch=arm64
-    ;;
-  *)
-    echo "install-ci-tools: unsupported architecture: $arch" >&2
-    exit 1
-    ;;
-esac
-
-fetch() {
-  # fetch <url> <dest>
-  if command -v curl >/dev/null 2>&1; then
-    curl -sSLf --retry 3 -o "$2" "$1"
-  elif command -v wget >/dev/null 2>&1; then
-    wget -q -O "$2" "$1"
-  else
-    echo "install-ci-tools: neither curl nor wget is available" >&2
-    exit 1
-  fi
-}
-
-# installed_version <command>
-# Prints the version of an already-installed tool, or nothing. Each tool spells
-# its version flag differently, hence the case.
-installed_version() {
-  local out
-  case "$1" in
-    kubeconform) out="$("$1" -v 2>/dev/null | head -1 || true)" ;;
-    *) out="$("$1" --version 2>/dev/null | head -1 || true)" ;;
-  esac
-  printf '%s' "$out"
-}
-
-# at_version <command> <expected>
-at_version() {
-  case "$(installed_version "$1")" in
-    *"$2"*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-install_kubeconform() {
-  if at_version kubeconform "v${KUBECONFORM_VERSION}"; then
-    return 0
-  fi
-  local tmp
-  tmp="$(mktemp -d)"
-  fetch "https://github.com/yannh/kubeconform/releases/download/v${KUBECONFORM_VERSION}/kubeconform-linux-${goarch}.tar.gz" \
-    "$tmp/kubeconform.tar.gz"
-  tar -xzf "$tmp/kubeconform.tar.gz" -C "$tmp" kubeconform
-  install -m 0755 "$tmp/kubeconform" "$BIN_DIR/kubeconform"
-  rm -rf "$tmp"
-}
-
-install_shellcheck() {
-  if at_version shellcheck "${SHELLCHECK_VERSION}"; then
-    return 0
-  fi
-  local tmp
-  tmp="$(mktemp -d)"
-  fetch "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.${sharch}.tar.xz" \
-    "$tmp/shellcheck.tar.xz"
-  tar -xJf "$tmp/shellcheck.tar.xz" -C "$tmp" --strip-components=1 "shellcheck-v${SHELLCHECK_VERSION}/shellcheck"
-  install -m 0755 "$tmp/shellcheck" "$BIN_DIR/shellcheck"
-  rm -rf "$tmp"
-}
-
-install_uv() {
-  if at_version uv "${UV_VERSION}"; then
-    return 0
-  fi
-  local tmp
-  tmp="$(mktemp -d)"
-  # uv release tags carry no leading v, unlike every other tool installed here.
-  fetch "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-${sharch}-unknown-linux-gnu.tar.gz" \
-    "$tmp/uv.tar.gz"
-  tar -xzf "$tmp/uv.tar.gz" -C "$tmp" --strip-components=1 "uv-${sharch}-unknown-linux-gnu/uv"
-  install -m 0755 "$tmp/uv" "$BIN_DIR/uv"
-  rm -rf "$tmp"
-}
-
-install_hadolint() {
-  if at_version hadolint "${HADOLINT_VERSION}"; then
-    return 0
-  fi
-  # A bare binary, no archive: hadolint ships one file per platform.
-  fetch "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-${hadolintarch}" \
-    "$BIN_DIR/hadolint"
-  chmod 0755 "$BIN_DIR/hadolint"
-}
-
-# ruff and yamllint both come from PyPI as wheels, which uv unpacks for us.
-install_uv_tool() {
-  # <package> <pinned version>
-  if at_version "$1" "$2"; then
-    return 0
-  fi
-  install_uv
-  UV_TOOL_BIN_DIR="$BIN_DIR" uv tool install --force "$1==$2" >/dev/null
-}
-
-install_ruff() {
-  install_uv_tool ruff "${RUFF_VERSION}"
-}
-
-install_yamllint() {
-  install_uv_tool yamllint "${YAMLLINT_VERSION}"
-}
-
-install_pip_audit() {
-  install_uv_tool pip-audit "${PIP_AUDIT_VERSION}"
-}
-
-install_prettier() {
-  if at_version prettier "${PRETTIER_VERSION}"; then
-    return 0
-  fi
-  # Not a standalone binary: prettier's entry point requires ../package.json
-  # relative to its own real path, so the package directory has to survive
-  # next to it. Hence a versioned directory plus a relative symlink, rather
-  # than copying the one file out as the other installers do.
-  local dir="$BIN_DIR/prettier-${PRETTIER_VERSION}"
-  if [ ! -f "$dir/package/package.json" ]; then
-    rm -rf "$dir"
-    mkdir -p "$dir"
-    fetch "https://registry.npmjs.org/prettier/-/prettier-${PRETTIER_VERSION}.tgz" "$dir/prettier.tgz"
-    tar -xzf "$dir/prettier.tgz" -C "$dir"
-    rm -f "$dir/prettier.tgz"
-    # npm strips the exec bit from bin/ on the way into the tarball.
-    chmod 0755 "$dir/package/bin/prettier.cjs"
-  fi
-  # Relative, so the whole tree stays valid if TOOLS_DIR is relocated.
-  ln -sfn "prettier-${PRETTIER_VERSION}/package/bin/prettier.cjs" "$BIN_DIR/prettier"
-}
-
-install_node() {
-  # npm gets checked by running it, not by looking it up: what matters is that
-  # it answers, so a stub, a half-removed Arch package or a name that resolves
-  # to something broken all have to read as "not installed". The runner's npm
-  # is a symlink into /usr/lib/node_modules/npm, which is exactly the kind of
-  # thing that disappears between runs.
-  if at_version node "v${NODE_VERSION}" && [ -n "$(installed_version npm)" ]; then
-    return 0
-  fi
-  # Same shape as prettier above: the tarball's bin/npm and bin/npx are links
-  # into lib/node_modules, so the whole tree has to survive next to them.
-  local dir="$BIN_DIR/node-${NODE_VERSION}"
-  if [ ! -x "$dir/bin/node" ]; then
-    rm -rf "$dir"
-    mkdir -p "$dir"
-    fetch "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${nodearch}.tar.xz" \
-      "$dir/node.tar.xz"
-    tar -xJf "$dir/node.tar.xz" -C "$dir" --strip-components=1 "node-v${NODE_VERSION}-linux-${nodearch}"
-    rm -f "$dir/node.tar.xz"
-  fi
-  # Relative, so the whole tree stays valid if TOOLS_DIR is relocated.
-  for bin in node npm npx; do
-    ln -sfn "node-${NODE_VERSION}/bin/${bin}" "$BIN_DIR/${bin}"
-  done
-}
-
-install_actionlint() {
-  if at_version actionlint "${ACTIONLINT_VERSION}"; then
-    return 0
-  fi
-  local tmp
-  tmp="$(mktemp -d)"
-  fetch "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_${goarch}.tar.gz" \
-    "$tmp/actionlint.tar.gz"
-  tar -xzf "$tmp/actionlint.tar.gz" -C "$tmp" actionlint
-  install -m 0755 "$tmp/actionlint" "$BIN_DIR/actionlint"
-  rm -rf "$tmp"
-}
-
-wanted=("$@")
-if [ "${#wanted[@]}" -eq 0 ]; then
-  wanted=(kubeconform shellcheck actionlint prettier ruff yamllint hadolint)
-fi
-
-for tool in "${wanted[@]}"; do
-  case "$tool" in
-    kubeconform) install_kubeconform ;;
-    shellcheck) install_shellcheck ;;
-    actionlint) install_actionlint ;;
-    prettier) install_prettier ;;
-    ruff) install_ruff ;;
-    yamllint) install_yamllint ;;
-    pip-audit) install_pip_audit ;;
-    hadolint) install_hadolint ;;
-    node) install_node ;;
-    uv) install_uv ;;
-    *)
-      echo "install-ci-tools: unknown tool: $tool" >&2
-      exit 1
-      ;;
-  esac
-done
-
-printf '%s\n' "$BIN_DIR"

.gitea/workflows/renovate-ci.yaml

@@ -1,76 +0,0 @@
-name: renovate-ci
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  validate-renovate:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 20
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      # renovate/k8s/cronjob.yaml is the single source of truth for the image tag,
-      # so the same version that runs in the cluster is the one validated here.
-      - name: Resolve the deployed Renovate image
-        id: image
-        shell: bash
-        run: |
-          set -euo pipefail
-          image="$(sed -n 's|.*image:[[:space:]]*\(renovate/renovate:[^[:space:]]*\).*|\1|p' \
-            renovate/k8s/cronjob.yaml | head -1)"
-          if [ -z "$image" ]; then
-            echo "::error::no renovate/renovate image found in renovate/k8s/cronjob.yaml"
-            exit 1
-          fi
-          echo "using $image"
-          echo "image=$image" >> "$GITHUB_OUTPUT"
-
-      - name: Validate Renovate repository config
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker run --rm \
-            -v "$PWD/renovate:/opt/renovate:ro" \
-            -e RENOVATE_CONFIG_FILE=/opt/renovate/renovate.json \
-            "${{ steps.image.outputs.image }}" \
-            renovate-config-validator /opt/renovate/renovate.json
-
-      # The CronJob cannot read the repository, so renovate/k8s/configmap.yaml
-      # carries an inlined copy of the config. Fail if it no longer matches.
-      - name: Check the generated Renovate ConfigMap
-        shell: bash
-        run: |
-          set -euo pipefail
-          ./.gitea/workflows/sync-renovate-configmap.sh --check
-
-      - name: Validate Renovate Kubernetes manifests
-        shell: bash
-        run: |
-          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh kubeconform)"
-          export PATH="$tools_dir:$PATH"
-          kubeconform \
-            -strict \
-            -ignore-missing-schemas \
-            -summary \
-            renovate/k8s/namespace.yaml \
-            renovate/k8s/configmap.yaml \
-            renovate/k8s/cronjob.yaml
-
-      - name: Validate Renovate Compose file
-        shell: bash
-        run: |
-          set -euo pipefail
-          source .gitea/workflows/compose-lint.sh
-          mapfile -t safe_flags < <(compose_safe_flags)
-          validate_compose_file renovate/renovate-compose.yaml \
-            ${safe_flags[@]+"${safe_flags[@]}"}

.gitea/workflows/renovate-run.yaml

@@ -1,92 +0,0 @@
-name: renovate-run
-
-on:
-  workflow_dispatch:
-    inputs:
-      repositories:
-        description: "Repositories to scan (comma-separated)"
-        required: false
-        default: "forust/homelab"
-      log_level:
-        description: "Renovate log level"
-        required: false
-        default: "info"
-        type: choice
-        options:
-          - info
-          - debug
-      dry_run:
-        description: "Plan only, do not open or update PRs"
-        required: false
-        default: false
-        type: boolean
-
-# Renovate writes through its own bot PAT, passed in as RENOVATE_TOKEN, so the
-# Actions token is only ever used to read the checkout.
-permissions:
-  contents: read
-
-concurrency:
-  group: renovate-run
-  cancel-in-progress: false
-
-jobs:
-  run-renovate:
-    runs-on: [self-hosted, linux, arch, homelab]
-    timeout-minutes: 60
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-      # renovate/k8s/cronjob.yaml is the single source of truth for the image tag.
-      # Reading it here means this workflow validates and runs the exact version
-      # that is deployed, instead of a copy that silently goes stale.
-      - name: Resolve the deployed Renovate image
-        id: image
-        shell: bash
-        run: |
-          set -euo pipefail
-          image="$(sed -n 's|.*image:[[:space:]]*\(renovate/renovate:[^[:space:]]*\).*|\1|p' \
-            renovate/k8s/cronjob.yaml | head -1)"
-          if [ -z "$image" ]; then
-            echo "::error::no renovate/renovate image found in renovate/k8s/cronjob.yaml"
-            exit 1
-          fi
-          echo "using $image"
-          echo "image=$image" >> "$GITHUB_OUTPUT"
-
-      - name: Validate Renovate config
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker run --rm \
-            -v "$PWD/renovate/renovate.json:/opt/renovate/renovate.json:ro" \
-            -e RENOVATE_CONFIG_FILE=/opt/renovate/renovate.json \
-            "${{ steps.image.outputs.image }}" \
-            renovate-config-validator
-
-      - name: Run Renovate
-        shell: bash
-        env:
-          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
-          RENOVATE_REPOSITORIES: ${{ inputs.repositories }}
-          RENOVATE_DRY_RUN: ${{ inputs.dry_run && 'full' || '' }}
-          LOG_LEVEL: ${{ inputs.log_level }}
-        run: |
-          set -euo pipefail
-
-          : "${RENOVATE_TOKEN:?missing RENOVATE_TOKEN secret — add a renovate-bot PAT in repo/org Actions secrets}"
-
-          docker run --rm \
-            -v "$PWD/renovate/renovate.json:/opt/renovate/renovate.json:ro" \
-            -e RENOVATE_PLATFORM=gitea \
-            -e RENOVATE_ENDPOINT=https://gitea.forust.xyz/api/v1 \
-            -e RENOVATE_TOKEN="$RENOVATE_TOKEN" \
-            -e RENOVATE_GITHUB_COM_TOKEN="${RENOVATE_GITHUB_COM_TOKEN:-}" \
-            -e RENOVATE_REPOSITORIES="${RENOVATE_REPOSITORIES:-forust/homelab}" \
-            -e RENOVATE_DRY_RUN="${RENOVATE_DRY_RUN:-}" \
-            -e RENOVATE_CONFIG_FILE=/opt/renovate/renovate.json \
-            -e RENOVATE_BASE_DIR=/tmp/renovate \
-            -e LOG_LEVEL="${LOG_LEVEL:-info}" \
-            "${{ steps.image.outputs.image }}"

