catalin/fukuops
1
0
Fork 1
Code Issues 10 Pull requests Projects 2 Releases Packages 10 Activity

feat(helm): complete chart normalization with ConfigMap, HPA, and OCI migration

Browse source 
- Added debug mode, structured ConfigMap pattern, and README to all charts
- Migrated all flat-structure charts to hierarchical values under chartname key
- Fixed templates to use correct hierarchical paths
- Renamed helm-rustical key to rustical, added HPA support
- Fixed ingress YAML parsing (oxicloud), nested env vars (rustical)
- Pushed all normalized charts to OCI registry as 1.0.0+ and updated ArgoCD apps
This commit is contained in:
cătălin 2026-08-14 09:35:19 +02:00
commit 1fd2bfef3d
No known key found for this signature in database
71 changed files with 2150 additions and 965 deletions
Download patch file Download diff file Expand all files Collapse all files

11
k8s/argo-apps/authentik.yaml
View file

@ -51,6 +51,10 @@ spec:
persistentVolumeClaim:
claimName: pvc-authentik-media
server:
resources:
requests:
cpu: 500m
memory: 1Gi
autoscaling:
enabled: true
minReplicas: 1
@ -79,6 +83,9 @@ spec:
tls: []
https: true
worker:
requests:
cpu: 250m
memory: 512Mi
autoscaling:
enabled: true
minReplicas: 2
@ -92,4 +99,6 @@ spec:
targetRevision: main
project: fuku
syncPolicy:
automated: {}
automated:
prune: true
selfHeal: true

62
k8s/argo-apps/dokuwiki.yaml
View file

@ -12,38 +12,40 @@ spec:
sources:
- repoURL: git.roboces.dev/catalin/fukuops
chart: dokuwiki
targetRevision: 0.1.2
targetRevision: 1.0.2
helm:
valuesObject:
replicaCount: 1
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsUser: 33
runAsGroup: 33
capabilities:
drop:
- all
service:
type: LoadBalancer
port: 8004
ingress:
enabled: true
className: "traefik"
hosts:
- host: wiki.roboces.dev
paths:
- path: /
pathType: Prefix
persistence:
enabled: true
storageClass: "truenas-nfs-csi"
accessMode: ReadWriteMany
size: 20Gi
env:
PHP_TIMEZONE: Europe/Madrid
PHP_MEMORYLIMIT: 512M
PHP_UPLOADLIMIT: 128M
dokuwiki:
replicaCount: 1
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsUser: 33
runAsGroup: 33
capabilities:
drop:
- all
service:
type: LoadBalancer
port: 8004
ingress:
enabled: true
className: "traefik"
hosts:
- host: wiki.roboces.dev
paths:
- path: /
pathType: Prefix
persistence:
enabled: true
storageClass: "truenas-nfs-csi"
accessMode: ReadWriteMany
size: 20Gi
config:
php:
timezone: Europe/Madrid
memoryLimit: 512M
uploadLimit: 128M
project: roboces
syncPolicy:
automated:

4
k8s/argo-apps/forgejo.yaml
View file

@ -101,4 +101,6 @@ spec:
enabled: false
project: roboces
syncPolicy:
automated: {}
automated:
prune: true
selfHeal: true

80
k8s/argo-apps/helm-rustical.yaml
View file

@ -12,45 +12,51 @@ spec:
sources:
- repoURL: git.roboces.dev/catalin/fukuops
chart: helm-rustical
targetRevision: 0.3.0
targetRevision: 1.1.1
helm:
valuesObject:
debug:
enabled: false
replicaCount: 1
service:
type: LoadBalancer
port: 8001
targetPort: 4000
ingress:
enabled: true
className: "traefik"
hosts:
- host: cal.roboces.dev
paths:
- path: /
pathType: Prefix
env:
RUSTICAL_OIDC__NAME: Authentik
RUSTICAL_OIDC__ISSUER: https://auth.fukurokuju.dev/application/o/rustical/
RUSTICAL_OIDC__CLAIM_USERID: preferred_username
RUSTICAL_OIDC__SCOPES: '["openid", "profile", "groups"]'
RUSTICAL_OIDC__ALLOW_SIGN_UP: "true"
RUSTICAL_FRONTEND__ALLOW_PASSWORD_LOGIN: false
persistence:
enabled: true
storageClass: "truenas-nfs-csi"
accessMode: ReadWriteMany
size: 50Gi
secret:
existingSecretName: rustical
resources:
requests:
cpu: 250m
memory: 256Mi
limits:
cpu: 500m
memory: 512Mi
rustical:
debug:
enabled: false
autoscaling:
enabled: true
minReplicas: 1
maxReplicas: 3
targetCPUUtilizationPercentage: 80
targetMemoryUtilizationPercentage: 80
service:
type: LoadBalancer
port: 8001
targetPort: 4000
ingress:
enabled: true
className: "traefik"
hosts:
- host: cal.roboces.dev
paths:
- path: /
pathType: Prefix
config:
oidc.name: Authentik
oidc.issuer: https://auth.fukurokuju.dev/application/o/rustical/
oidc.claim_userid: preferred_username
oidc.scopes: '["openid", "profile", "groups"]'
oidc.allow_sign_up: "true"
frontend.allow_password_login: false
persistence:
enabled: true
storageClass: "truenas-nfs-csi"
accessMode: ReadWriteMany
size: 50Gi
secret:
existingSecretName: rustical
resources:
requests:
cpu: 250m
memory: 256Mi
limits:
cpu: 500m
memory: 512Mi
project: roboces
syncPolicy:
automated:

