Story Crater Bot
86f94f96fd
Adds Homarr landing page with Authentik SSO: - k8s/argocd/apps/60-applications.yaml: multi-source Application (homarr chart from homarr-labs + in-repo values), ns dashboard, wave 8 - k8s/bootstrap/ingress/ingress.yaml: homarr.riotpiao.com → dashboard/homarr:3000 - k8s/bootstrap/coredns/coredns-configmap.yaml: rewrite homarr.riotpiao.com to ingress controller - k8s/security/iam/scripts/authentik-provision.py: added 'homarr' to SERVICES (generates OAuth provider/app + homarr-oidc secret with client-id/secret) - k8s/security/iam/rbac-dashboard-rolebinding.yaml: grants authentik-provisioner SA access to dashboard ns for secret management - k8s/security/iam/kustomization.yaml: includes new RoleBinding Homarr now fully wired: - Ingress: https://homarr.riotpiao.com - SSO: redirects to Authentik, login as rock - Persistence: 5Gi RWO on longhorn-wffc (3-replica HA) - Tile config: UI-managed (saved to PVC)
317 lines
9.5 KiB
YAML
317 lines
9.5 KiB
YAML
# k8s/ingress/ingress.yaml
|
|
# Ingress rules for all homelab services.
|
|
# TLS is handled centrally: nginx serves the wildcard-tls cert (*.riotpiao.com)
|
|
# as its default-ssl-certificate. No per-rule tls: blocks or cert-manager annotations
|
|
# are needed — cert-manager manages one cert, nginx uses it for all hosts.
|
|
#
|
|
# DNS: *.riotpiao.com must resolve to 10.6.0.1 (WireGuard) or 192.168.1.160 (LAN).
|
|
|
|
# ── Grafana ───────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: grafana
|
|
namespace: logging
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: grafana.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: grafana
|
|
port:
|
|
number: 80
|
|
|
|
---
|
|
# ── Loki (API access for external tools) ─────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: loki
|
|
namespace: logging
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: loki.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: loki
|
|
port:
|
|
number: 3100
|
|
|
|
---
|
|
# ── Authentik ─────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: authentik
|
|
namespace: iam
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: authentik.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: authentik-server
|
|
port:
|
|
number: 80
|
|
|
|
---
|
|
# ── Vault ─────────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: vault
|
|
namespace: iam
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: vault.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: vault
|
|
port:
|
|
number: 8200
|
|
|
|
---
|
|
# ── MinIO console (storage namespace) ────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: minio
|
|
namespace: storage
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
|
nginx.ingress.kubernetes.io/affinity: "cookie"
|
|
nginx.ingress.kubernetes.io/session-cookie-name: "minio-console-affinity"
|
|
nginx.ingress.kubernetes.io/session-cookie-max-age: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: minio.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: minio-cluster-console
|
|
port:
|
|
number: 9090
|
|
|
|
---
|
|
# ── MinIO S3 API ──────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: minio-api
|
|
namespace: storage
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: minio-api.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: minio
|
|
port:
|
|
number: 9000
|
|
|
|
---
|
|
# ── Prometheus ────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: prometheus
|
|
namespace: monitoring
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: prometheus.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: prometheus-kube-prometheus-prometheus
|
|
port:
|
|
number: 9090
|
|
|
|
---
|
|
# ── Portainer ─────────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: portainer
|
|
namespace: dashboard
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: portainer.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: portainer
|
|
port:
|
|
number: 9000
|
|
|
|
---
|
|
# ── Forgejo (git forge + OCI registry UI) ────────────────────────────────────
|
|
# nginx terminates TLS using the wildcard cert, then proxies plain HTTP to
|
|
# Forgejo on port 3000. ROOT_URL stays https:// so Forgejo generates correct URLs.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: forgejo
|
|
namespace: cicd
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: forgejo.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: forgejo-gitea-http
|
|
port:
|
|
number: 3000
|
|
|
|
---
|
|
# ── Argo CD (cicd namespace) ──────────────────────────────────────────────────
|
|
# argocd-server runs HTTPS internally — nginx proxies via backend-protocol: HTTPS.
|
|
# proxy-ssl-verify: off because argocd-server's pod cert is self-signed (not homelab-ca).
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: argocd
|
|
namespace: argocd
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
|
nginx.ingress.kubernetes.io/proxy-ssl-verify: "off"
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: argocd.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: argocd-server
|
|
port:
|
|
number: 443
|
|
|
|
---
|
|
# ── Longhorn UI ───────────────────────────────────────────────────────────────
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: longhorn
|
|
namespace: longhorn-system
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: longhorn.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: longhorn-frontend
|
|
port:
|
|
number: 80
|
|
|
|
---
|
|
# ── Temporal Web UI ────────────────────────────────────────────────────────────
|
|
# Temporal workflow orchestration Web UI
|
|
# TLS: wildcard cert managed by cert-manager, served by nginx default-ssl-certificate
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: temporal
|
|
namespace: temporal
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: temporal.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: temporal-web
|
|
port:
|
|
number: 8080
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: homarr
|
|
namespace: dashboard
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: homarr.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: homarr
|
|
port:
|
|
number: 3000
|