.gitea/workflows/ssh-run.sh

@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-# usage: ssh-run.sh <stage>
-# Runs one deploy-lib.sh stage on the workstation over SSH.
-set -euo pipefail
-
-: "${DEPLOY_HOST:?missing DEPLOY_HOST}"
-: "${DEPLOY_USER:?missing DEPLOY_USER}"
-: "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"
-
-deploy_port="${DEPLOY_PORT:-22}"
-deploy_path="${DEPLOY_PATH:-/srv/homelab}"
-deploy_path="$(printf '%s' "$deploy_path" | tr -d '\"' | tr -d '\r' | xargs)"
-
-# The private key is written to a per-run directory that is removed on exit, so a
-# failed or cancelled job cannot leave deploy credentials in the runner's temp
-# directory. Do not use a fixed path: apply-k8s and apply-compose run in parallel.
-key_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/homelab-deploy-key.XXXXXXXX")"
-trap 'rm -rf "$key_dir"' EXIT INT TERM
-
-ssh_key="$key_dir/deploy_key"
-printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
-chmod 600 "$ssh_key"
-
-# A connection that died silently used to hang until the job timeout, and the
-# stage was never re-run: one flaky TCP session cost a whole 45-minute apply.
-# ServerAlive* bounds how long a dead peer goes unnoticed, ConnectTimeout bounds
-# setup. Only exit 255 - ssh's own transport failures - is retried. A stage that
-# fails on its own merits exits with the remote's status, so a real failure
-# still surfaces its own log instead of burning three attempts. The stages are
-# declarative applies, so re-running one that had already committed is harmless.
-ssh_opts=(
-  -i "$ssh_key" -p "$deploy_port"
-  -o BatchMode=yes -o StrictHostKeyChecking=accept-new
-  -o ConnectTimeout=15
-  -o ServerAliveInterval=15 -o ServerAliveCountMax=4
-)
-
-rc=0
-for attempt in 1 2 3; do
-  if [ "$attempt" -gt 1 ]; then
-    echo ":: warning::ssh transport failed, retrying (${attempt}/3)"
-    sleep $((attempt * 5))
-  fi
-  rc=0
-  ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
-    env "REPO=$deploy_path" "APPLY_PRUNE=${APPLY_PRUNE:-false}" \
-    "DEPLOY_SHA=${DEPLOY_SHA:-}" "DEPLOY_SNAPSHOT_DIR=${DEPLOY_SNAPSHOT_DIR:-}" \
-    "STAGE=$1" bash -se <<'EOF' || rc=$?
-source "$REPO/.gitea/workflows/deploy-lib.sh"
-run_stage "$STAGE"
-EOF
-  [ "$rc" -eq 0 ] && break
-  [ "$rc" -ne 255 ] && break
-done
-
-if [ "$rc" -ne 0 ]; then
-  echo ":: error::stage $1 failed over ssh (exit $rc)"
-fi
-exit "$rc"

.gitea/workflows/sync-renovate-configmap.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# Regenerates renovate/k8s/configmap.yaml from renovate/renovate.json.
-#
-# renovate/renovate.json is the single source of truth: the CronJob, the Compose
-# file and the renovate-run workflow all mount that exact file. A ConfigMap cannot
-# read a file from the repository, so the same bytes are inlined here as a literal
-# block. This script keeps the copy honest:
-#
-#   .gitea/workflows/sync-renovate-configmap.sh          # rewrite in place
-#   .gitea/workflows/sync-renovate-configmap.sh --check  # fail if out of date
-#
-# renovate-ci runs the --check form on every PR and push, so a config change that
-# forgets to regenerate the ConfigMap cannot be merged.
-set -euo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-repo="$(git -C "$here" rev-parse --show-toplevel)"
-
-src="$repo/renovate/renovate.json"
-dst="$repo/renovate/k8s/configmap.yaml"
-[ -f "$src" ] || {
-  echo "missing $src" >&2
-  exit 1
-}
-
-render() {
-  cat <<'HEADER'
-# GENERATED FILE - do not edit by hand.
-# Source: renovate/renovate.json
-# Regenerate: .gitea/workflows/sync-renovate-configmap.sh
-# Verify:     .gitea/workflows/sync-renovate-configmap.sh --check
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: renovate-config
-  namespace: renovate
-data:
-  renovate.json: |
-HEADER
-  sed 's/^/    /' "$src"
-}
-
-if [ "${1:-}" = "--check" ]; then
-  if ! diff -u "$dst" <(render) >/dev/null 2>&1; then
-    echo "ERROR: $dst is out of sync with renovate/renovate.json"
-    echo "Run: .gitea/workflows/sync-renovate-configmap.sh"
-    diff -u "$dst" <(render) || true
-    exit 1
-  fi
-  echo "renovate/k8s/configmap.yaml is in sync with renovate/renovate.json"
-  exit 0
-fi
-
-render >"$dst"
-echo "wrote $dst"

.gitea/workflows/tool-versions.env

@@ -1,33 +0,0 @@
-# Pinned versions of the CI tools installed by install-ci-tools.sh.
-# Renovate keeps these up to date (see customManagers in renovate/renovate.json).
-#
-# Every version here except NODE_VERSION matches what was already installed on
-# the runner, so pinning them changes what CI does not at all. It changes what
-# CI does when the runner is rebuilt with something else: today
-# install-ci-tools.sh finds the pinned version already on PATH and installs
-# nothing, and a runner that drifts gets the pinned one installed over it.
-#
-# The renovate image version is NOT pinned here: renovate/k8s/cronjob.yaml is the
-# single source of truth and the workflows read the tag from it, so there is
-# nothing to drift.
-ACTIONLINT_VERSION="1.7.7"
-SHELLCHECK_VERSION="0.11.0"
-KUBECONFORM_VERSION="0.8.0"
-PRETTIER_VERSION="3.8.1"
-RUFF_VERSION="0.16.8"
-YAMLLINT_VERSION="1.38.0"
-HADOLINT_VERSION="2.14.0"
-# pip-audit reads the advisory database over the network, so a floating version
-# would make the same commit report different things on different days. Pin it
-# like the rest: the advisories themselves are the moving part, not the tool.
-PIP_AUDIT_VERSION="2.10.1"
-# uv builds the throwaway venv the pytest job runs in, and unpacks the PyPI
-# wheels for ruff, yamllint and pip-audit.
-UV_VERSION="0.12.17"
-# node runs `npm ci` for the frontend tests and the npm audit, and it is the one
-# pin here that does NOT come from the runner: the runner's system node is a
-# rolling Arch package (it was node 26 with no npm at all when this was pinned),
-# and the panel image is node:22-alpine. Pinned to the image's major on purpose,
-# so the tree that gets tested is the tree that gets built. Renovate keeps this
-# in step with the Dockerfile's node: tag via the "node runtime" group.
-NODE_VERSION="22.23.3"

.gitignore

@@ -5,12 +5,12 @@ sync.ffs_lock
 # Copyparty
 *.hist/
 
-# Volumes, configs and data directories
+# Volumes and data directories
 gitea/gitea-db/
 gitea/gitea-data/*
 n8n/n8n-data/*
 n8n/n8n-node-data/*
-adguardhome/conf/*
+adguardhome/data/*
 dockmon/data/*
 portainer/portainer_data/*
 metube/MeTube_downloads
@@ -21,10 +21,6 @@ checkmk/checkmk/*
 downtify/Downtify_downloads
 headscale/config/*
 headscale/data/*
-# NetBird local hostnames and generated secrets
-netbird/.env
-netbird/secrets/
-searxng/core-config/*
 
 # Steaming services files
 streaming/jellyfin/*
@@ -36,22 +32,17 @@ streaming/qbittorrent/*
 streaming/prowlarr/*
 
 # Homepage 
+homepages/forust_files/assets/images/team/*
 homepages/forust_files/.well-known/*
 
 # Traefik files
 traefik/letsencrypt/acme.json
 traefik/dynamic/fileservers.yml
-traefik/dynamic/*.local.y*ml.*
-traefik/dynamic/*.external.y*ml
-traefik/k8s/fileservers.y*ml
-traefik/k8s/aliasHeadersStrategy.md
-
 traefik/logs/*
 
 # SSL Certificates
 adguardhome/certs/*
 traefik/certs/*
-certs/
 
 # Monitoring
 monitoring/prometheus.yml
@@ -86,8 +77,6 @@ replacements.txt
 
 # Git
 .gitattributes
-# Gitea/github Runners
-.runner
 
 # Misc
 .DS_Store
@@ -96,8 +85,6 @@ replacements.txt
 # Temp files
 edu_master/temp/
 temp/*
-# Local-only tooling scratch space (pinned CI tools, verification scripts)
-tmp/
 
 # Environment 
 .env
@@ -105,14 +92,3 @@ tmp/
 .env.forust
 .env.*
 !*example
-
-# kubernetes
-*/k8s/*secret*
-!*/k8s/*secret*.example
-**/k8s/*secret*
-!**/k8s/*secret*.example
-# Local-only tweaks, not for upstream
-prometheus-stack/k8s/grafana-values.yaml
-traefik/k8s/local-tls.yaml
-converters/k8s/config.yaml
-convertx/k8s/config.yaml

.hadolint.yaml

@@ -1,10 +0,0 @@
-ignored:
-  - DL3008
-  - DL3042
-  - DL3018
-  - DL3059
-trustedRegistries:
-  - docker.io
-  - ghcr.io
-  - quay.io
-  - gcr.forust.xyz

.markdownlint.json

@@ -1,8 +0,0 @@
-{
-  "default": true,
-  "MD013": false,
-  "MD024": false,
-  "MD033": false,
-  "MD041": false,
-  "MD046": false
-}

.prettierrc.yaml

@@ -1,7 +0,0 @@
-bracketSameLine: true
-htmlWhitespaceSensitivity: css
-printWidth: 120
-tabWidth: 2
-trailingComma: all
-proseWrap: preserve
-endOfLine: lf

.yamllint

@@ -1,22 +0,0 @@
-extends: default
-
-rules:
-  comments:
-    min-spaces-from-content: 1
-  comments-indentation: false
-  document-start: disable
-  line-length: disable
-  braces:
-    min-spaces-inside: 0
-    max-spaces-inside: 1
-  brackets:
-    min-spaces-inside: 0
-    max-spaces-inside: 1
-  indentation:
-    spaces: 2
-    indent-sequences: consistent
-  truthy:
-    allowed-values:
-      - "true"
-      - "false"
-      - "on"

.zed/settings.json

@@ -1,40 +0,0 @@
-{
-  "tab_size": 2,
-  "soft_wrap": "prefer_line",
-  "preferred_line_length": 120,
-  "format_on_save": "on",
-  "languages": {
-    "YAML": {
-      "tab_size": 2,
-      "hard_tabs": false,
-      "format_on_save": "on",
-      "formatter": {
-        "language_server": { "name": "yaml-language-server" },
-      },
-    },
-    "Python": {
-      "tab_size": 4,
-      "format_on_save": "on",
-      "language_servers": ["pyright", "ruff"],
-      "formatter": {
-        "language_server": { "name": "ruff" },
-      },
-    },
-  },
-  "lsp": {
-    "yaml-language-server": {
-      "settings": {
-        "yaml": {
-          "schemas": {
-            "kubernetes": ["**/k8s/*.yaml", "**/k8s/*.yml"],
-          },
-          "validate": true,
-          "completion": true,
-          "format": {
-            "enable": true,
-          },
-        },
-      },
-    },
-  },
-}

adguardhome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   adguard:
-    image: adguard/adguardhome:v0.107.79
+    image: adguard/adguardhome:latest
     container_name: adguardhome
     restart: unless-stopped
     ports:
@@ -11,29 +11,33 @@ services:
       # - "68:68/tcp" # DHCP
       # - "3000:3000/tcp"
     volumes:
-      - data:/opt/adguardhome/work
+      - ./data/work:/opt/adguardhome/work
-      - ./conf:/opt/adguardhome/conf
+      - ./data/conf:/opt/adguardhome/conf
       - ./certs:/certs:ro
     labels:
       - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
       - "traefik.http.services.adguard.loadbalancer.server.port=3000"
       
       # Prod Router
       - "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
       - "traefik.http.routers.adguard.entrypoints=websecure"
-      - "traefik.http.routers.adguard.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.adguard.middlewares=security-headers@file"
+      - "traefik.http.routers.adguard.tls=true"
       # Local Router
       - "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
       - "traefik.http.routers.adguard-local.entrypoints=websecure"
+      - "traefik.http.routers.adguard-local.middlewares=security-headers@file"
       - "traefik.http.routers.adguard-local.tls=true"
       # Dev Router
-      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)"
+      - "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) Host(`dns.gigaforust.internal`)"
       - "traefik.http.routers.adguard-dev.entrypoints=websecure"
+      - "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
       - "traefik.http.routers.adguard-dev.tls=true"
       # DoH Router
-      - "traefik.http.routers.dns-over-https.rule=(Host(`dns.forust.xyz` || Host(`adguard.forust.xyz`)) && PathPrefix(`/dns-query`))"
+      - "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
-      - "traefik.http.routers.dns-over-https.entrypoints=websecure"
+      - "traefik.http.routers.dns.entrypoints=websecure"
-      - "traefik.http.routers.dns-over-https.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.dns.tls.certresolver=letsencrypt"
       
       # Glance Metadata
       - glance.name=adguard
@@ -41,8 +45,6 @@ services:
       - glance.description=AdGuard Home is a network-wide software for blocking ads.
     networks:
       - proxy
-volumes:
-  data:
 networks:
   proxy:
     external: true

adguardhome/k8s/adguard.yaml

@@ -1,118 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: adguard-lb-service
-  namespace: adguard
-  annotations:
-    metallb.io/loadBalancerIPs: "192.168.80.3"
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app: adguard
-  ports:
-    - name: dns-udp
-      port: 53
-      targetPort: 53
-      protocol: UDP
-    - name: dns-tcp
-      port: 53
-      targetPort: 53
-      protocol: TCP
-    - name: dot
-      port: 853
-      targetPort: 853
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: adguard-service
-  namespace: adguard
-spec:
-  selector:
-    app: adguard
-  ports:
-    - port: 3000
-      name: webui
-      targetPort: 3000
-    - port: 53
-      name: dns
-      targetPort: 53
-      protocol: UDP
-    - port: 53
-      name: dns-tcp
-      targetPort: 53
-      protocol: TCP
-    - port: 853
-      name: dot
-      targetPort: 853
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: adguard-deployment
-  namespace: adguard
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: adguard
-  template:
-    metadata:
-      labels:
-        app: adguard
-      annotations:
-        reloader.stakater.com/auto: "true"
-    spec:
-      containers:
-        - name: adguard
-          image: adguard/adguardhome:v0.107.79
-          resources:
-            limits:
-              memory: "1.5Gi"
-              cpu: "300m"
-            requests:
-              memory: "1Gi"
-              cpu: "50m"
-          ports:
-            - containerPort: 3000
-              name: webui
-            - containerPort: 53
-              name: dns
-            - containerPort: 853
-              name: dot
-          volumeMounts:
-            - name: adguard-data
-              mountPath: /opt/adguardhome/work
-              subPath: work
-            - name: adguard-data
-              mountPath: /opt/adguardhome/conf
-              subPath: conf
-            - name: adguard-certs
-              mountPath: /certs
-              readOnly: true
-      volumes:
-        - name: adguard-data
-          persistentVolumeClaim:
-            claimName: adguard-pvc
-        - name: adguard-certs
-          secret:
-            secretName: adguard-certs
-            items:
-              - key: tls.crt
-                path: fullchain.pem
-              - key: tls.key
-                path: privkey.pem
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: adguard-pvc
-  namespace: adguard
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi

adguardhome/k8s/certificate.yaml

@@ -1,12 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: adguard-certs
-  namespace: adguard
-spec:
-  secretName: adguard-certs
-  dnsNames:
-    - dns.forust.xyz
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer

adguardhome/k8s/ingress.yaml

@@ -1,46 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: adguard-prod
-  namespace: adguard
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`dns.forust.xyz`)
-      kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-      services:
-        - name: adguard-service
-          port: 3000
-    - match: (Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
-      kind: Rule
-      services:
-        - name: adguard-service
-          port: 3000
-  tls:
-    secretName: adguard-certs
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: adguard-local
-  namespace: adguard
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: adguard-service
-          port: 3000
-    - match: (Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)) && PathPrefix(`/dns-query`)
-      kind: Rule
-      services:
-        - name: adguard-service
-          port: 3000
-  tls:
-    secretName: internal-wildcard-tls

adguardhome/k8s/internal-certificate.yaml

@@ -1,15 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: adguard
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

adguardhome/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: adguard

adguardhome/k8s/secrets.yaml.example

@@ -1,10 +0,0 @@
-kubectl apply -f k8s/namespace.yaml && \
-kubectl create secret tls adguard-certs -n adguard \
-  --cert=certs/fullchain.pem \
-  --key=certs/privkey.pem --dry-run=client -o yaml > \
-  k8s/secrets.yaml
-
-#  OR WITH NO FILE CREATION:
-kubectl create secret tls adguard-certs -n adguard \
-  --cert=certs/fullchain.pem --key=certs/privkey.pem \
-  --save-config

authentik/compose.yaml

@@ -1,6 +1,6 @@
 services:
   postgresql:
-    image: docker.io/library/postgres:15.19-alpine
+    image: docker.io/library/postgres:15-alpine
     restart: unless-stopped
     env_file:
       - .env
@@ -42,20 +42,26 @@ services:
       - ./custom-templates:/templates
     labels:
       - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
       - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
 
       # Prod Router
       - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
       - "traefik.http.routers.authentik-server.entrypoints=websecure"
-      - "traefik.http.routers.authentik-server.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.authentik-server.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server.service=authentik-server"
+      - "traefik.http.routers.authentik-server.tls=true"
       # Local Router
-      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`)"
+      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
       - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-local.service=authentik-server"
       - "traefik.http.routers.authentik-server-local.tls=true"
       # Dev Router
       - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
       - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
       - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-dev.service=authentik-server"
       - "traefik.http.routers.authentik-server-dev.tls=true"
     networks:
       - proxy

authentik/k8s/authentik.yaml

@@ -1,93 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-server-service
-  namespace: authentik
-spec:
-  type: ClusterIP
-  selector:
-    app: authentik-server
-  ports:
-    - port: 9000
-      targetPort: 9000
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-worker-service
-  namespace: authentik
-spec:
-  type: ClusterIP
-  selector:
-    app: authentik-worker
-  ports:
-    - port: 9000
-      targetPort: 9000
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-server-deployment
-  namespace: authentik
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: authentik-server
-  template:
-    metadata:
-      labels:
-        app: authentik-server
-    spec:
-      containers:
-        - name: authentik-server
-          image: ghcr.io/goauthentik/server:2026.8.3
-          args: ["server"]
-          envFrom:
-            - configMapRef:
-                name: authentik-config
-            - secretRef:
-                name: authentik-secrets
-          ports:
-            - containerPort: 9000
-          resources:
-            requests:
-              memory: "768Mi"
-              cpu: "300m"
-            limits:
-              memory: "1.5Gi"
-              cpu: "1000m"
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-worker-deployment
-  namespace: authentik
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: authentik-worker
-  template:
-    metadata:
-      labels:
-        app: authentik-worker
-    spec:
-      containers:
-        - name: authentik-worker
-          image: ghcr.io/goauthentik/server:2026.8.3
-          args: ["worker"]
-          securityContext:
-            runAsUser: 0
-          envFrom:
-            - configMapRef:
-                name: authentik-config
-            - secretRef:
-                name: authentik-secrets
-          resources:
-            requests:
-              memory: "320Mi"
-              cpu: "300m"
-            limits:
-              memory: "768Mi"
-              cpu: "700m"

authentik/k8s/certificates.yaml

@@ -1,28 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: authentik-prod-tls
-  namespace: authentik
-spec:
-  secretName: authentik-prod-tls
-  dnsNames:
-    - auth.forust.xyz
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: authentik
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

authentik/k8s/config.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-config
-  namespace: authentik
-data:
-  AUTHENTIK_IMAGE: ghcr.io/goauthentik/server
-  AUTHENTIK_TAG: "2025.10.2"
-  AUTHENTIK_POSTGRESQL__HOST: postgres.database.svc.cluster.local
-  AUTHENTIK_POSTGRESQL__NAME: authentik
-  AUTHENTIK_ERROR_REPORTING__ENABLED: "true"

authentik/k8s/ingress.yaml

@@ -1,36 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: authentik-prod
-  namespace: authentik
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`auth.forust.xyz`)
-      kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-      services:
-        - name: authentik-server-service
-          port: 9000
-  tls:
-    secretName: authentik-prod-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: authentik-local
-  namespace: authentik
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`auth.workstation.internal`) || Host(`auth.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: authentik-server-service
-          port: 9000
-  tls:
-    secretName: internal-wildcard-tls

authentik/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: authentik

authentik/k8s/secrets.yaml.example

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: authentik-secrets
-  namespace: authentik
-type: Opaque
-stringData:
-  AUTHENTIK_SECRET_KEY: ""
-  AUTHENTIK_POSTGRESQL__PASSWORD: ""
-  AUTHENTIK_POSTGRESQL__USER: authentik
-  AUTHENTIK_BOOTSTRAP_PASSWORD: authentik

cert-manager/k8s/cert-manager-values.yaml

@@ -1,9 +0,0 @@
-crds:
-  enabled: true
-prometheus:
-  servicemonitor:
-    enabled: true
-    interval: 60s
-    scrapeTimeout: 30s
-    labels:
-      release: prometheus-stack

cert-manager/k8s/clusterissuer.yaml

@@ -1,29 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-staging
-spec:
-  acme:
-    email: bobrovod@national.shitposting.agency
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: letsencrypt-staging-account-key
-    solvers:
-      - http01:
-          ingress:
-            class: traefik
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-prod
-spec:
-  acme:
-    email: bobrovod@national.shitposting.agency
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: letsencrypt-prod-account-key
-    solvers:
-      - http01:
-          ingress:
-            class: traefik

cert-manager/k8s/homelab-internal-root-ca.crt

@@ -1,30 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFFjCCAv6gAwIBAgIUetKpTfEDOn2985FFMu6G26itT+wwDQYJKoZIhvcNAQEN
-BQAwIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRlcm5hbCByb290IENBMB4XDTI2MDky
-MzEyNDA0N1oXDTM2MDkyMDEyNDA0N1owIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRl
-cm5hbCByb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvmNP
-ZCOoD8NtNuYJKVXBlTPjX7D7sJCSK5neH7ZbYV5+lmUlEErY8Mik7j37V5k5NfpF
-Ig85pOjP7RckTPz5V6ek3yaN40s4AL053sN5ZPauDVYjalaEHTgj5sEMqlLACQWI
-yZmJOZspZykae8dIpQnqCoFpRT4FurJ78v4a0ylnFVLMQn/lyCHedwTjkEdtYWYr
-ccJy8vQwqkzs/rWvEH1lDqZhennLOrmcCjfonG7D/pruMn4z+6E28p4+ejkRrI6x
-luak3KnpT1XMeHtgU21hiRGaMDBchHMFgAhnY1qosymKenXvfTZItwgjZbwa1hJI
-GAiDm+jQDKMjzRZ3rH6Xfc0auUcykNz73PpNu1NGm78nndXwCXcXn1LFKNQJ+r1U
-sJiyAmUZmXVn4aM4OMf2F38k7wTYIKg7nRGaUkNeKDlNkjA4HvgWw+jwO1KmdHQ/
-mOem1rosDWHRK01wg+Gga9mQCnhNhxglg3t/UeSic6uOaRsvaz4qkzHq8MbCujVz
-DpKQjqdikYOAXZOs4KlBLWrS7NaK4NzfSD02pBUErh54ruJfY/bWz9KyXzBD/lQZ
-VUTKyvUVB0bkVHEdf1jJmX3H4IZRQSF5JPqOBotW6bJI5fEGNBvj9Zxy4nm2WWGz
-yyP3uWsQz8U/Wdx9nXZLHInTZBsvgLYtKUAWA30CAwEAAaNCMEAwDgYDVR0PAQH/
-BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEkKm2rxPaK6+O9WD80z
-BLC6F9QsMA0GCSqGSIb3DQEBDQUAA4ICAQAnFyHz97Umf5VIu+dKTJid7C73VugJ
-TIar/xJBs/4CxP+znBxhJjXygRoyIfzoVGWcB2ZSL//vL78Qlts79K/Imc9a4RFF
-wMvCxsRXAEQ4TpeWi3ophPNcs4rhsP+gQKQFtnyKP9519bqpfxp0bTqwOV2o18fn
-za7rlQViiEnNV58j7CVoM9+mJvVVfBEX1Km+GyJL9GadzbIQ7FxClVJZefCbft93
-zHVk9gDOw8ys1XGSR2OUCyCLinXO6mqS16CmBb2MAKXq/YyH7E0N8iotAPGtfA8V
-M/0ddy947rY0xCrtECfWwvGQpJS7NRv/Z9b2jCfXrI5LXmL2nfQRg0y9GE4Vjwr+
-WxtGU5jOeFt0jQ+xRzcgG0Op+qK3x55l5LSo2hOcOVYbiHxcHEJFgwNi1ADeBFwb
-q/HdysfURSOghqjIpMMAUabBp+DBUg2EUF7pIaUqbdqExFYcr9EYisEMiNsmKmN+
-8ZbcOeerFKDQj+t/R0bFXa7UBn2UWsjI8zlR74aa2kLDXwtyz/XlO/FlYm66eBFo
-2/eYUSeU+S4ej+wUAs/dvjF7f190/DUQGuwOTlLTahqWDztmhCk7qzbECu56CwKT
-E5Ect2P72UleYwdblkVOVd352AmiwEzdOaziIRrPh8uenEknH6JBYPO3mjk7cCg+
-GPGcNIBctjdXhg==
------END CERTIFICATE-----

cert-manager/k8s/internal-ca.yaml

@@ -1,33 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: selfsigned
-spec:
-  selfSigned: {}
----
-# Homelab internal root CA (10y). Install the .crt on clients (see below).
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-ca-root
-  namespace: cert-manager
-spec:
-  isCA: true
-  commonName: homelab internal root CA
-  duration: 87600h
-  renewBefore: 7200h
-  secretName: internal-ca-root
-  privateKey:
-    algorithm: RSA
-    size: 4096
-  issuerRef:
-    name: selfsigned
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: internal-ca
-spec:
-  ca:
-    secretName: internal-ca-root

cert-manager/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager

cfddns/.env.example

@@ -1,15 +0,0 @@
-CLOUDFLARE_API_TOKEN=YOUR_CLOUDFLARE_API_TOKEN
-DOMAINS=example.com,dns.example.com,mc.example.com,auth.example.com,ssh.example.com
-IP4_DOMAINS=
-IP6_DOMAINS=
-IP4_PROVIDER=cloudflare.trace
-IP6_PROVIDER=none # change if you want to update AAAA
-UPDATE_CRON=@every 5m
-UPDATE_ON_START=true
-DELETE_ON_STOP=false
-DELETE_ON_FAILURE=true
-TTL=1
-PROXIED=!is(dns.example.com) && !is(mc.example.com) && !is(ssh.example.com)
-EMOJI=true
-UPTIMEKUMA=https://uptime-kuma.example.com/api/push/AsaSDFGFkfklaFALSKffkfFKfkfkfkFK?status=up&msg=OK&ping=
-REJECT_CLOUDFLARE_IPS=true

cfddns/compose.yaml

@@ -1,30 +1,13 @@
 services:
   cloudflare-ddns:
-    image: timothyjmiller/cloudflare-ddns:2.2.0
+    image: timothyjmiller/cloudflare-ddns:latest
     container_name: cloudflare-ddns
     restart: unless-stopped
     security_opt:
       - no-new-privileges:true
-    network_mode: "host"
+    network_mode: 'host'
-    # https://github.com/timothymiller/cloudflare-ddns#-quick-start
     environment:
-      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN:?Cloudflare API token is required}
+      - PUID=1000
-      - DOMAINS=${DOMAINS:-}
+      - PGID=1000
-      - IP4_DOMAINS=${IP4_DOMAINS:-}
+    volumes:
-      - IP6_DOMAINS=${IP6_DOMAINS:-}
+      - ./config.json:/config.json
-      - IP4_PROVIDER=${IP4_PROVIDER:-cloudflare.trace}
-      - IP6_PROVIDER=${IP6_PROVIDER:-none}
-      - UPDATE_CRON=${UPDATE_CRON:-@every 5m}
-      - UPDATE_ON_START=${UPDATE_ON_START:-true}
-      - DELETE_ON_STOP=${DELETE_ON_STOP:-false}
-      - DELETE_ON_FAILURE=${DELETE_ON_FAILURE:-true}
-      - TTL=${TTL:-1} # 1=auto
-      # to proxy only "dns.example.com" and "wfs.example.com" use "!is(dns.domain.com) && !is (wfs.domain.com)"
-      - PROXIED=${PROXIED:-true}
-      - EMOJI=${EMOJI:-true}
-      - UPTIMEKUMA=${UPTIMEKUMA:-}
-      - HEALTHCHECKS=${HEALTHCHECKS:-}
-      - REJECT_CLOUDFLARE_IPS=${REJECT_CLOUDFLARE_IPS:-true}
-      # volumes:
-      # Prefer using environment variables for configuration, config.json legacy support
-      # - ./config.json:/config.json

cfddns/config.json.example

@@ -7,7 +7,7 @@
       "api_key": {
         "api_key": "api_key_here",
         "account_email": "your_email_here"
-      },
+      }
       "zone_id": "your_zone-id",
       "subdomains": [
         { "name": "", "proxied": true },

cfddns/k8s/.gitignore

@@ -1 +0,0 @@
-secret.yaml

cfddns/k8s/deployment.yaml

@@ -1,32 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cfddns
-  labels:
-    app: cfddns
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: cfddns
-  template:
-    metadata:
-      labels:
-        app: cfddns
-    spec:
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      containers:
-        - name: cloudflare-ddns
-          image: timothyjmiller/cloudflare-ddns:2.2.0
-          imagePullPolicy: Always
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "30m"
-            limits:
-              memory: "128Mi"
-              cpu: "50m"
-          envFrom:
-            - secretRef:
-                name: cfddns-secrets

cfddns/k8s/secret.yaml.example

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cfddns-secrets
-type: Opaque
-stringData:
-  CLOUDFLARE_API_TOKEN: your_token
-  DOMAINS: "example.com,www.example.com"
-  IP4_PROVIDER: cloudflare.trace
-  IP6_PROVIDER: none
-  UPDATE_CRON: "@every 5m"
-  UPDATE_ON_START: "true"
-  DELETE_ON_STOP: "false"
-  DELETE_ON_FAILURE: "true"
-  TTL: "1"
-  PROXIED: "true"
-  EMOJI: "true"
-  REJECT_CLOUDFLARE_IPS: "true"

checkmk/compose.yaml

@@ -1,6 +1,6 @@
 services:
   checkmk:
-    image: "checkmk/check-mk-raw:2.4.0-2026.09.14"
+    image: "checkmk/check-mk-raw:2.4.0-latest"
     container_name: "checkmk"
     restart: unless-stopped
     # ports:
@@ -13,21 +13,24 @@ services:
     environment:
       - CMK_PASSWORD=${CMK_PASSWORD:-password}
       - CMK_SITE_ID=cmk
-      - TZ=${TZ:-Etc/UTC}
     labels:
       - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
       - "traefik.http.services.checkmk.loadbalancer.server.port=5000"
 
       # Prod Router
       - "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
       - "traefik.http.routers.checkmk.entrypoints=websecure"
-      - "traefik.http.routers.checkmk.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.checkmk.middlewares=security-headers@file"
+      - "traefik.http.routers.checkmk.tls=true"
       # Local Router
       - "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
       - "traefik.http.routers.checkmk-local.entrypoints=websecure"
+      - "traefik.http.routers.checkmk-local.middlewares=security-headers@file"
       - "traefik.http.routers.checkmk-local.tls=true"
       # Dev Router
       - "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
+      - "traefik.http.routers.checkmk-dev.middlewares=security-headers@file"
       - "traefik.http.routers.checkmk-dev.entrypoints=websecure"
       - "traefik.http.routers.checkmk-dev.tls=true"
     networks:

checkmk/k8s/certificates.yaml

@@ -1,28 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: checkmk-prod-tls
-  namespace: checkmk
-spec:
-  secretName: checkmk-prod-tls
-  dnsNames:
-    - cmk.forust.xyz
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: checkmk
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

checkmk/k8s/checkmk.yaml

@@ -1,75 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: checkmk-service
-  namespace: checkmk
-spec:
-  selector:
-    app: checkmk
-  ports:
-    - name: web
-      port: 5000
-      targetPort: 5000
-    - name: agent-receiver
-      port: 8000
-      targetPort: 8000
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: checkmk-deployment
-  namespace: checkmk
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: checkmk
-  template:
-    metadata:
-      labels:
-        app: checkmk
-    spec:
-      containers:
-        - name: checkmk
-          image: checkmk/check-mk-raw:2.4.0-2026.09.14
-          envFrom:
-            - secretRef:
-                name: checkmk-secrets
-            - configMapRef:
-                name: checkmk-config
-          ports:
-            - name: web
-              containerPort: 5000
-            - name: agent-receiver
-              containerPort: 8000
-          volumeMounts:
-            - name: sites
-              mountPath: /omd/sites
-            - name: tmp
-              mountPath: /opt/omd/sites/cmk/tmp
-          resources:
-            requests:
-              memory: "2Gi"
-              cpu: "600m"
-            limits:
-              memory: "5Gi"
-              cpu: "4"
-      volumes:
-        - name: sites
-          persistentVolumeClaim:
-            claimName: checkmk-sites-pvc
-        - name: tmp
-          emptyDir:
-            medium: Memory
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: checkmk-sites-pvc
-  namespace: checkmk
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi

checkmk/k8s/config.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: checkmk-config
-  namespace: checkmk
-data:
-  TZ: Europe/Bratislava
-  CMK_SITE_ID: cmk

checkmk/k8s/ingress.yaml

@@ -1,52 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: checkmk-prod
-  namespace: checkmk
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`cmk.forust.xyz`)
-      kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-      services:
-        - name: checkmk-service
-          port: 5000
-  tls:
-    secretName: checkmk-prod-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRouteTCP
-metadata:
-  name: checkmk-agent-receiver
-  namespace: checkmk
-spec:
-  entryPoints:
-    - checkmk-agent
-  routes:
-    - match: HostSNI(`*`)
-      services:
-        - name: checkmk-service
-          port: 8000
-  tls:
-    passthrough: true
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: checkmk-local
-  namespace: checkmk
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`cmk.workstation.internal`) || Host(`cmk.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: checkmk-service
-          port: 5000
-  tls:
-    secretName: internal-wildcard-tls

checkmk/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: checkmk

checkmk/k8s/secrets.yaml.example

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: checkmk-secrets
-  namespace: checkmk
-type: Opaque
-stringData:
-  CMK_PASSWORD: "password"

cloudflared/k8s/.gitignore

@@ -1 +0,0 @@
-secret.yaml

cloudflared/k8s/deployment.yaml

@@ -1,37 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: cloudflared
-  labels:
-    app: cloudflared
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: cloudflared
-  template:
-    metadata:
-      labels:
-        app: cloudflared
-    spec:
-      containers:
-        - name: cloudflared
-          image: cloudflare/cloudflared:2026.9.3
-          imagePullPolicy: IfNotPresent
-          args:
-            - tunnel
-            - --no-autoupdate
-            - run
-          env:
-            - name: TUNNEL_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: cloudflared-secrets
-                  key: TUNNEL_TOKEN
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "30m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"

cloudflared/k8s/secret.yaml.example

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflared-secrets
-type: Opaque
-stringData:
-  TUNNEL_TOKEN: your_tunnel_token_here

converters/.env.example

@@ -1,9 +0,0 @@
-ACCOUNT_REGISTRATION=false
-HTTP_ALLOWED=false
-ALLOW_UNAUTHENTICAED=false
-AUTO_DELETE_EVERY_N_HOURS=24
-WEBROOT=/convert
-HIDE_HISTORY=false
-LANGUAGE=en
-UNAUTHED_USER_SHARING=false
-MAX_CONVERT_PROCESS=0

converters/compose.yaml

@@ -1,70 +0,0 @@
-services:
-  convertx:
-    container_name: convertx
-    image: ghcr.io/c4illin/convertx:v0.18.0
-    restart: unless-stopped
-    ports:
-      - "9992:3000"
-    # https://github.com/C4illin/ConvertX#environment-variables
-    environment:
-      - JWT_SECRET=$(JWT_SECRET)
-      - ACCOUNT_REGISTRATION=$(ACCOUNT_REGISTRATION:-false)
-      - HTTP_ALLOWED=$(HTTP_ALLOWED:-false)
-      - ALLOW_UNAUTHENTICATED=$(ALLOW_UNAUTHENTICATED:-false)
-      - AUTO_DELETE_EVERY_N_HOURS=$(AUTO_DELETE_EVERY_N_HOURS:-24)
-      - WEBROOT=$(WEBROOT)
-      - HIDE_HISTORY=$(HIDE_HISTORY:-false)
-      - LANGUAGE=$(LANGUAGE:-en)
-      - UNAUTHENTICATED_USER_SHARING=$(UNAUTHENTICATED_USER_SHARING:-false)
-      - MAX_CONVERT_PROCESS=$(MAX_CONVERT_PROCESS:-0)
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.convertx.loadbalancer.server.port=3000"
-      # Prod Router
-      - "traefik.http.routers.convertx.rule=(Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)"
-      - "traefik.http.routers.convertx.entrypoints=websecure"
-      - "traefik.http.routers.convertx.priority=50"
-      - "traefik.http.routers.convertx.tls.certresolver=letsencrypt"
-      # Local Router
-      - "traefik.http.routers.convertx-local.rule=Host(`workstation.internal`) && PathPrefix(`/convert`)"
-      - "traefik.http.routers.convertx-local.entrypoints=websecure"
-      - "traefik.http.routers.convertx-local.priority=50"
-      - "traefik.http.routers.convertx-local.tls=true"
-      # Dev Router
-      - "traefik.http.routers.convertx-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`/convert`)"
-      - "traefik.http.routers.convertx-dev.entrypoints=websecure"
-      - "traefik.http.routers.convertx-dev.priority=50"
-      - "traefik.http.routers.convertx-dev.tls=true"
-    networks:
-      - proxy
-    volumes:
-      - data:/app/data
-
-  bentopdf:
-    container_name: bentopdf
-    image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.bentopdf.loadbalancer.server.port=8080"
-
-      # Prod router
-      - "traefik.http.routers.bentopdf.rule=Host(`pdf.forust.xyz`)"
-      - "traefik.http.routers.bentopdf.entrypoints=websecure"
-      - "traefik.http.routers.bentopdf.tls.certresolver=letsencrypt"
-      - "traefik.http.routers.bentopdf.tls=true"
-      # Local router
-      - "traefik.http.routers.bentopdf-local.rule=Host(`pdf.workstation.internal`)"
-      - "traefik.http.routers.bentopdf-local.entrypoints=websecure"
-      - "traefik.http.routers.bentopdf-local.tls=true"
-      # Dev router
-      - "traefik.http.routers.bentopdf-dev.rule=Host(`pdf.gigaforust.internal`)"
-      - "traefik.http.routers.bentopdf-dev.entrypoints=websecure"
-      - "traefik.http.routers.bentopdf-dev.tls=true"
-    networks:
-      - proxy
-networks:
-  proxy:
-    external: true
-volumes:
-  data:

converters/k8s/bentopdf.yaml

@@ -1,43 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: bentopdf-service
-  namespace: converters
-spec:
-  selector:
-    app: bentopdf
-  ports:
-    - port: 8080
-      targetPort: 8080
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bentopdf-deployment
-  namespace: converters
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      app: bentopdf
-  template:
-    metadata:
-      labels:
-        app: bentopdf
-    spec:
-      containers:
-        - image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
-          imagePullPolicy: Always
-          name: bentopdf
-          ports:
-            - containerPort: 8080
-          # p95 4M, max 11M over 7 days. Was 50Mi/700Mi.
-          resources:
-            requests:
-              memory: "32Mi"
-              cpu: "50m"
-              ephemeral-storage: "100Mi"
-            limits:
-              memory: "128Mi"
-              cpu: "700m"
-              ephemeral-storage: "5Gi"

converters/k8s/certificates.yaml

@@ -1,42 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: convertx-prod-tls
-  namespace: converters
-spec:
-  secretName: convertx-prod-tls
-  dnsNames:
-    - forust.xyz
-    - www.forust.xyz
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: bentopdf-prod-tls
-  namespace: converters
-spec:
-  secretName: bentopdf-prod-tls
-  dnsNames:
-    - pdf.forust.xyz
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: converters
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

converters/k8s/config.yaml.example

@@ -1,16 +0,0 @@
-# test manifest with docker and k8s config keys mismatch
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: convertx-config
-  namespace: converters
-data:
-  ACCOUNT_REGISTRATION: "false"
-  HTTP_ALLOWED: "false"
-  ALLOW_UNAUTHENTICAED: "false"
-  AUTO_DELETE_EVERY_N_HOURS: "24"
-  WEBROOT: "/convert"
-  HIDE_HISTORY: "false"
-  LANGUAGE: "en"
-  UNAUTHED_USER_SHARING: "false"
-  MAX_CONVERT_PROCESS: "0"

converters/k8s/convertx.yaml

@@ -1,64 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: convertx-service
-  namespace: converters
-spec:
-  selector:
-    app: convertx
-  ports:
-    - port: 3000
-      targetPort: 3000
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: convertx-deployment
-  namespace: converters
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: convertx
-  template:
-    metadata:
-      labels:
-        app: convertx
-    spec:
-      containers:
-        - image: ghcr.io/c4illin/convertx:v0.18.0
-          name: convertx
-          envFrom:
-            - configMapRef:
-                name: convertx-config
-            - secretRef:
-                name: convertx-secrets
-          ports:
-            - containerPort: 3000
-          volumeMounts:
-            - mountPath: /data
-              name: data
-          # p95 85M, max 136M over 7 days, spikes while converting. Was 250Mi/1.5Gi.
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              cpu: "1500m"
-              memory: "512Mi"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: convertx-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: convertx-pvc
-  namespace: converters
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi

converters/k8s/ingress.yaml

@@ -1,70 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: convertx-prod
-  namespace: converters
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: (Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)
-      kind: Rule
-      priority: 50
-      services:
-        - name: convertx-service
-          port: 3000
-  tls:
-    secretName: convertx-prod-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: convertx-local
-  namespace: converters
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: (Host(`workstation.internal`) || Host(`gigaforust.internal`)) && PathPrefix(`/convert`)
-      kind: Rule
-      priority: 50
-      services:
-        - name: convertx-service
-          port: 3000
-  tls:
-    secretName: internal-wildcard-tls
-
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: bentopdf-prod
-  namespace: converters
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`pdf.forust.xyz`)
-      kind: Rule
-      services:
-        - name: bentopdf-service
-          port: 8080
-  tls:
-    secretName: bentopdf-prod-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: bentopdf-local
-  namespace: converters
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`pdf.workstation.internal`) || Host(`pdf.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: bentopdf-service
-          port: 8080
-  tls:
-    secretName: internal-wildcard-tls

converters/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: converters

converters/k8s/secrets.yaml.example

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: convertx-secrets
-  namespace: converters
-type: Opaque
-stringData:
-  jwt-secret: ""

