Add Flux sync manifests

kubernetes-monitoring/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: master
+  secretRef:
+    name: flux-system
+  url: https://github.com/berezovskyi-oleksandr/homelab.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./kubernetes-monitoring
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

kubernetes-monitoring/flux-system/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml

kubernetes/app/blog/configmap-nginx.yaml

@@ -10,6 +10,7 @@ data:
         server_name _;
         root /git/current;
         index index.html;
+        absolute_redirect off;
 
         location /health {
             access_log off;

kubernetes/app/gitea/release.yaml

@@ -21,6 +21,175 @@ spec:
   upgrade:
     remediation:
       retries: 3
+  # Patch the init script: Gitea 1.26 removed environment-to-ini; use built-in subcommand instead.
+  # Remove once helm-gitea chart ships a release with the fix (commit 1baf2d0).
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: Secret
+              name: gitea-gitea
+            patch: |
+              apiVersion: v1
+              kind: Secret
+              metadata:
+                name: gitea-gitea
+              stringData:
+                config_environment.sh: |
+                  #!/usr/bin/env bash
+                  set -euo pipefail
+
+                  function env2ini::log() {
+                    printf "$${1}\n"
+                  }
+
+                  function env2ini::read_config_to_env() {
+                    local section="$${1}"
+                    local line="$${2}"
+
+                    if [[ -z "$${line}" ]]; then
+                      # skip empty line
+                      return
+                    fi
+
+                    # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
+                    local setting="$(awk -F '=' '{print $1}' <<< "$${line}" | xargs echo -n)"
+
+                    if [[ -z "$${setting}" ]]; then
+                      env2ini::log '  ! invalid setting'
+                      exit 1
+                    fi
+
+                    local value=''
+                    local regex="^$${setting}(\s*)=(\s*)(.*)"
+                    if [[ $line =~ $regex ]]; then
+                      value="$${BASH_REMATCH[3]}"
+                    else
+                      env2ini::log '  ! invalid setting'
+                      exit 1
+                    fi
+
+                    env2ini::log "    + '$${setting}'"
+
+                    if [[ -z "$${section}" ]]; then
+                      export "GITEA____$${setting^^}=$${value}"                           # '^^' makes the variable content uppercase
+                      return
+                    fi
+
+                    local masked_section="$${section//./_0X2E_}"                            # '//' instructs to replace all matches
+                    masked_section="$${masked_section//-/_0X2D_}"
+
+                    export "GITEA__$${masked_section^^}__$${setting^^}=$${value}"        # '^^' makes the variable content uppercase
+                  }
+
+                  function env2ini::reload_preset_envs() {
+                    env2ini::log "Reloading preset envs..."
+
+                    while read -r line; do
+                      if [[ -z "$${line}" ]]; then
+                        # skip empty line
+                        return
+                      fi
+
+                      # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
+                      local setting="$(awk -F '=' '{print $1}' <<< "$${line}" | xargs echo -n)"
+
+                      if [[ -z "$${setting}" ]]; then
+                        env2ini::log '  ! invalid setting'
+                        exit 1
+                      fi
+
+                      local value=''
+                      local regex="^$${setting}(\s*)=(\s*)(.*)"
+                      if [[ $line =~ $regex ]]; then
+                        value="$${BASH_REMATCH[3]}"
+                      else
+                        env2ini::log '  ! invalid setting'
+                        exit 1
+                      fi
+
+                      env2ini::log "  + '$${setting}'"
+
+                      export "$${setting^^}=$${value}"                           # '^^' makes the variable content uppercase
+                    done < "$TMP_EXISTING_ENVS_FILE"
+
+                    rm $TMP_EXISTING_ENVS_FILE
+                  }
+
+
+                  function env2ini::process_config_file() {
+                    local config_file="$${1}"
+                    local section="$(basename "$${config_file}")"
+
+                    if [[ $section == '_generals_' ]]; then
+                      env2ini::log "  [ini root]"
+                      section=''
+                    else
+                      env2ini::log "  $${section}"
+                    fi
+
+                    while read -r line; do
+                      env2ini::read_config_to_env "$${section}" "$${line}"
+                    done < <(awk 1 "$${config_file}")                             # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
+                  }
+
+                  function env2ini::load_config_sources() {
+                    local path="$${1}"
+
+                    if [[ -d "$${path}" ]]; then
+                      env2ini::log "Processing $(basename "$${path}")..."
+
+                      while read -d '' configFile; do
+                        env2ini::process_config_file "$${configFile}"
+                      done < <(find "$${path}" -type l -not -name '..data' -print0)
+
+                      env2ini::log "\n"
+                    fi
+                  }
+
+                  function env2ini::generate_initial_secrets() {
+                    # These environment variables will either be
+                    #   - overwritten with user defined values,
+                    #   - initially used to set up Gitea
+                    # Anyway, they won't harm existing app.ini files
+
+                    export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
+                    export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
+                    export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
+                    export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
+
+                    env2ini::log "...Initial secrets generated\n"
+                  }
+
+                  # save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
+                  env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > $TMP_EXISTING_ENVS_FILE
+
+                  # MUST BE CALLED BEFORE OTHER CONFIGURATION
+                  env2ini::generate_initial_secrets
+
+                  env2ini::load_config_sources "$ENV_TO_INI_MOUNT_POINT/inlines/"
+                  env2ini::load_config_sources "$ENV_TO_INI_MOUNT_POINT/additionals/"
+
+                  # load existing envs to override auto generated envs
+                  env2ini::reload_preset_envs
+
+                  env2ini::log "=== All configuration sources loaded ===\n"
+
+                  # safety to prevent rewrite of secret keys if an app.ini already exists
+                  if [ -f $${GITEA_APP_INI} ]; then
+                    env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
+                    env2ini::log '  - security.INTERNAL_TOKEN'
+                    env2ini::log '  - security.SECRET_KEY'
+                    env2ini::log '  - oauth2.JWT_SECRET'
+                    env2ini::log '  - server.LFS_JWT_SECRET'
+
+                    unset GITEA__SECURITY__INTERNAL_TOKEN
+                    unset GITEA__SECURITY__SECRET_KEY
+                    unset GITEA__OAUTH2__JWT_SECRET
+                    unset GITEA__SERVER__LFS_JWT_SECRET
+                  fi
+
+                  gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"
   values:
     strategy:
       type: Recreate
@@ -30,6 +199,11 @@ spec:
         type: RuntimeDefault
 
