add several config files, namely relevant to docker-30 and gitea

kustomization for cilium

docker-30/gitea/docker-compose.yaml

@@ -0,0 +1,117 @@
+version: '3.8'
+
+services:
+  postgres:
+    image: postgres:16
+    container_name: gitea-postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: gitea
+      POSTGRES_USER: gitea
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    volumes:
+      - ./postgres:/var/lib/postgresql/data
+    networks:
+      - gitea-network
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U gitea"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  # minio:
+  #   image: minio/minio:RELEASE.2025-09-07T16-13-09Z-cpuv1
+  #   container_name: gitea-minio
+  #   restart: unless-stopped
+  #   command: server /data --console-address ":9001"
+  #   environment:
+  #     MINIO_ROOT_USER: gitea
+  #     MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
+  #   volumes:
+  #     - ./minio:/data
+  #   networks:
+  #     - gitea-network
+  #   healthcheck:
+  #     test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
+  #     interval: 30s
+  #     timeout: 20s
+  #     retries: 3
+
+  gitea:
+    image: gitea/gitea:1.25
+    container_name: gitea-server
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+      #minio:
+      #  condition: service_healthy
+    environment:
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=postgres:5432
+      - GITEA__database__NAME=gitea
+      - GITEA__database__USER=gitea
+      - GITEA__database__PASSWD=${POSTGRES_PASSWORD}
+      - GITEA__server__DOMAIN=gitea.home.hrajfrisbee.cz
+      - GITEA__server__SSH_DOMAIN=gitea.home.hrajfrisbee.cz
+      - GITEA__server__ROOT_URL=https://gitea.home.hrajfrisbee.cz
+      - GITEA__security__SECRET_KEY=${GITEA_SECRET_KEY}
+      - GITEA__security__INTERNAL_TOKEN=${INTERNAL_TOKEN}
+      #- GITEA__storage__STORAGE_TYPE=minio
+      #- GITEA__storage__MINIO_ENDPOINT=minio:9000
+      #- GITEA__storage__MINIO_ACCESS_KEY_ID=gitea
+      #- GITEA__storage__MINIO_SECRET_ACCESS_KEY=${MINIO_ROOT_PASSWORD}
+      #- GITEA__storage__MINIO_BUCKET=gitea
+      #- GITEA__storage__MINIO_USE_SSL=false
+      #- GITEA__lfs__STORAGE_TYPE=minio
+      #- GITEA__packages__STORAGE_TYPE=minio
+      - GITEA__actions__ENABLED=true
+    volumes:
+      - ./data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "3000:3000"
+      - "2222:22"
+    networks:
+      - gitea-network
+
+  gitea-runner:
+    image: gitea/act_runner:nightly
+    container_name: gitea-runner
+    restart: unless-stopped
+    depends_on:
+      - gitea
+    environment:
+      GITEA_INSTANCE_URL: http://gitea:3000
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${RUNNER_TOKEN}
+    volumes:
+      - ./runner-data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - gitea-network
+
+  # caddy:
+  #   image: caddy:2.7-alpine
+  #   container_name: gitea-caddy
+  #   restart: unless-stopped
+  #   ports:
+  #     - "80:80"
+  #     - "443:443"
+  #   volumes:
+  #     - ./Caddyfile:/etc/caddy/Caddyfile
+  #     - ./caddy-data:/data
+  #     - ./caddy-config:/config
+  #   networks:
+  #     - gitea-network
+
+networks:
+  gitea-network:
+    driver: bridge
+
+volumes:
+  postgres-data:
+  #minio-data:
+  gitea-data:
+  #caddy-data:
+  #caddy-config:

docker-30/gitea/readme.md

@@ -0,0 +1,14 @@
+# Gitea
+
+```bash
+# mkdir -p /srv/docker/gitea-production/{data,postgres,minio,config}
+mkdir -p /srv/docker/gitea-production/{data,postgres,config}
+cd /srv/docker/gitea-production
+
+# Generate secure passwords
+echo "POSTGRES_PASSWORD=$(openssl rand -base64 32)" > .env
+echo "MINIO_ROOT_PASSWORD=$(openssl rand -base64 24)" >> .env
+echo "GITEA_SECRET_KEY=$(openssl rand -base64 32)" >> .env
+echo "INTERNAL_TOKEN=$(openssl rand -base64 32)" >> .env
+
+```