crowdsec/k8s/crowdsec-middleware.yaml

@@ -1,69 +0,0 @@
-# crowdsec/k8s is NOT managed by deploy.yaml - apply this by hand, and apply it
-# together with a restart:
-#   kubectl apply -f crowdsec/k8s/crowdsec-middleware.yaml
-#   kubectl -n traefik rollout restart deploy/traefik
-#
-# The restart is not optional. In stream mode the plugin runs a package-level
-# ticker goroutine (handleStreamTicker over the isCrowdsecStreamHealthy and
-# updateFailure globals) that no reconfiguration stops. Applying a change
-# wedges the instance: every route referencing it answers 404 and traefik logs
-# 'invalid middleware crowdsec-crowdsec-bouncer@kubernetescrd' until the pod is
-# replaced. Re-applying the previous config does NOT recover it, and the config
-# is not the cause - a valid CIDR cannot fail NewChecker, which is a plain
-# net.ParseCIDR. Only a new pod clears it. Measured cost: ~35s down for all
-# 20 hosts behind this middleware.
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: crowdsec-bouncer
-  namespace: crowdsec
-spec:
-  plugin:
-    crowdsec-bouncer:
-      enabled: true
-      LogLevel: INFO
-      # `live` blocked on a `GET /v1/decisions` per request, so a burst
-      # saturated the LAPI and the plugin 403'd IPs that were never banned.
-      # v1.3.3 ignores UpdateMaxFailure in `live`, so fail-open is only
-      # reachable in stream mode, which polls into a cache instead - no
-      # per-request call to saturate. 15s rather than the 60s default: the
-      # deploy runner shares one public IP with the house, so this bounds
-      # both how late a ban lands and how long a lifted one lingers.
-      CrowdsecMode: stream
-      UpdateIntervalSeconds: 15
-      # -1 = never block because the LAPI is unreachable. In v1.3.3
-      # handleStreamTicker only clears isCrowdsecStreamHealthy when
-      # updateMaxFailure != -1, and ServeHTTP 403s once it is false, so this
-      # makes a CrowdSec outage mean "no protection", not "every site 403".
-      UpdateMaxFailure: -1
-      CrowdsecLapiScheme: http
-      CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
-      CrowdsecLapiKeyFile: "/etc/traefik/secrets/traefik-api-key"
-      # Bypasses the bouncer and the decision cache, no LAPI round-trip.
-      # Keep in sync with forust/local-network in crowdsec-values.yaml.
-      ClientTrustedIPs:
-        - "127.0.0.0/8"
-        - "10.0.0.0/8"
-        - "172.16.0.0/12"
-        - "192.168.0.0/16"
-        - "100.64.0.0/10"
-        - "169.254.0.0/16"
-        - "fc00::/7"
-        - "fe80::/10"
-        # The mobile operator range from forust/mobile-whitelist, repeated
-        # deliberately rather than relying on the parser whitelist alone.
-        # That whitelist drops the event before it reaches a bucket, so no
-        # decision is ever created - but it is one config away from not
-        # firing, and the bouncer would then enforce a ban that was never
-        # justified. This is the last line: even a decision that exists for
-        # any reason is not served against the phone.
-        - "84.245.64.0/18"
-      # The name is HTTPTimeoutSeconds, an int in seconds (min 1) - there is
-      # no CrowdsecLapiTimeout, and an unrecognised key is silently dropped,
-      # which is how this sat at the 10s default. Nothing rides on it per
-      # request any more, so this only bounds the stream pull - and too low
-      # is the dangerous direction: the LAPI needs ~2s to answer
-      # /v1/decisions/stream, and a pull that times out leaves the ban cache
-      # frozen at its startup contents ("failed sending new decisions"),
-      # i.e. new bans silently never apply. Keep it above the pull latency.
-      HTTPTimeoutSeconds: 10

crowdsec/k8s/crowdsec-values.yaml

@@ -1,190 +0,0 @@
-container_runtime: containerd
-
-agent:
-  acquisition: []
-  additionalAcquisition:
-    - labels:
-        type: traefik
-      limit: 1000
-      query: |
-        {namespace="traefik"}
-      source: loki
-      url: http://loki.prometheus.svc.cluster.local:3100/
-      wait_for_ready: 30s
-  env:
-    - name: COLLECTIONS
-      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
-    - name: DISABLE_COLLECTIONS
-      value: crowdsecurity/sshd
-  metrics:
-    enabled: true
-    serviceMonitor:
-      additionalLabels:
-        release: prometheus-stack
-      enabled: true
-  # Static machine identity: agent pods mount pre-created LAPI credentials
-  # (Secret crowdsec-agent-credentials, key local_api_credentials.yaml)
-  # at the exact path the agent entrypoint expects. Together with the
-  # patched register-init (enforced by janitor-cronjob.yaml) the agent
-  # never calls `cscli lapi register` in steady state, so pod names,
-  # restarts and reboots can no longer break it.
-  extraVolumes:
-    - name: static-creds
-      secret:
-        secretName: crowdsec-agent-credentials
-        items:
-          - key: local_api_credentials.yaml
-            path: local_api_credentials.yaml
-  extraVolumeMounts:
-    - name: static-creds
-      mountPath: /tmp_config/local_api_credentials.yaml
-      subPath: local_api_credentials.yaml
-      readOnly: true
-  resources:
-    limits:
-      cpu: 200m
-      memory: 500Mi
-    requests:
-      cpu: 50m
-      memory: 100Mi
-
-config:
-  parsers:
-    s02-enrich:
-      mobile-whitelist.yaml: |
-        name: forust/mobile-whitelist
-        description: "Whitelist SWAN/4ka mobile network"
-        whitelist:
-          reason: "Mobile IP whitelist"
-          cidr:
-            - "84.245.64.0/18"
-      # CrowdSec's own guidance: CIDR allowlisting belongs at the parser stage.
-      # A parser whitelist discards the event before it reaches a bucket, so
-      # these addresses never produce an overflow and never become a decision.
-      # A postoverflow whitelist is checked only *after* the ban exists, and
-      # the bouncer answers 403 for as long as it does - which is a window we
-      # do not want the deploy sitting in.
-      local-network.yaml: |
-        name: forust/local-network
-        description: "Whitelist loopback, private and VPN networks"
-        whitelist:
-          reason: "Local network"
-          cidr:
-            - "127.0.0.0/8"
-            - "10.0.0.0/8"
-            - "172.16.0.0/12"
-            - "192.168.0.0/16"
-            # CGNAT range (RFC 6598). The workstation and the k0s node live
-            # here on WireGuard, and 100.64.0.0/10 is not covered by the
-            # RFC 1918 blocks above.
-            - "100.64.0.0/10"
-            - "169.254.0.0/16"
-            - "fc00::/7"
-            - "fe80::/10"
-
-  postoverflows:
-    s01-whitelist:
-      # The one whitelist that has to stay here: resolving a hostname is a
-      # network call, and the docs put expensive lookups in postoverflows on
-      # purpose - it runs only when a bucket actually overflows.
-      # ddns.forust.xyz is the public home address, not a private one, so
-      # forust/local-network does not cover it.
-      home-dynamic-ip.yaml: |
-        name: forust/home-dynamic-ip
-        description: "Whitelist home dynamic IP"
-        whitelist:
-          reason: "Home dynamic IP"
-          expression:
-            - evt.Overflow.Alert.Source.IP in LookupHost("ddns.forust.xyz")
-
-  # LAPI-only main config override, merged over config.yaml. NOTE: the
-  # chart's own default for this key is REPLACED, not merged, so its
-  # auto_registration block is repeated verbatim below - drop it and the
-  # agent can no longer register itself.
-  config.yaml.local: |
-    api:
-      server:
-        auto_registration: # Activate if not using TLS for authentication
-          enabled: true
-          token: "${REGISTRATION_TOKEN}" # /!\ Do not modify this variable (auto-generated and handled by the chart)
-          allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
-            - "127.0.0.1/32"
-            - "192.168.0.0/16"
-            - "10.0.0.0/8"
-            - "172.16.0.0/12"
-        # This homelab has no egress to console.crowdsec.cloud: DNS does
-        # not resolve. The LAPI kept trying anyway ("Signal push: N
-        # signals to push", "capi metrics: sending" every 10s) and each
-        # attempt sat on a resolver timeout WHILE HOLDING A WRITE
-        # TRANSACTION, which is what kept stalling per-request decision
-        # lookups even with WAL enabled. Nothing to share and nothing to
-        # pull - turn the Central API off instead of letting it block the
-        # only database writer we have.
-        online_client:
-          sharing: false
-          pull:
-            community: false
-            blocklists: false
-        disable_usage_metrics_export: true
-    db_config:
-      # SQLite without WAL serialises every reader behind the writer's
-      # rollback journal, and the LAPI writes constantly: the agent pushes
-      # Traefik alerts read from Loki, the metrics collector counts
-      # decisions, the bouncer touches "last pull" on every request.
-      # Symptom: decision lookups taking 10-30s (and a second connection
-      # that could not even open the database) while the LAPI sat at 28m
-      # CPU - the process was blocked in fsync, not computing. Every
-      # bouncer-protected request then blew through the plugin timeout and
-      # fail-closed with 403, on every site at once.
-      # The PVC is local-path-retain (hostPath), not a network share, so
-      # WAL is safe here; the crowdsec docs recommend it for exactly this
-      # ("allowing more concurrency in SQLite that will improve
-      # performances in most scenarios").
-      use_wal: true
-      # Keeps the alert table bounded. At the 5000/7d default the file
-      # reached 54MB in 15 days off the Traefik access log alone, and the
-      # metrics collector counts decisions on a timer; a smaller working
-      # set means fewer full scans. Crowdsec only prunes - SQLite never
-      # shrinks the file, so the size stays until a manual VACUUM.
-      flush:
-        max_items: 1000
-        max_age: 24h
-
-lapi:
-  env:
-    - name: COLLECTIONS
-      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
-    - name: DISABLE_COLLECTIONS
-      value: crowdsecurity/linux crowdsecurity/sshd
-  metrics:
-    enabled: true
-    serviceMonitor:
-      additionalLabels:
-        release: prometheus-stack
-      enabled: true
-  persistentVolume:
-    config:
-      enabled: true
-      size: 100Mi
-      storageClassName: local-path-retain
-    data:
-      enabled: true
-      size: 1Gi
-      storageClassName: local-path-retain
-  # LAPI answers a blocking /v1/decisions lookup for EVERY bouncer-protected
-  # request (whole Traefik front door), so it is the hot path of the proxy.
-  # At 400m/500Mi it went CPU-throttled and idle lookups measured 1.3-7.4s,
-  # which pushed requests into the bouncer's fail-closed 403.
-  # Single replica on purpose: LAPI is stateful (BoltDB on the `data` PVC,
-  # credentials on the `config` PVC) - two replicas sharing those RWO
-  # volumes would corrupt the decision store. Scale up CPU, not replicas.
-  resources:
-    limits:
-      cpu: 1500m
-      memory: 1Gi
-    requests:
-      cpu: 250m
-      memory: 500Mi
-  service:
-    type: ClusterIP
-  storeLAPICscliCredentialsInSecret: true