36
k8s/argo-apps/immich.yaml
View file

@ -12,13 +12,9 @@ spec:
sources:
- repoURL: git.roboces.dev/catalin/fukuops
chart: immich
targetRevision: 0.2.3
targetRevision: 1.0.4
helm:
valuesObject:
machine-learning:
enabled: true
service:
type: LoadBalancer
immich:
autoscaling:
enabled: true
@ -32,16 +28,17 @@ spec:
- all
service:
type: LoadBalancer
db:
hostname: "192.168.1.3"
port: 5432
database_name: "immich"
redis:
hostname: "192.168.1.3"
port: 30036
dbindex: "12"
general:
tz: "Europe/Madrid"
config:
database:
hostname: "192.168.1.3"
port: 5432
name: "immich"
redis:
hostname: "192.168.1.3"
port: 30036
dbIndex: "12"
general:
timezone: Europe/Madrid
persistence:
library:
enabled: true
@ -96,8 +93,13 @@ spec:
- path: /
pathType: Prefix
tls: []
secret:
existingSecretName: "immich-secrets"
machineLearning:
enabled: true
service:
type: LoadBalancer
secret:
enabled: true
existingSecretName: "immich-secrets"
project: roboces
syncPolicy:
automated:

135
k8s/argo-apps/miniflux.yaml
View file

@ -12,72 +12,79 @@ spec:
sources:
- repoURL: git.roboces.dev/catalin/fukuops
chart: miniflux
targetRevision: 0.2.0
targetRevision: 1.0.3
helm:
valuesObject:
replicaCount: 3
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 10000
runAsGroup: 10000
capabilities:
drop:
- all
service:
type: LoadBalancer
ingress:
enabled: true
className: "traefik"
hosts:
- host: feeds.roboces.dev
paths:
- path: /
pathType: Prefix
resources:
requests:
cpu: 300m
memory: 300Mi
ephemeral-storage: 2Gi
limits:
cpu: 400m
memory: 500Mi
ephemeral-storage: 4Gi
livenessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 5
timeoutSeconds: 15
successThreshold: 1
failureThreshold: 3
periodSeconds: 10
readinessProbe:
httpGet:
path: /
port: 8080
initialDelaySeconds: 15
timeoutSeconds: 2
successThreshold: 1
failureThreshold: 3
periodSeconds: 10
podDisruptionBudget:
enabled: true
maxUnavailable: 1
env:
RUN_MIGRATIONS: "1"
CREATE_ADMIN: "1"
OAUTH2_PROVIDER: oidc
OAUTH2_REDIRECT_URL: https://feeds.roboces.dev/oauth2/oidc/callback
OAUTH2_OIDC_DISCOVERY_ENDPOINT: https://auth.fukurokuju.dev/application/o/miniflux/
OAUTH2_USER_CREATION: "1"
FETCH_YOUTUBE_WATCH_TIME: "1"
WORKER_POOL_SIZE: "1"
POLLING_FREQUENCY: "120"
BATCH_SIZE: "25"
METRICS_COLLECTOR: "1"
METRICS_ALLOWED_NETWORKS: 10.42.1.0/16
secret:
existingSecretName: miniflux
miniflux:
autoscaling:
enabled: true
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 10000
runAsGroup: 10000
capabilities:
drop:
- all
service:
type: LoadBalancer
ingress:
enabled: true
className: "traefik"
hosts:
- host: feeds.roboces.dev
paths:
- path: /
pathType: Prefix
resources:
requests:
cpu: 500m
memory: 512Mi
ephemeral-storage: 2Gi
limits:
cpu: 700m
memory: 1024Mi
ephemeral-storage: 4Gi
livenessProbe:
tcpSocket:
port: 8080
initialDelaySeconds: 5
timeoutSeconds: 15
successThreshold: 1
failureThreshold: 3
periodSeconds: 10
readinessProbe:
httpGet:
path: /
port: 8080
initialDelaySeconds: 15
timeoutSeconds: 2
successThreshold: 1
failureThreshold: 3
periodSeconds: 10
podDisruptionBudget:
enabled: true
maxUnavailable: 1
config:
general:
runMigrations: true
createAdmin: true
workerPoolSize: 1
pollingFrequency: 120
batchSize: 25
oauth2:
enabled: true
provider: oidc
redirectUrl: https://feeds.roboces.dev/oauth2/oidc/callback
oidcDiscoveryEndpoint: https://auth.fukurokuju.dev/application/o/miniflux/
userCreation: true
metrics:
enabled: true
allowedNetworks: 10.42.1.0/16
youtube:
fetchWatchTime: true
secret:
existingSecretName: miniflux
project: roboces
syncPolicy:
automated:

68
k8s/argo-apps/oxicloud.yaml
View file

@ -12,39 +12,43 @@ spec:
sources:
- repoURL: git.roboces.dev/catalin/fukuops
chart: oxicloud
targetRevision: 0.1.0
targetRevision: 1.0.1
helm:
valuesObject:
persistence:
enabled: true
storageClass: "truenas-nfs-csi"
accessMode: ReadWriteMany
size: 50Gi
service:
type: LoadBalancer
config:
server:
port: 8086
host: "0.0.0.0"
baseUrl: "https://cloud.roboces.dev"
features:
enableAuth: "true"
enableSharing: "true"
mimalloc:
purgeDelay: "0"
allowLargeOsPages: "0"
secrets:
existingSecret: oxicloud
wopi:
enabled: false
ingress:
className: "traefik"
hosts:
- host: cloud.roboces.dev
paths:
- path: /
pathType: ImplementationSpecific
tls: []
oxicloud:
persistence:
enabled: true
storageClass: "truenas-nfs-csi"
accessMode: ReadWriteMany
size: 50Gi
service:
type: LoadBalancer
config:
server:
port: 8086
host: "0.0.0.0"
baseUrl: "https://cloud.roboces.dev"
features:
enableAuth: true
enableSharing: true
mimalloc:
purgeDelay: "0"
allowLargeOsPages: "0"
secret:
existingSecretName: oxicloud
wopi:
enabled: false
ingress:
enabled: true
className: "traefik"
hosts:
- host: cloud.roboces.dev
paths:
- path: /
pathType: ImplementationSpecific
tls: []
project: roboces
syncPolicy:
automated: {}
automated:
prune: true
selfHeal: true

1
k8s/argo-apps/vault-sm.yaml
View file

@ -21,6 +21,7 @@ spec:
type: LoadBalancer
persistence:
storageClass: truenas-nfs-csi
accessMode: ReadWriteMany
dashboard:
enabled: true
service:

84
k8s/argo-apps/vaultwarden.yaml
View file

@ -12,51 +12,51 @@ spec:
sources:
- repoURL: git.roboces.dev/catalin/fukuops
chart: vaultwarden
targetRevision: 0.1.1
targetRevision: 1.0.2
helm:
valuesObject:
conf:
db:
enable_db_wal: true
connection_retries: 15
timeout: 30
web_vault:
vaultwarden:
config:
database:
enableWal: true
connectionRetries: 15
timeout: 30
webVault:
enabled: true
folder: "web-vault/"
replicaCount: 1
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsUser: 10000
runAsGroup: 10000
capabilities:
drop:
- all
service:
type: LoadBalancer
ingress:
enabled: true
folder: "web-vault/"
replicaCount: 1
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
runAsUser: 10000
runAsGroup: 10000
capabilities:
drop:
- all
service:
type: LoadBalancer
ingress:
enabled: true
className: "traefik"
hosts:
- host: vault.roboces.dev
paths:
- path: /
pathType: Prefix
resources:
requests:
cpu: 250m
memory: 256Mi
limits:
cpu: 500m
memory: 512Mi
persistence:
enabled: true
storageClass: "truenas-nfs-csi"
accessMode: ReadWriteMany
size: 5Gi
secret:
existingSecretName: vaultwarden-secrets
className: "traefik"
hosts:
- host: vault.roboces.dev
paths:
- path: /
pathType: Prefix
resources:
requests:
cpu: 250m
memory: 256Mi
limits:
cpu: 500m
memory: 512Mi
persistence:
enabled: true
storageClass: "truenas-nfs-csi"
accessMode: ReadWriteMany
size: 5Gi
secret:
existingSecretName: vaultwarden-secrets
project: roboces
syncPolicy:
automated: