feat: add gen-certs script and update adguard

README.md

@@ -7,119 +7,3 @@
 ```bash
 ethtool -K eno1 tx off rx off
 ```
-
-## scripts
-
-### `hbd.sh` - Helm Build and Deploy
-
-Package and push Helm charts to an OCI registry.
-
-```bash
-scripts/hbd.sh <chart-name> [version] [--oci-registry <registry>]
-```
-
-**Arguments:**
-- `chart-name` - Name of the chart in `k8s/charts/`
-- `version` (optional) - Version to deploy. If omitted, bumps patch version (e.g., 0.1.0 → 0.1.1)
-- `--oci-registry <registry>` (optional) - Override default OCI registry
-
-**Default registry:** `oci://git.roboces.dev/catalin/fukuops`
-
-**Examples:**
-```bash
-# Deploy next patch version (0.1.0 → 0.1.1)
-scripts/hbd.sh vaultwarden
-
-# Deploy specific version
-scripts/hbd.sh vaultwarden 0.2.0
-
-# Deploy to custom registry
-scripts/hbd.sh vaultwarden 0.1.1 --oci-registry oci://my-registry.com/charts
-```
-
----
-
-### `k3scale.sh` - Kubernetes Scaling
-
-Scale deployments and statefulsets in a k3s cluster.
-
-```bash
-scripts/k3scale.sh REPLICAS [RESOURCE...] [OPTIONS]
-```
-
-**Arguments:**
-- `REPLICAS` - Number of replicas to scale to
-- `RESOURCE` - Resource to scale in `namespace/name` format (can specify multiple)
-
-**Options:**
-- `--all` - Scale all deployments/statefulsets in current namespace
-- `--all-namespaces` - Scale across all namespaces
-- `-n, --namespace NAMESPACE` - Target namespace
-- `--dry-run` - Show actions without executing
-- `-v|-vv|-vvv` - Verbosity levels
-
-**Examples:**
-```bash
-scripts/k3scale.sh 1 mynamespace/mydeployment
-scripts/k3scale.sh 0 --all --namespace production
-scripts/k3scale.sh 3 --all --dry-run
-```
-
----
-
-### `proxmox-power.sh` - Proxmox VM Management
-
-Start or shutdown QEMU VMs and LXC containers on a Proxmox cluster.
-
-```bash
-scripts/proxmox-power.sh --op start|shutdown [--all | --ids <vmid> ...]] [OPTIONS]
-```
-
-**Options:**
-- `--op OP` - Operation: `start` or `shutdown` (required)
-- `--all` - Operate on all VMs/containers (honors filters)
-- `--ids LIST` - Space-separated list of VMIDs
-- `--only-qemu` - Only QEMU VMs
-- `--only-lxc` - Only LXC containers
-- `--force` - Force shutdown if timeout exceeded
-- `--timeout SEC` - Shutdown wait timeout (default: 120)
-- `--concurrency N` - Parallel operations (default: 4)
-- `--node NODE` - Restrict to specific node
-- `--dry-run` - Show actions without executing
-- `--insecure` - Skip SSL verification
-
-**Authentication (env vars):**
-- API Token: `PVE_TOKEN_ID` + `PVE_TOKEN_SECRET`
-- Password: `PVE_USER` + `PVE_PASSWORD` (or via GNOME keyring)
-
-**Examples:**
-```bash
-scripts/proxmox-power.sh --op shutdown --all
-scripts/proxmox-power.sh --op start --ids 100 101 --node mynode
-PVE_TOKEN_ID=user@pam!ci scripts/proxmox-power.sh --op start --all
-```
-
----
-
-
-### `update-argo.sh` - ArgoCD Upgrades
-
-Upgrade ArgoCD to a new version.
-
-```bash
-scripts/update-argo.sh [VERSION] [OPTIONS]
-```
-
-**Arguments:**
-- `VERSION` (optional) - Target version. If omitted, auto-detects latest
-
-**Options:**
-- `--dry-run` - Show what would be done
-- `-v|-vv|-vvv` - Verbosity levels
-
-**Examples:**
-```bash
-scripts/update-argo.sh                  # Upgrade to latest
-scripts/update-argo.sh v2.9.0          # Upgrade to specific version
-scripts/update-argo.sh --dry-run -vv   # Preview with verbose output
-```

scripts/gen-certs.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+    echo "Usage: $0 <fqdn> [-o destination]"
+    echo "  <fqdn>        Fully qualified domain name for the certificate"
+    echo "  -o            Optional destination (local path or ssh://host:port/path)"
+    echo "                Supported protocols: ssh://"
+    exit 1
+}
+
+if [ $# -lt 1 ]; then
+    usage
+fi
+
+if [[ "$1" == -* ]]; then
+    usage
+fi
+
+FQDN="$1"
+shift 1
+
+DEST=""
+OPTIND=1
+while getopts "ho:" opt; do
+    case "$opt" in
+        h) usage ;;
+        o) DEST="$OPTARG" ;;
+        *) usage ;;
+    esac
+done
+
+CERT_FILE="${FQDN}.pem"
+KEY_FILE="${FQDN}.key.pem"
+
+generate_cert() {
+    echo "Generating SSL certificate for ${FQDN}..."
+
+    openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
+        -keyout "${KEY_FILE}" \
+        -out "${CERT_FILE}" \
+        -subj "/CN=${FQDN}" \
+        -addext "subjectAltName=DNS:${FQDN}" \
+        2>/dev/null
+
+    echo "Certificate generated: ${CERT_FILE}"
+    echo "Key generated: ${KEY_FILE}"
+}
+
+transfer_via_ssh() {
+    local dest="$1"
+    local host port path
+
+    dest="${dest#*://}"
+    host="${dest%%:*}"
+
+    local remainder="${dest#*:}"
+    if [[ "$remainder" == /* ]]; then
+        path="$remainder"
+        port="22"
+    else
+        port="${remainder%%/*}"
+        path="/${remainder#*/}"
+    fi
+
+    echo "Transferring certificates to ${host}:${port}${path}..."
+
+    scp -P "${port}" "${CERT_FILE}" "${KEY_FILE}" "${host}:${path}/"
+
+    echo "Certificates transferred successfully."
+}
+
+main() {
+    generate_cert
+
+
+    if [ -z "${DEST}" ]; then
+        echo "Certificates are in the current directory (no -o destination provided)."
+        return
+    fi
+
+    if [[ "$DEST" == ssh://* ]]; then
+        transfer_via_ssh "${DEST#ssh://}"
+    else
+        if [ ! -d "${DEST}" ]; then
+            mkdir -p "${DEST}"
+        fi
+        cp "${CERT_FILE}" "${KEY_FILE}" "${DEST}/"
+        echo "Certificates copied to ${DEST}/"
+    fi
+}
+
+main

tofu/adguard/main.tf

@@ -17,7 +17,8 @@ terraform {
 provider "adguard" {
   host     = "dns.fuku"
   username = "admin"
-  scheme   = "http"
+  scheme   = "https"
+  insecure = "true"
   timeout  = 5
 }
 
@@ -111,3 +112,13 @@ resource "adguard_rewrite" "vault" {
   domain = "vault.roboces.dev"
   answer = "192.168.1.12"
 }
+
+resource "adguard_rewrite" "pocketid" {
+  domain = "auth.roboces.dev"
+  answer = "192.168.1.12"
+}
+
+resource "adguard_rewrite" "dns" {
+  domain = "dns.fuku"
+  answer = "192.168.1.12"
+}