crowdsec/k8s/grafana-dashboards.yaml

@@ -1,32 +0,0 @@
-apiVersion: v1
-data:
-  crowdsec-overview.json: "{\n  \"__inputs\": [\n    {\n      \"name\": \"DS_PROMETHEUS\",\n      \"label\": \"Prometheus\",\n      \"description\": \"\",\n      \"type\": \"datasource\",\n      \"pluginId\": \"prometheus\",\n      \"pluginName\": \"Prometheus\"\n    }\n  ],\n  \"__requires\": [\n    {\n      \"type\": \"grafana\",\n      \"id\": \"grafana\",\n      \"name\": \"Grafana\",\n      \"version\": \"8.1.2\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"graph\",\n      \"name\": \"Graph (old)\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"datasource\",\n      \"id\": \"prometheus\",\n      \"name\": \"Prometheus\",\n      \"version\": \"1.0.0\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"stat\",\n      \"name\": \"Stat\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"timeseries\",\n      \"name\": \"Time series\",\n      \"version\": \"\"\n    }\n  ],\n  \"annotations\": {\n    \"list\": [\n      {\n        \"builtIn\": 1,\n        \"datasource\": \"-- Grafana --\",\n        \"enable\": true,\n        \"hide\": true,\n        \"iconColor\": \"rgba(0, 211, 255, 1)\",\n        \"name\": \"Annotations & Alerts\",\n        \"target\": {\n          \"limit\": 100,\n          \"matchAny\": false,\n          \"tags\": [],\n          \"type\": \"dashboard\"\n        },\n        \"type\": \"dashboard\"\n      }\n    ]\n  },\n  \"editable\": true,\n  \"gnetId\": null,\n  \"graphTooltip\": 0,\n  \"id\": null,\n  \"links\": [],\n  \"panels\": [\n    {\n      \"collapsed\": false,\n      \"datasource\": null,\n      \"gridPos\": {\n        \"h\": 1,\n        \"w\": 24,\n        \"x\": 0,\n        \"y\": 0\n      },\n      \"id\": 24,\n      \"panels\": [],\n      \"title\": \"Summary\",\n      \"type\": \"row\"\n    },\n    {\n      \"cacheTimeout\": null,\n      \"datasource\": \"${DS_PROMETHEUS}\",\n      \"fieldConfig\": {\n        \"defaults\": {\n          \"color\": {\n            \"mode\": \"thresholds\"\n          },\n          \"mappings\": [\n            {\n              \"options\": {\n                \"match\": \"null\",\n                \"result\": {\n                  \"text\": \"N/A\"\n                }\n              },\n              \"type\": \"special\"\n            }\n          ],\n          \"thresholds\": {\n            \"mode\": \"absolute\",\n            \"steps\": [\n              {\n                \"color\": \"#E02F44\",\n                \"value\": null\n              },\n              {\n                \"color\": \"#E02F44\",\n                \"value\": 10\n              },\n              {\n                \"color\": \"#299c46\",\n                \"value\": 10\n              }\n            ]\n          },\n          \"unit\": \"none\"\n        },\n        \"overrides\": []\n      },\n      \"gridPos\": {\n        \"h\": 8,\n        \"w\": 6,\n        \"x\": 0,\n        \"y\": 1\n      },\n      \"id\": 2,\n      \"interval\": null,\n      \"links\": [],\n      \"maxDataPoints\": 100,\n      \"options\": {\n        \"colorMode\": \"background\",\n        \"graphMode\": \"none\",\n        \"justifyMode\": \"auto\",\n        \"orientation\": \"horizontal\",\n        \"reduceOptions\": {\n          \"calcs\": [\n            \"lastNotNull\"\n          ],\n          \"fields\": \"\",\n          \"values\": false\n        },\n        \"text\": {},\n        \"textMode\": \"auto\"\n      },\n      \"pluginVersion\": \"8.1.2\",\n      \"targets\": [\n        {\n          \"exemplar\": true,\n          \"expr\": \"count(cs_info)\",\n          \"interval\": \"\",\n          \"legendFormat\": \"\",\n          \"refId\": \"A\"\n        }\n      ],\n      \"timeFrom\": null,\n      \"timeShift\": null,\n      \"title\": \"Running Crowdsec\",\n      \"transparent\": true,\n      \"type\": \"stat\"\n    },\n    {\n      \"aliasColors\": {},\n      \"bars\": false,\n      \"dashLength\": 10,\n      \"dashes\": false,\n      \"datasource\": \"${DS_PROMETHEUS}\",\n      \"decimals\": 1,\n      \"fieldConfig\": {\n        \"defaults\": {\n          \"links\": []\n        },\n        \"overrides\": []\n      },\n      \"fill\": 1,\n      \"fillGradient\": 0,\n      \"gridPos\": {\n        \"h\": 8,\n        \"w\": 18,\n        \"x\": 6,\n        \"y\": 1\n      },\n      \"hiddenSeries\": false,\n      \"id\": 8,\n      \"legend\": {\n        \"alignAsTable\": true,\n        \"avg\": false,\n        \"current\": false,\n        \"max\": false,\n        \"min\": false,\n        \"rightSide\": true,\n        \"show\": true,\n        \"sort\": \"total\",\n        \"sortDesc\": true,\n        \"total\": true,\n        \"values\": true\n      },\n      \"lines\": true,\n      \"linewidth\": 1,\n      \"nullPointMode\": \"null\",\n      \"options\": {\n        \"alertThreshold\": true\n      },\n      \"percentage\": false,\n      \"pluginVersion\": \"8.1.2\",\n      \"pointradius\": 2,\n      \"points\": false,\n      \"renLine truncated
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: manual
-    grafana_dashboard: "1"
-  name: crowdsec-crowdsec-overview
-  namespace: prometheus
----
-apiVersion: v1
-data:
-  crowdsec-lapi-metrics.json: "{\n  \"__inputs\": [\n    {\n      \"name\": \"DS_PROMETHEUS\",\n      \"label\": \"Prometheus\",\n      \"description\": \"\",\n      \"type\": \"datasource\",\n      \"pluginId\": \"prometheus\",\n      \"pluginName\": \"Prometheus\"\n    }\n  ],\n  \"__requires\": [\n    {\n      \"type\": \"panel\",\n      \"id\": \"bargauge\",\n      \"name\": \"Bar gauge\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"grafana\",\n      \"id\": \"grafana\",\n      \"name\": \"Grafana\",\n      \"version\": \"8.1.2\"\n    },\n    {\n      \"type\": \"datasource\",\n      \"id\": \"prometheus\",\n      \"name\": \"Prometheus\",\n      \"version\": \"1.0.0\"\n    }\n  ],\n  \"annotations\": {\n    \"list\": [\n      {\n        \"builtIn\": 1,\n        \"datasource\": \"-- Grafana --\",\n        \"enable\": true,\n        \"hide\": true,\n        \"iconColor\": \"rgba(0, 211, 255, 1)\",\n        \"name\": \"Annotations & Alerts\",\n        \"target\": {\n          \"limit\": 100,\n          \"matchAny\": false,\n          \"tags\": [],\n          \"type\": \"dashboard\"\n        },\n        \"type\": \"dashboard\"\n      }\n    ]\n  },\n  \"editable\": true,\n  \"gnetId\": null,\n  \"graphTooltip\": 0,\n  \"id\": null,\n  \"iteration\": 1655915193937,\n  \"links\": [],\n  \"panels\": [\n    {\n      \"collapsed\": false,\n      \"datasource\": null,\n      \"gridPos\": {\n        \"h\": 1,\n        \"w\": 24,\n        \"x\": 0,\n        \"y\": 0\n      },\n      \"id\": 10,\n      \"panels\": [],\n      \"title\": \"Agents\",\n      \"type\": \"row\"\n    },\n    {\n      \"datasource\": \"${DS_PROMETHEUS}\",\n      \"fieldConfig\": {\n        \"defaults\": {\n          \"color\": {\n            \"mode\": \"thresholds\"\n          },\n          \"mappings\": [],\n          \"thresholds\": {\n            \"mode\": \"absolute\",\n            \"steps\": [\n              {\n                \"color\": \"green\",\n                \"value\": null\n              },\n              {\n                \"color\": \"red\",\n                \"value\": 80\n              }\n            ]\n          }\n        },\n        \"overrides\": []\n      },\n      \"gridPos\": {\n        \"h\": 8,\n        \"w\": 12,\n        \"x\": 0,\n        \"y\": 1\n      },\n      \"id\": 2,\n      \"options\": {\n        \"displayMode\": \"gradient\",\n        \"orientation\": \"vertical\",\n        \"reduceOptions\": {\n          \"calcs\": [\n            \"lastNotNull\"\n          ],\n          \"fields\": \"\",\n          \"values\": false\n        },\n        \"showUnfilled\": false,\n        \"text\": {}\n      },\n      \"pluginVersion\": \"8.1.2\",\n      \"repeat\": \"query0\",\n      \"repeatDirection\": \"h\",\n      \"targets\": [\n        {\n          \"exemplar\": false,\n          \"expr\": \"sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\\\"/v1/watchers/login\\\", instance=\\\"$lapi\\\"}[$__rate_interval])) by (le)\",\n          \"format\": \"heatmap\",\n          \"interval\": \"\",\n          \"legendFormat\": \"{{le}}\",\n          \"refId\": \"A\"\n        }\n      ],\n      \"title\": \"Agents Login\",\n      \"type\": \"heatmap\"\n    },\n    {\n      \"datasource\": \"${DS_PROMETHEUS}\",\n      \"fieldConfig\": {\n        \"defaults\": {\n          \"color\": {\n            \"mode\": \"thresholds\"\n          },\n          \"mappings\": [],\n          \"thresholds\": {\n            \"mode\": \"absolute\",\n            \"steps\": [\n              {\n                \"color\": \"green\",\n                \"value\": null\n              }\n            ]\n          },\n          \"unit\": \"none\"\n        },\n        \"overrides\": []\n      },\n      \"gridPos\": {\n        \"h\": 8,\n        \"w\": 12,\n        \"x\": 12,\n        \"y\": 1\n      },\n      \"id\": 6,\n      \"options\": {\n        \"displayMode\": \"gradient\",\n        \"orientation\": \"auto\",\n        \"reduceOptions\": {\n          \"calcs\": [\n            \"lastNotNull\"\n          ],\n          \"fields\": \"\",\n          \"values\": false\n        },\n        \"showUnfilled\": false,\n        \"text\": {}\n      },\n      \"pluginVersion\": \"8.1.2\",\n      \"targets\": [\n        {\n          \"exemplar\": true,\n          \"expr\": \"sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\\\"/v1/watchers/login\\\"}[$__rate_interval])) by (le)\",\n          \"format\": \"heatmap\",\n          \"interval\": \"\",\n          \"legendFormat\": \"{{le}}\",\n          \"refId\": \"A\"\n        }\n      ],\n      \"title\": \"Heartbeat\",\n      \"type\": \"heatmap\"\n    },\n    {\n      \"collapsed\": false,\n      \"datasource\": null,\n      \"gridPos\": {\n        \"h\": 1,\n        \"w\": 24,\n        \"x\": 0,\n        \"y\": 9\n      },\n      \"id\": 12,\n      \"panels\": [],\n      \"title\": \"Decisions\",\n      \"type\": \"row\"\n    },\n    {\n      \"datasource\": \"${DS_PROMETHEUS}\",\n  Line truncated
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: manual
-    grafana_dashboard: "1"
-  name: crowdsec-crowdsec-lapi-metrics
-  namespace: prometheus
----
-apiVersion: v1
-data:
-  crowdsec-insight.json: "{\n  \"__inputs\": [\n    {\n      \"name\": \"DS_PROMETHEUS\",\n      \"label\": \"Prometheus\",\n      \"description\": \"\",\n      \"type\": \"datasource\",\n      \"pluginId\": \"prometheus\",\n      \"pluginName\": \"Prometheus\"\n    }\n  ],\n  \"__requires\": [\n    {\n      \"type\": \"panel\",\n      \"id\": \"bargauge\",\n      \"name\": \"Bar gauge\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"gauge\",\n      \"name\": \"Gauge\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"grafana\",\n      \"id\": \"grafana\",\n      \"name\": \"Grafana\",\n      \"version\": \"8.1.2\"\n    },\n    {\n      \"type\": \"datasource\",\n      \"id\": \"prometheus\",\n      \"name\": \"Prometheus\",\n      \"version\": \"1.0.0\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"stat\",\n      \"name\": \"Stat\",\n      \"version\": \"\"\n    }\n  ],\n  \"annotations\": {\n    \"list\": [\n      {\n        \"builtIn\": 1,\n        \"datasource\": \"-- Grafana --\",\n        \"enable\": true,\n        \"hide\": true,\n        \"iconColor\": \"rgba(0, 211, 255, 1)\",\n        \"name\": \"Annotations & Alerts\",\n        \"target\": {\n          \"limit\": 100,\n          \"matchAny\": false,\n          \"tags\": [],\n          \"type\": \"dashboard\"\n        },\n        \"type\": \"dashboard\"\n      }\n    ]\n  },\n  \"editable\": true,\n  \"gnetId\": null,\n  \"graphTooltip\": 0,\n  \"id\": null,\n  \"iteration\": 1655915159751,\n  \"links\": [],\n  \"panels\": [\n    {\n      \"collapsed\": true,\n      \"datasource\": null,\n      \"gridPos\": {\n        \"h\": 1,\n        \"w\": 24,\n        \"x\": 0,\n        \"y\": 0\n      },\n      \"id\": 22,\n      \"panels\": [\n        {\n          \"cacheTimeout\": null,\n          \"datasource\": \"${DS_PROMETHEUS}\",\n          \"fieldConfig\": {\n            \"defaults\": {\n              \"color\": {\n                \"mode\": \"thresholds\"\n              },\n              \"mappings\": [\n                {\n                  \"options\": {\n                    \"match\": \"null\",\n                    \"result\": {\n                      \"text\": \"N/A\"\n                    }\n                  },\n                  \"type\": \"special\"\n                }\n              ],\n              \"thresholds\": {\n                \"mode\": \"absolute\",\n                \"steps\": [\n                  {\n                    \"color\": \"green\",\n                    \"value\": null\n                  },\n                  {\n                    \"color\": \"red\",\n                    \"value\": 80\n                  }\n                ]\n              },\n              \"unit\": \"dateTimeAsIso\"\n            },\n            \"overrides\": []\n          },\n          \"gridPos\": {\n            \"h\": 9,\n            \"w\": 5,\n            \"x\": 2,\n            \"y\": 1\n          },\n          \"id\": 2,\n          \"interval\": null,\n          \"links\": [],\n          \"maxDataPoints\": 100,\n          \"options\": {\n            \"colorMode\": \"none\",\n            \"graphMode\": \"none\",\n            \"justifyMode\": \"auto\",\n            \"orientation\": \"horizontal\",\n            \"reduceOptions\": {\n              \"calcs\": [\n                \"lastNotNull\"\n              ],\n              \"fields\": \"\",\n              \"values\": false\n            },\n            \"text\": {},\n            \"textMode\": \"auto\"\n          },\n          \"pluginVersion\": \"8.1.2\",\n          \"targets\": [\n            {\n              \"exemplar\": true,\n              \"expr\": \"(process_start_time_seconds{instance=\\\"$instance\\\"})*1000\",\n              \"interval\": \"\",\n              \"legendFormat\": \"{{instance}}\",\n              \"refId\": \"A\"\n            }\n          ],\n          \"timeFrom\": null,\n          \"timeShift\": null,\n          \"title\": \"Up since\",\n          \"type\": \"stat\"\n        },\n        {\n          \"datasource\": \"${DS_PROMETHEUS}\",\n          \"fieldConfig\": {\n            \"defaults\": {\n              \"displayName\": \"\",\n              \"mappings\": [],\n              \"thresholds\": {\n                \"mode\": \"absolute\",\n                \"steps\": [\n                  {\n                    \"color\": \"green\",\n                    \"value\": null\n                  }\n                ]\n              },\n              \"unit\": \"decbytes\"\n            },\n            \"overrides\": []\n          },\n          \"gridPos\": {\n            \"h\": 9,\n            \"w\": 5,\n            \"x\": 7,\n            \"y\": 1\n          },\n          \"id\": 4,\n          \"options\": {\n            \"orientation\": \"auto\",\n            \"reduceOptions\": {\n              \"calcs\": [\n                \"mean\"\n              ],\n              \"fields\": \"\",\n              \"values\": false\n            },\Line truncated
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/managed-by: manual
-    grafana_dashboard: "1"
-  name: crowdsec-crowdsec-insight
-  namespace: prometheus