     image:
+      # renovate: currentValue=1.26.2-rootless currentDigest=sha256:c5c21a7705a16f2b2369384a3b7d67c5ed761a818bbb0a55187b5cf98cdc2e68
+
+      tag: 1.26.2
+
+      digest: sha256:c5c21a7705a16f2b2369384a3b7d67c5ed761a818bbb0a55187b5cf98cdc2e68
       rootless: true
       pullPolicy: IfNotPresent
 

kubernetes/app/gitea/renovate.json

@@ -0,0 +1,33 @@
+{
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Track gitea rootless image; chart appends -rootless to tag automatically",
+      "fileMatch": ["kubernetes/app/gitea/release\\.yaml$"],
+      "matchStrings": [
+        "(?<indentation>\\s+)# renovate: currentValue=(?<currentValue>[^\\s]+) currentDigest=(?<currentDigest>sha256:[a-f0-9]+)\\n\\s+tag: [^\\s]+\\n\\s+digest: [^\\s]+"
+      ],
+      "depNameTemplate": "gitea/gitea",
+      "datasourceTemplate": "docker",
+      "autoReplaceStringTemplate": "{{indentation}}# renovate: currentValue={{newValue}} currentDigest={{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}\n{{indentation}}tag: {{newMajor}}.{{newMinor}}.{{newPatch}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "semanticCommitScope": "k8s/gitea"
+    },
+    {
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "matchPackageNames": ["gitea/gitea"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "automerge": true
+    },
+    {
+      "description": "Ignore infrastructure images",
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "matchPackageNames": ["creativeprojects/resticprofile", "postgres"],
+      "enabled": false
+    }
+  ]
+}

kubernetes/app/jellyfin/deployment.yaml

@@ -43,7 +43,7 @@ spec:
               mountPath: /db-local
       containers:
         - name: jellyfin
-          image: jellyfin/jellyfin:10.11.8
+          image: jellyfin/jellyfin:10.11.11
           env:
             - name: JELLYFIN_PublishedServerUrl
               value: https://${JELLYFIN_HOST}

kubernetes/app/media/deployment-prowlarr.yaml

@@ -45,7 +45,7 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "prowlarr-log"' || true
       containers:
         - name: prowlarr
-          image: lscr.io/linuxserver/prowlarr:2.3.5
+          image: lscr.io/linuxserver/prowlarr:2.4.0
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-qbittorrent.yaml

@@ -29,7 +29,7 @@ spec:
               mountPath: /media
       containers:
         - name: qbittorrent
-          image: lscr.io/linuxserver/qbittorrent:5.2.0
+          image: lscr.io/linuxserver/qbittorrent:5.2.2
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/deployment-radarr.yaml

@@ -54,7 +54,7 @@ spec:
             - psql -d postgres -c 'CREATE DATABASE "radarr-log"' || true
       containers:
         - name: radarr
-          image: lscr.io/linuxserver/radarr:6.1.1
+          image: lscr.io/linuxserver/radarr:6.2.1
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/release-seerr.yaml

@@ -18,7 +18,7 @@ spec:
   targetNamespace: media
   values:
     image:
-      tag: v3.2.0
+      tag: v3.3.0
     podLabels:
       app: seerr
     extraEnv:

kubernetes/infrastructure/controllers/authelia/redis-release.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: redis
-      version: 25.x
+      version: 25.5.3
       reconcileStrategy: ChartVersion
       sourceRef:
         kind: HelmRepository

renovate.json

@@ -5,7 +5,8 @@
     ":semanticCommits",
     "local>oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/media/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json"
+    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/gitea/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",