gitops/home-kubernetes/cilium/release.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+  namespace: kube-system
+spec:
+  chart:
+    spec:
+      chart: cilium
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: cilium
+      version: 1.16.5
+  interval: 5m0s

gitops/home-kubernetes/cilium/repository.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cilium
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  url: https://helm.cilium.io/

gitops/home-kubernetes/flux-system/extra-kustomizations.yaml

@@ -0,0 +1,52 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./gitops/home-kubernetes/cilium
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: ingress-nginx
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./gitops/home-kubernetes/ingress-nginx
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kuard
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./gitops/home-kubernetes/kuard
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: longhorn
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./gitops/home-kubernetes/longhorn
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

gitops/home-kubernetes/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  secretRef:
+    name: flux-system
+  url: https://gitlab.hrajfrisbee.cz/infrastructure/home-kubernetes.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./gitops/home-kubernetes/flux-system
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

gitops/home-kubernetes/flux-system/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml
+- extra-kustomizations.yaml

gitops/home-kubernetes/ingress-nginx/helmrelease_ingress-nginx.yaml

@@ -0,0 +1,21 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  chart:
+    spec:
+      chart: ingress-nginx
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: ingress-nginx
+      version: 4.12.0
+  values:
+    controller:
+      admissionWebhooks:
+        enabled: false
+        patch:
+          enabled: false
+  interval: 5m0s

gitops/home-kubernetes/ingress-nginx/helmrepository_ingress-nginx.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: ingress-nginx
+  namespace: ingress-nginx
+spec:
+  interval: 5m0s
+  url: https://kubernetes.github.io/ingress-nginx

gitops/home-kubernetes/ingress-nginx/namespace_ingress-nginx.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx

gitops/home-kubernetes/kuard/deployment_kuard.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kuard
+  namespace: kuard
+spec:
+  selector:
+    matchLabels:
+      app: kuard
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: kuard
+    spec:
+      containers:
+      - image: gcr.io/kuar-demo/kuard-amd64:1
+        imagePullPolicy: Always
+        name: kuard
+        ports:
+        - containerPort: 8080
+        resources:
+          limits:
+            cpu: 100m
+            memory: 100Mi
+          requests:
+            cpu: 100m
+            memory: 100Mi

gitops/home-kubernetes/kuard/ingress_kuard.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kuard
+  namespace: kuard
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: test.kuard.dev
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: kuard
+            port:
+              number: 80
+  - host: kuard.home.lab
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: kuard
+            port:
+              number: 80              

gitops/home-kubernetes/kuard/namespace_kuard.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kuard

gitops/home-kubernetes/kuard/service_kuard.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kuard
+  namespace: kuard
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+    protocol: TCP
+  selector:
+    app: kuard

gitops/home-kubernetes/longhorn/helmrelease_longhorn.yaml

@@ -0,0 +1,15 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: longhorn
+  namespace: longhorn
+spec:
+  chart:
+    spec:
+      chart: longhorn
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: longhorn
+      version: v1.8.1
+  interval: 5m0s

gitops/home-kubernetes/longhorn/helmrepository_longhorn.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: longhorn
+  namespace: longhorn
+spec:
+  interval: 5m0s
+  url: https://charts.longhorn.io

gitops/home-kubernetes/longhorn/namespace_longhorn.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: longhorn

todo.md

@@ -1,7 +1,9 @@
 ## kubernetes apps
 - certManager
 - cloudNativePg
-- longhorn CSI
+- ~~longhorn CSI~~
+- [20.7.2024] portworx
+- ingress controller
 