crowdsec/k8s/janitor-cronjob.yaml

@@ -1,202 +0,0 @@
-# CrowdSec self-healing: static machine identity + enforcement loops.
-#
-# Problem it fixes: the chart's agent init container runs
-#   `cscli lapi register --machine "$POD_NAME" ...`
-# unconditionally. Credentials live in an emptyDir, the machine row lives
-# in LAPI's persistent DB. Any init re-run for an already-known pod name
-# (kubelet restart, node reboot) dies with
-#   403 Forbidden: user '<pod>' already exist
-# and the DaemonSet pod sticks in Init forever. Every DS restart also
-# leaves an orphan machine row that is never cleaned.
-#
-# Design (name-independent):
-#   * Agent identity is a STATIC machine `crowdsec-agent-workstation`
-#     whose password lives in Secret `crowdsec-agent-credentials`
-#     (created once, manually - like all other secrets in this repo).
-#     The secret is mounted into agent pods at
-#     /tmp_config/local_api_credentials.yaml (see extraVolumeMounts in
-#     crowdsec-values.yaml), which is exactly the path the agent's main
-#     container copies into place at startup.
-#   * The DS init command is patched (strategic merge, by container name)
-#     to SKIP registration when that file exists, keeping the legacy
-#     register path only as fallback. Detection marker in the patched
-#     command: `[ -s /tmp_config`.
-#   * This CronJob enforces the desired state hourly, so recovery is
-#     automatic even after `helm upgrade` reverts the DS patch or the
-#     LAPI database is wiped:
-#       1. patch DS init if it still has the unconditional register
-#          (no-op otherwise - no restart churn);
-#       2. prune machines with no heartbeat for 2h (orphan hygiene);
-#       3. ensure the static machine exists, recreating it with the
-#          Secret password if missing (agent retry loops reconnect
-#          on their own - same name + same password);
-#       4. prune bouncer entries idle for 30d.
-#
-# It used to also delete LePresidente/http-generic-403-bf decisions hourly.
-# That was a workaround for the bouncer failing closed on a slow LAPI and
-# 403-ing the deploy runner into a 4h ban. The bouncer now polls decisions
-# into a cache and never blocks on an unreachable LAPI, so it cannot
-# manufacture those 403s any more, and the scenario only fires against real
-# scanners - deleting their decisions hourly was undoing a working ban.
-#
-# Manual apply (crowdsec/k8s is NOT managed by deploy.yaml):
-#   kubectl apply -f crowdsec/k8s/janitor-cronjob.yaml
-# Force a run:
-#   kubectl create job -n crowdsec --from=cronjob/crowdsec-janitor janitor-now
-#
-# Helm upgrades: the janitor's strategic patch puts the DS field under
-# the `kubectl-patch` field manager, so a plain `helm upgrade` FAILS
-# with an SSA conflict on initContainers[].command. Procedure:
-#   1. revert init to chart state (kills the conflict):
-#        helm template crowdsec crowdsec/crowdsec --version <ver> \
-#          -n crowdsec -f crowdsec/k8s/crowdsec-values.yaml > /tmp/r.yaml
-#        python3 -c "import yaml,json; ..." # build revert patch from
-#        the rendered DaemonSet init command, then
-#        kubectl patch ds crowdsec-agent -n crowdsec \
-#          --type strategic -p "\$(cat /tmp/revert_patch.json)"
-#   2. helm upgrade --install crowdsec ... (no --force needed)
-#   3. janitor-now right away (upgrade reverts init; new pods would
-#      sit in Init until the next hourly run otherwise).
-#
-# One-time bootstrap (order matters):
-#   1. Create Secret + static machine (see commands in chat).
-#   2. Apply this file, trigger janitor-now, wait for agent 1/1.
-#   3. One-time orphan cleanup:
-#        kubectl exec -n crowdsec deploy/crowdsec-lapi -- \
-#          cscli machines prune --duration 1h --force
-#   4. Only then `helm upgrade` crowdsec with the extraVolumes values.
-#      Upgrade reverts the DS patch; trigger janitor-now right after it
-#      (otherwise new pods sit in Init until the next hourly run, then
-#      self-heal anyway).
-#
-# Password rotation: update the Secret, delete the machine
-# (`cscli machines delete crowdsec-agent-workstation`), trigger
-# janitor-now (recreates it), then `kubectl rollout restart
-# ds/crowdsec-agent -n crowdsec` (agent reads the file at startup only).
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: crowdsec-janitor
-  namespace: crowdsec
-  labels:
-    app.kubernetes.io/part-of: crowdsec
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: crowdsec-janitor
-  namespace: crowdsec
-  labels:
-    app.kubernetes.io/part-of: crowdsec
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["create"]
-  - apiGroups: ["apps"]
-    resources: ["daemonsets"]
-    verbs: ["get", "patch"]
-  # `kubectl exec deploy/<name>` resolves deploy -> replicaset -> pod,
-  # which needs read access to these (exec itself is pods/exec above).
-  - apiGroups: ["apps"]
-    resources: ["deployments", "replicasets"]
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: crowdsec-janitor
-  namespace: crowdsec
-  labels:
-    app.kubernetes.io/part-of: crowdsec
-subjects:
-  - kind: ServiceAccount
-    name: crowdsec-janitor
-    namespace: crowdsec
-roleRef:
-  kind: Role
-  name: crowdsec-janitor
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: crowdsec-janitor
-  namespace: crowdsec
-  labels:
-    app.kubernetes.io/part-of: crowdsec
-spec:
-  schedule: "17 * * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      activeDeadlineSeconds: 300
-      template:
-        metadata:
-          labels:
-            app.kubernetes.io/part-of: crowdsec
-        spec:
-          serviceAccountName: crowdsec-janitor
-          restartPolicy: OnFailure
-          containers:
-            - name: janitor
-              # Same image the chart itself uses for registration jobs;
-              # IfNotPresent so it works while the node is offline
-              # (layer cached from the chart install).
-              image: alpine/kubectl:latest
-              imagePullPolicy: IfNotPresent
-              env:
-                - name: AGENT_PASSWORD
-                  valueFrom:
-                    secretKeyRef:
-                      name: crowdsec-agent-credentials
-                      key: password
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  set -eu
-                  LAPI_EXEC="kubectl exec -n crowdsec deploy/crowdsec-lapi --"
-                  echo "== 1. enforce patched agent init =="
-                  CUR=$(kubectl get ds crowdsec-agent -n crowdsec \
-                    -o jsonpath='{.spec.template.spec.initContainers[0].command[2]}')
-                  case "$CUR" in
-                    *'-s /tmp_config'*)
-                      echo "init already patched"
-                      ;;
-                    *)
-                      echo "patching init"
-                      WAIT='until nc "$LAPI_HOST" "$LAPI_PORT" -z'
-                      WAIT="$WAIT; do echo waiting for lapi to start; sleep 5; done"
-                      LINK='ln -s /staging/etc/crowdsec /etc/crowdsec'
-                      REG='cscli lapi register --machine "$USERNAME"'
-                      REG="$REG -u \"\$LAPI_URL\" --token \"\$REGISTRATION_TOKEN\""
-                      CREDS=/tmp_config/local_api_credentials.yaml
-                      CMD="$WAIT; $LINK; [ -s $CREDS ] || {"
-                      CMD="$CMD $REG && cp"
-                      CMD="$CMD /etc/crowdsec/local_api_credentials.yaml $CREDS; }"
-                      ESC=$(printf '%s' "$CMD" | sed 's/"/\\"/g')
-                      PATCH='{"spec":{"template":{"spec":{"initContainers":'
-                      PATCH=$PATCH'[{"name":"wait-for-lapi-and-register",'
-                      PATCH=$PATCH'"command":["sh","-c","'$ESC'"]}]}}}}'
-                      kubectl patch ds crowdsec-agent -n crowdsec \
-                        --type strategic -p "$PATCH"
-                      ;;
-                  esac
-                  echo "== 2. prune orphan machines (no heartbeat for 2h) =="
-                  $LAPI_EXEC cscli machines prune --duration 2h --force
-                  echo "== 3. ensure static machine exists =="
-                  if $LAPI_EXEC cscli machines inspect \
-                    crowdsec-agent-workstation >/dev/null 2>&1; then
-                    echo "static machine present"
-                  else
-                    echo "recreating static machine"
-                    $LAPI_EXEC cscli machines add crowdsec-agent-workstation \
-                      --password "$AGENT_PASSWORD" --force
-                  fi
-                  echo "== 4. prune stale bouncers (no pull for 30d) =="
-                  $LAPI_EXEC cscli bouncers prune -d 720h --force

crowdsec/k8s/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: crowdsec
-  labels:
-    app.kubernetes.io/part-of: crowdsec

crowdsec/k8s/network-policy.yaml

@@ -1,34 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: crowdsec-lapi
-  namespace: crowdsec
-spec:
-  podSelector:
-    matchLabels:
-      k8s-app: crowdsec
-      type: lapi
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik
-        - podSelector:
-            matchLabels:
-              k8s-app: crowdsec
-              type: agent
-      ports:
-        - protocol: TCP
-          port: 8080
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: prometheus
-      ports:
-        - protocol: TCP
-          port: 6060

dockmon/compose.yaml

@@ -1,46 +1,50 @@
 services:
-  dockmon:
+   dockmon:
-    image: darthnorse/dockmon:2.5.0
+      image: darthnorse/dockmon:latest
-    container_name: dockmon
+      container_name: dockmon
-    restart: unless-stopped
+      restart: unless-stopped
-    # ports:
+      # ports:
-    #   - 8000:443
+      #    - 8000:443
-    volumes:
+      volumes:
-      - data:/app/data
+         - data:/app/data
-      - /var/run/docker.sock:/var/run/docker.sock
+         - /var/run/docker.sock:/var/run/docker.sock
-    healthcheck:
+      healthcheck:
-      test: ["CMD", "curl", "-k", "-f", "https://localhost:443/health"]
+         test: [ "CMD", "curl", "-k", "-f", "https://localhost:443/health" ]
-      interval: 30s
+         interval: 30s
-      timeout: 10s
+         timeout: 10s
-      retries: 3
+         retries: 3
-    labels:
+      labels:
-      - "traefik.enable=true"
+         - "traefik.enable=true"
-      - "traefik.http.services.dockmon.loadbalancer.server.port=443"
+         - "traefik.docker.network=proxy"
-      - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+         - "traefik.http.services.dockmon.loadbalancer.server.port=443"
-      - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
+         - "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
+         - "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
 
-      # Prod Router
+         # Prod Router
-      - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
+         - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
-      - "traefik.http.routers.dockmon.entrypoints=websecure"
+         - "traefik.http.routers.dockmon.entrypoints=websecure"
-      - "traefik.http.routers.dockmon.middlewares=security-headers@file"
+         - "traefik.http.routers.dockmon.middlewares=security-chain@file"
-      - "traefik.http.routers.dockmon.tls.certresolver=letsencrypt"
+         - "traefik.http.routers.dockmon.service=dockmon"
-      # Local Router
+         - "traefik.http.routers.dockmon.tls=true"
-      - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
+         # Local Router
-      - "traefik.http.routers.dockmon-local.entrypoints=websecure"
+         - "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
-      - "traefik.http.routers.dockmon-local.tls=true"
+         - "traefik.http.routers.dockmon-local.entrypoints=websecure"
-      # Dev Router
+         - "traefik.http.routers.dockmon-local.middlewares=security-headers@file"
-      - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
+         - "traefik.http.routers.dockmon-local.tls=true"
-      - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
+         # Dev Router
-      - "traefik.http.routers.dockmon-dev.tls=true"
+         - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
+         - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
+         - "traefik.http.routers.dockmon-dev.middlewares=security-chain@file"
+         - "traefik.http.routers.dockmon-dev.tls=true"
 
-      # Glance Metadata
+         # Glance Metadata
-      - glance.name=dockmon
+         - glance.name=dockmon
-      - glance.url=https://dockmon.forust.xyz/
+         - glance.url=https://dockmon.forust.xyz/
-      - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
+         - glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
-    networks:
+      networks:
-      - proxy
+         - proxy
 volumes:
-  data:
+   data:
 networks:
-  proxy:
+   proxy:
-    external: true
+      external: true

dockmon/k8s/certificates.yaml

@@ -1,28 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: dockmon-prod-tls
-  namespace: dockmon
-spec:
-  secretName: dockmon-prod-tls
-  dnsNames:
-    - dockmon.forust.xyz
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: dockmon
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

dockmon/k8s/dockmon.yaml

@@ -1,68 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: dockmon-service
-  namespace: dockmon
-spec:
-  clusterIP: None
-  selector:
-    app: dockmon
-  ports:
-    - port: 443
-      targetPort: 443
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: dockmon-statefulset
-  namespace: dockmon
-spec:
-  serviceName: dockmon-service
-  replicas: 1
-  selector:
-    matchLabels:
-      app: dockmon
-  template:
-    metadata:
-      labels:
-        app: dockmon
-    spec:
-      containers:
-        - name: dockmon
-          image: darthnorse/dockmon:2.5.0
-          ports:
-            - containerPort: 443
-          volumeMounts:
-            - name: data
-              mountPath: /app/data
-            - name: docker-sock
-              mountPath: /var/run/docker.sock
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 443
-              scheme: HTTPS
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 10
-            failureThreshold: 3
-          resources:
-            requests:
-              memory: "512Mi"
-              cpu: "200m"
-            limits:
-              memory: "1.5Gi"
-              cpu: "700m "
-      volumes:
-        - name: docker-sock
-          hostPath:
-            path: /var/run/docker.sock
-            type: Socket
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi

dockmon/k8s/ingress.yaml

@@ -1,47 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: dockmon-transport
-  namespace: dockmon
-spec:
-  insecureSkipVerify: true
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: dockmon-prod
-  namespace: dockmon
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`dockmon.forust.xyz`)
-      kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-        - name: security-headers@file
-      services:
-        - name: dockmon-service
-          port: 443
-          serversTransport: dockmon-transport
-  tls:
-    secretName: dockmon-prod-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: dockmon-local
-  namespace: dockmon
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`dockmon.workstation.internal`) || Host(`dockmon.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: dockmon-service
-          port: 443
-          serversTransport: dockmon-transport
-  tls:
-    secretName: internal-wildcard-tls

dockmon/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: dockmon

downtify/compose.yaml

@@ -1,29 +1,31 @@
 services:
   downtify:
     container_name: downtify
-    image: ghcr.io/henriquesebastiao/downtify:3.1.0
+    image: ghcr.io/henriquesebastiao/downtify:latest
-    restart: unless-stopped
     # ports:
     #   - '7077:8000'
     volumes:
       - ./Downtify_downloads:/downloads
     labels:
-      - "traefik.enable=true"
+      - traefik.enable=true
-      - "traefik.http.services.downtify.loadbalancer.server.port=8000"
+      - traefik.docker.network=proxy
+      - traefik.http.services.downtify.loadbalancer.server.port=8000
 
       # Prod Router 
-      - "traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)"
+      - traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)
-      - "traefik.http.routers.downtify.entrypoints=websecure"
+      - traefik.http.routers.downtify.entrypoints=websecure
-      - "traefik.http.routers.downtify.middlewares=security-chain@file"
+      - traefik.http.routers.downtify.middlewares=security-chain@file
-      - "traefik.http.routers.downtify.tls.certresolver=letsencrypt"
+      - traefik.http.routers.downtify.tls=true
       # Local Router
-      - "traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`)"
+      - traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`) || Host(`downtify.internal`)
-      - "traefik.http.routers.downtify-local.entrypoints=websecure"
+      - traefik.http.routers.downtify-local.entrypoints=websecure
-      - "traefik.http.routers.downtify-local.tls=true"
+      - traefik.http.routers.downtify-local.middlewares=security-headers@file
+      - traefik.http.routers.downtify-local.tls=true
       # Dev Router
-      - "traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)"
+      - traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)
-      - "traefik.http.routers.downtify-dev.entrypoints=websecure"
+      - traefik.http.routers.downtify-dev.entrypoints=websecure
-      - "traefik.http.routers.downtify-dev.tls=true"
+      - traefik.http.routers.downtify-dev.middlewares=security-chain@file
+      - traefik.http.routers.downtify-dev.tls=true
     networks:
       - proxy
 networks:

downtify/k8s/downtify.yaml

@@ -1,58 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: downtify-service
-  namespace: downtify
-spec:
-  selector:
-    app: downtify
-  ports:
-    - port: 8000
-      targetPort: 8000
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: downtify-deployment
-  namespace: downtify
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: downtify
-  template:
-    metadata:
-      labels:
-        app: downtify
-    spec:
-      containers:
-        - name: downtify
-          image: ghcr.io/henriquesebastiao/downtify:3.1.0
-          ports:
-            - containerPort: 8000
-          volumeMounts:
-            - name: downloads
-              mountPath: /downloads
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "200m"
-            limits:
-              memory: "1Gi"
-              cpu: "1"
-      volumes:
-        - name: downloads
-          persistentVolumeClaim:
-            claimName: downtify-downloads-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: downtify-downloads-pvc
-  namespace: downtify
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

downtify/k8s/ingress.yaml

@@ -1,37 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: downtify-prod
-  namespace: downtify
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`downtify.forust.xyz`)
-      kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-        - name: security-chain@file
-      services:
-        - name: downtify-service
-          port: 8000
-  tls:
-    secretName: downtify-prod-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: downtify-local
-  namespace: downtify
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`downtify.workstation.internal`) || Host(`downtify.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: downtify-service
-          port: 8000
-  tls:
-    secretName: internal-wildcard-tls

downtify/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: downtify

dtek_notif/docker-compose.yaml

@@ -3,11 +3,10 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    image: gcr.forust.xyz/forust/dtek-notif:latest
-    pull_policy: build
     restart: unless-stopped
     environment:
       - TZ=Europe/Kyiv
+    
     dns:
       - 1.1.1.1
       - 8.8.8.8

edu_master/.env.example

@@ -9,6 +9,5 @@ WEBINAR_CHECK_INTERVAL=60
 REDIS_HOST=redis
 REDIS_PORT=6379
 PLAYWRIGHT_WS=ws://playwright-service:3000/ws
-TZ=Europe/Kyiv
 WEBINAR_TELEGRAM_TOKEN=your_telegram_bot_token_here
 WEBINAR_ADMIN_ID=123456789

edu_master/PLAYWRIGHT_VERSION

@@ -1 +0,0 @@
-1.56.0

edu_master/compose.yaml

@@ -1,11 +1,11 @@
 services:
   redis:
-    image: redis:8.10.2-alpine
+    image: redis:alpine
     restart: unless-stopped
     volumes:
       - redis-data:/data
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: [ "CMD", "redis-cli", "ping" ]
       interval: 5s
       timeout: 3s
       retries: 5
@@ -17,15 +17,13 @@ services:
 
   session-keeper:
     build: ./phpsessid-bot
-    image: gcr.forust.xyz/forust/session-keeper:prod
-    pull_policy: build
     env_file: .env
     restart: unless-stopped
     depends_on:
       redis:
         condition: service_healthy
     healthcheck:
-      test: ["CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1"]
+      test: [ "CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1" ]
       interval: 30s
       timeout: 5s
       retries: 10
@@ -33,8 +31,6 @@ services:
 
   webinar-checker:
     build: ./webinar-checker
-    image: gcr.forust.xyz/forust/webinar-checker:prod
-    pull_policy: build
     env_file: .env
     restart: unless-stopped
     depends_on:

edu_master/k8s/alerts.yaml

@@ -1,96 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: edu-master-webinar
-  namespace: edu-master
-  labels:
-    release: prometheus-stack
-spec:
-  groups:
-    - name: edu_master.webinar
-      rules:
-        # No successful webinar check for 5m (~2-3 missed 2-min checks).
-        # Catches: playwright hangs/timeouts, version skew, site changes, hung job.
-        # The last_success > 0 guard is mandatory: checker.py initialises
-        # last_success to 0, so without it `time() - 0` equals the current epoch
-        # and humanizeDuration renders ~20722d on every pod restart. Keep the
-        # duration expression on the left so $value stays the real gap.
-        - alert: WebinarCheckerNoSuccessfulCheck
-          expr: |
-            ((time() - webinar_check_last_success_timestamp_seconds) > 300)
-              and (webinar_check_last_success_timestamp_seconds > 0)
-              and (webinar_check_last_run_timestamp_seconds > 0)
-          for: 2m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Webinar checker has no successful check for 5m"
-            description: "edu-master/webinar-checker: last successful webinar check was {{ $value | humanizeDuration }} ago. Checks are failing or hanging (see consecutive failures alert). Notifications about new webinars are NOT being sent."
-
-        # Checks are running but none has ever succeeded since pod start.
-        # Split out from the rule above so a zeroed gauge never feeds
-        # humanizeDuration.
-        - alert: WebinarCheckerNeverSucceeded
-          expr: |
-            (webinar_check_last_success_timestamp_seconds == 0)
-              and (webinar_check_last_run_timestamp_seconds > 0)
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Webinar checker has never completed a successful check"
-            description: 'edu-master/webinar-checker: checks have been running for 10m but not one has ever succeeded since the pod started, so every check is failing. Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
-
-        # Fast path: 3 consecutive failures (~6+ min at 2-min interval).
-        - alert: WebinarCheckerConsecutiveFailures
-          expr: |
-            webinar_check_consecutive_failures >= 3
-          for: 5m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Webinar checker failing consecutively"
-            description: 'edu-master/webinar-checker: {{ $value }} consecutive webinar check failures (timeout / playwright error / page error). Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
-
-        # Metrics endpoint not scraped for 10m: pod down, metrics server dead, or ServiceMonitor broken.
-        - alert: WebinarCheckerScrapeDown
-          expr: |
-            absent(webinar_check_last_run_timestamp_seconds) == 1
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Webinar checker metrics missing"
-            description: "edu-master/webinar-checker: no metrics series for 10m. Pod may be down, metrics server dead, or ServiceMonitor/Service broken. Webinar checks are unobserved."
-
-        # EDU session lost: session-keeper down or credentials expired. Without PHPSESSID every check is skipped.
-        - alert: EduPhpsessidMissing
-          expr: |
-            edu_phpsessid_present == 0
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "EDU_PHPSESSID missing"
-            description: "edu-master: EDU_PHPSESSID absent from redis for 10m. Webinar/diari/schedule checks are all skipped. Check session-keeper logs and EDU credentials."
-
-        # Hard deps: checker and playwright deployments unavailable.
-        - alert: WebinarCheckerDeploymentDown
-          expr: |
-            kube_deployment_status_replicas_unavailable{deployment="webinar-checker", namespace="edu-master"} > 0
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Webinar checker deployment unavailable"
-            description: "edu-master/webinar-checker deployment has {{ $value }} unavailable replica(s) for 10m."
-
-        - alert: PlaywrightServiceDown
-          expr: |
-            kube_deployment_status_replicas_unavailable{deployment="playwright-service", namespace="edu-master"} > 0
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Playwright service unavailable"
-            description: "edu-master/playwright-service deployment has {{ $value }} unavailable replica(s) for 10m. All webinar/diari/schedule checks fail without it."

edu_master/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: edu-master

edu_master/k8s/playwright.yaml

@@ -1,67 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: playwright-service
-  namespace: edu-master
-  labels:
-    app: edu-master-playwright
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: edu-master-playwright
-  template:
-    metadata:
-      labels:
-        app: edu-master-playwright
-    spec:
-      containers:
-        - name: playwright
-          # renovate: datasource=docker depName=mcr.microsoft.com/playwright versioning=docker
-          image: mcr.microsoft.com/playwright:v1.56.0-jammy
-          imagePullPolicy: IfNotPresent
-          # p95 412M, max 478M over 7 days, no limit before. Request is set at p95
-          # so the pod is not an eviction candidate; the limit stays above 2x the
-          # request because browser page lifetimes are unpredictable.
-          resources:
-            requests:
-              cpu: "200m"
-              memory: "416Mi"
-            limits:
-              memory: "1Gi"
-          command:
-            - npx
-            - -y
-            - playwright@1.56.0
-            - run-server
-            - --port
-            - "3000"
-            - --path
-            - /ws
-          ports:
-            - containerPort: 3000
-          readinessProbe:
-            tcpSocket:
-              port: 3000
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 3
-          livenessProbe:
-            tcpSocket:
-              port: 3000
-            initialDelaySeconds: 15
-            periodSeconds: 20
-            timeoutSeconds: 3
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: playwright-service
-  namespace: edu-master
-spec:
-  selector:
-    app: edu-master-playwright
-  ports:
-    - name: ws
-      port: 3000
-      targetPort: 3000

edu_master/k8s/redis.yaml

@@ -1,75 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: redis
-  namespace: edu-master
-  labels:
-    app: edu-master-redis
-spec:
-  serviceName: redis
-  replicas: 1
-  selector:
-    matchLabels:
-      app: edu-master-redis
-  template:
-    metadata:
-      labels:
-        app: edu-master-redis
-    spec:
-      containers:
-        - name: redis
-          image: redis:8.10.2-alpine
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 6379
-          volumeMounts:
-            - name: redis-data
-              mountPath: /data
-          resources:
-            requests:
-              cpu: 25m
-              memory: 32Mi
-            limits:
-              cpu: 250m
-              memory: 128Mi
-          readinessProbe:
-            exec:
-              command: ["redis-cli", "ping"]
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 3
-          livenessProbe:
-            exec:
-              command: ["redis-cli", "ping"]
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 3
-      volumes:
-        - name: redis-data
-          persistentVolumeClaim:
-            claimName: redis-data-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: redis-data-pvc
-  namespace: edu-master
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis
-  namespace: edu-master
-spec:
-  selector:
-    app: edu-master-redis
-  ports:
-    - name: redis
-      port: 6379
-      targetPort: 6379

edu_master/k8s/restore-seed-job.yaml.example

@@ -1,50 +0,0 @@
-# One-time Job to migrate redis state from docker compose to k8s (maintenance window).
-# The .example file is not applied by the deploy pipeline (mask *.example.yaml).
-#
-# Runbook:
-#   1. docker compose -f <repo>/edu_master/compose.yaml stop        # SIGTERM -> redis will flush dump.rdb
-#   2. docker run --rm -v edu_master_redis-data:/data \
-#        -v /tmp/edu-master-backup:/backup \
-#        redis:alpine sh -c "cp /data/dump.rdb /backup/ && ls -la /backup"
-#   3. kubectl apply -f edu_master/k8s/namespace.yaml
-#   4. kubectl apply -f <only the PVC from redis.yaml>              # seed must come BEFORE redis pod starts
-#   5. kubectl apply -f edu_master/k8s/restore-seed-job.yaml.example
-#      kubectl wait --for=condition=complete job/redis-restore-seed -n edu-master --timeout=120s
-#   6. kubectl delete job redis-restore-seed -n edu-master
-#   7. kubectl apply -f edu_master/k8s/ -R                           # apply remaining manifests
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: redis-restore-seed
-  namespace: edu-master
-spec:
-  backoffLimit: 2
-  ttlSecondsAfterFinished: 3600
-  template:
-    spec:
-      restartPolicy: Never
-      containers:
-        - name: seed
-          image: redis:alpine
-          command:
-            - /bin/sh
-            - -ec
-            - |
-              ls -la /backup
-              cp /backup/dump.rdb /data/dump.rdb
-              chmod 644 /data/dump.rdb
-              ls -la /data
-          volumeMounts:
-            - name: redis-data
-              mountPath: /data
-            - name: backup
-              mountPath: /backup
-              readOnly: true
-      volumes:
-        - name: redis-data
-          persistentVolumeClaim:
-            claimName: redis-data-pvc
-        - name: backup
-          hostPath:
-            path: /tmp/edu-master-backup
-            type: DirectoryOrCreate

edu_master/k8s/secrets.yaml.example

@@ -1,29 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: edu-master-secrets
-  namespace: edu-master
-type: Opaque
-stringData:
-  # Session keeper credentials
-  KEEPER_LOGIN: ""
-  KEEPER_PASSWORD: ""
-  KEEPER_INTERVAL: "10"
-  # EDU links
-  EDU_URL_BASE: "https://edu.edu.vn.ua"
-  EDU_URL_LOGIN: "/user/login"
-  EDU_URL_COURSES: "/course/userlist"
-  EDU_URL_WEBINAR: "/webinar/useractive"
-  # Playwright
-  USER_AGENT: ""
-  PLAYWRIGHT_WS: "ws://playwright-service:3000/ws"
-  # Webinar-checker
-  WEBINAR_TELEGRAM_TOKEN: ""
-  WEBINAR_ADMIN_ID: ""
-  WEBINAR_CHECK_INTERVAL: "60"
-  # Prometheus metrics endpoint (scraped via ServiceMonitor, alerts in k8s/alerts.yaml)
-  METRICS_PORT: "8000"
-  # Database
-  REDIS_HOST: "redis"
-  REDIS_PORT: "6379"
-  TZ: "Europe/Kyiv"

edu_master/k8s/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: webinar-checker
-  namespace: edu-master
-  labels:
-    app: edu-master-webinar-checker
-spec:
-  selector:
-    app: edu-master-webinar-checker
-  ports:
-    - name: metrics
-      port: 8000
-      targetPort: metrics
-      protocol: TCP

edu_master/k8s/servicemonitor.yaml

@@ -1,16 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: webinar-checker
-  namespace: edu-master
-  labels:
-    release: prometheus-stack
-spec:
-  selector:
-    matchLabels:
-      app: edu-master-webinar-checker
-  endpoints:
-    - port: metrics
-      path: /metrics
-      interval: 30s
-      scrapeTimeout: 10s

edu_master/k8s/session-keeper.yaml

@@ -1,51 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: session-keeper
-  namespace: edu-master
-  labels:
-    app: edu-master-session-keeper
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: edu-master-session-keeper
-  template:
-    metadata:
-      labels:
-        app: edu-master-session-keeper
-    spec:
-      initContainers:
-        - name: wait-redis
-          image: redis:8.10.2-alpine
-          command:
-            - /bin/sh
-            - -ec
-            - |
-              i=0
-              until redis-cli -h redis ping | grep -q PONG; do
-                i=$((i+1))
-                [ "$i" -ge 300 ] && echo "TIMEOUT: redis not ready" && exit 1
-                sleep 2
-              done
-              echo "redis is ready"
-      containers:
-        - name: session-keeper
-          image: gcr.forust.xyz/forust/session-keeper:prod
-          envFrom:
-            - secretRef:
-                name: edu-master-secrets
-          resources:
-            requests:
-              cpu: 25m
-              memory: 32Mi
-            limits:
-              cpu: 250m
-              memory: 128Mi
-          readinessProbe:
-            exec:
-              command: ["/bin/sh", "-ec", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1"]
-            initialDelaySeconds: 15
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 10

edu_master/k8s/webinar-checker.yaml

@@ -1,73 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: webinar-checker
-  namespace: edu-master
-  labels:
-    app: edu-master-webinar-checker
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: edu-master-webinar-checker
-  template:
-    metadata:
-      labels:
-        app: edu-master-webinar-checker
-    spec:
-      # Enforces dependency order like compose depends_on:
-      # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
-      initContainers:
-        - name: wait-deps
-          image: redis:8.10.2-alpine
-          command:
-            - /bin/sh
-            - -ec
-            - |
-              i=0
-              until redis-cli -h redis ping | grep -q PONG; do
-                i=$((i+1))
-                [ "$i" -ge 300 ] && echo "TIMEOUT: redis not ready" && exit 1
-                sleep 2
-              done
-              echo "redis ok"
-              until [ "$(redis-cli -h redis EXISTS EDU_PHPSESSID)" = "1" ]; do
-                i=$((i+1))
-                [ "$i" -ge 300 ] && echo "TIMEOUT: no PHPSESSID (session-keeper down?)" && exit 1
-                sleep 2
-              done
-              echo "PHPSESSID ok"
-              until nc -z playwright-service 3000; do
-                i=$((i+1))
-                [ "$i" -ge 300 ] && echo "TIMEOUT: playwright-service not reachable" && exit 1
-                sleep 2
-              done
-              echo "playwright ok"
-      containers:
-        - name: webinar-checker
-          image: gcr.forust.xyz/forust/webinar-checker:prod
-          ports:
-            - name: metrics
-              containerPort: 8000
-              protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: metrics
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 12
-            initialDelaySeconds: 10
-          envFrom:
-            - secretRef:
-                name: edu-master-secrets
-          env:
-            - name: TZ
-              value: "Europe/Kyiv"
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "192Mi"
-            limits:
-              cpu: "600m"
-              memory: "384Mi"

edu_master/phpsessid-bot/Dockerfile

@@ -3,10 +3,10 @@ FROM python:3.11-slim
 WORKDIR /app
 
 # Install system dependencies
-RUN apt-get update && apt-get install -y --no-install-recommends redis-tools && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y redis-tools && rm -rf /var/lib/apt/lists/*
 
 # Install dependencies
-RUN pip install --no-cache-dir requests==2.32.3 redis==5.2.1
+RUN pip install requests redis
 
 # Copy application code
 COPY . .