 
 ## other apps

vagrant/Vagrantfile

@@ -7,9 +7,11 @@ VAGRANT_BOX         = "generic/ubuntu2204"
 VAGRANT_BOX_VERSION = "4.3.12"
 CPUS_MASTER_NODE    = 2
 CPUS_WORKER_NODE    = 4
-MEMORY_MASTER_NODE  = 2048
+#MEMORY_MASTER_NODE  = 2048
-MEMORY_WORKER_NODE  = 4096
+MEMORY_MASTER_NODE  = 4096
-WORKER_NODES_COUNT  = 2
+#MEMORY_WORKER_NODE  = 4096
+MEMORY_WORKER_NODE  = 8192
+WORKER_NODES_COUNT  = 3
 
 
 Vagrant.configure(2) do |config|
@@ -84,6 +86,7 @@ Vagrant.configure(2) do |config|
         libvirt.cpus     = CPUS_WORKER_NODE
         libvirt.storage_pool_path = '/srv/vms'
         libvirt.storage :file, :size => '50G', :type => 'qcow2'
+        libvirt.storage :file, :size => '50G', :type => 'qcow2'
       end
 
       node.vm.provision "shell", path: "bootstrap_kworker.sh"

vagrant/k8s/gitea-values.yaml

@@ -0,0 +1,31 @@
+# helm upgrade --install gitea gitea-charts/gitea -n gitea --values gitea-values.yaml
+
+global:
+  storageClass: px-csi-db
+
+# clusterDomain: homelab.hrajfrisbee.cz
+
+
+gitea:
+  config:
+    server:
+      SSH_DOMAIN: gitea.homelab.hrajfrisbee.cz
+
+# service:
+#   http:
+#     type: LoadBalancer
+#     port: 443
+#     annotations:
+#       "io.cilium/lb-ipam-ips": "192.168.0.31"
+#       "lbipam.cilium.io/sharing-key": "1234"
+#     labels:
+#       homelab/public-service: "true"
+#   ssh:
+#     type: LoadBalancer
+#     port: 22
+#     ClusterIP:
+#     annotations:
+#       "io.cilium/lb-ipam-ips": "192.168.0.31"
+#       "lbipam.cilium.io/sharing-key": "1234"
+#     labels:
+#       homelab/public-service: "true"

vagrant/k8s/loadbalancer-ip-pools.yaml

@@ -6,4 +6,4 @@ metadata:
 spec:
   cidrs:
     - start: "192.168.0.31"
-    - stop: "192.168.0.39"    
+      stop: "192.168.0.39"    

vagrant/k8s/notes.md

@@ -0,0 +1,64 @@
+## gitea
+
+```bash
+# gitea install
+helm repo add gitea-charts https://dl.gitea.com/charts/ 
+helm upgrade --install gitea gitea-charts/gitea -n gitea --values gitea-values.yaml
+```
+
+
+## ingress
+```bash
+# istio
+# based on: https://tetrate.io/blog/istio-ingressclass-controller-with-helm/
+helm repo add istio https://istio-release.storage.googleapis.com/charts
+helm repo update
+
+kubectl create ns istio-system
+# this installs only serviceAccount and webhook
+helm install istio-base istio/base -n istio-system
+
+helm upgrade --install istiod istio/istiod -n istio-system \
+  --set meshConfig.ingressSelector=istio-ingress \
+  --set meshConfig.ingressService=istio-ingress \
+  --set pilot.env.K8S_INGRESS_NS=istio-ingress
+
+kubectl create ns istio-ingress
+helm install istio-ingress istio/gateway -n istio-ingress 
+
+helm install istio-ingressgateway istio/gateway -n istio-system
+
+# ingress class
+cat <<EOF | kubectl apply -f -
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  name: istio
+  annotations:
+    ingressclass.kubernetes.io/is-default-class: "true"
+spec:
+  controller: istio.io/ingress-controller
+EOF
+
+# first ingress
+cat <<EOF | kubectl apply -f -
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: httpbin
+spec:
+  ingressClassName: istio
+  rules:
+  - host: httpbin.homelab.hrajfrisbee.cz
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: httpbin
+            port:
+              number: 8000
+EOF
+
+```