git sealed secret

media/jellyseerr.yaml

@@ -84,7 +84,7 @@ spec:
   - secretName: jellyseerr-ingress
     hosts:
     - jellyseerr.ntwl.xyz
-    - get.ntwl.xyz
+    - js.ntwl.xyz
   rules:
     - host: jellyseerr.ntwl.xyz
       http:
@@ -96,7 +96,7 @@ spec:
                   name: web
             path: /
             pathType: Prefix
-    - host: get.ntwl.xyz
+    - host: js.ntwl.xyz
       http:
         paths:
           - backend:

ops/git.yaml

@@ -1,15 +1,26 @@
 ---
 
-apiVersion: v1
-kind: Secret
+# gitea-admin-secret: sealed with kubeseal. Encrypted, safe to commit.
+# Rotate: recreate plaintext secret + re-seal, e.g.
+#   kubectl -n ops create secret generic gitea-admin-secret \
+#     --from-literal=username=ntr --from-literal=password="$NEWPW" \
+#     --from-literal=email=ntr@strix.systems --dry-run=client -o yaml | \
+#   kubeseal --controller-name sealed-secrets-controller \
+#     --controller-namespace kube-system --format yaml
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
 metadata:
   name: gitea-admin-secret
   namespace: ops
-type: Opaque
-stringData:
-  username: ntr
-  password: "REDACTED"
-  email: "ntr@strix.systems"
+spec:
+  encryptedData:
+    email: AgCCwKb/cTRNKgtg7gPwId5rVYzf++0BDWA8miOcfAFciSWX1hSXFL7LGe52Ln2UpYD7BRZkkGq2Rz53XM+irSKFnD0K+F8/+S2wu4Nxk2GbwBEHbANd3ATnxxdBsqRrEYZFHy5X29sFIF1Kp+p7UwJhudZVMjuSlJ9awXri+XR3te/Fmpa/kT5SF7gc9DQPrNsH3UaTVBhxJ1nFNKShdSTVLC8/fD5RgxMPxwexx3ny7a9YJxQh97Te8ZrR24ZceccY+lmbxadsqqth8KjeqAdUkH/LSkIelRr9v4xbKnV5oGwOKjRDF4tZxgoLmkHvoP97tp9b0/aEEyRU78Zz5aMRwWNsY78O4/ufudUIyUctctgNZ4x6N1QSHHFFGcAB12e15jP+5TgZj9RUov2B6NSIab2XJU4pm4H65OGsX9osHIGou5lRMZvRi/SZlkbtkzx3OwMfc5TSw7aRQ6fSiYagsxWmKJWVs+OFjI/b9ee436/C63u1yilWFT7VHoJzRGck35DWk4xvatOb77inJBwLahruDXBGD2BB4hGVRB7cNJ+aAavEgBVvPstN9ssD3TNwVPQxL7CQiDrt9sj5Og4FDl1F+F2UNfP4RrNYHIQFZeFDQwrKXRkzeCA76sYE6ee8RvurHDiia2HoF9RL3cx0EqDiuqAKBpbzFSdSCcCWWvsvx0ICbialykyB8dTn/Mktzu0+3hf5FiV/seI=
+    password: AgAytYm5H0dVZUrvE2Ag8WrkWVMeGHJ/I6g85kFUIxMXKDi2Hnz0MuyTizCUovJVT3ab9CAgUOlP2JbIrbO8PnXhdlVgHWcSxq+5K32dMuUjZL7582bRo9buC+7BBxrBDk8/L/CcvfvP4Dow1KFzxI7jFuOz8LzuGgtzGgl5bowxskcAibAMSXR3EN3UGLGIticjiuKNZJRFwt9AD/nn1ZOH/HLX/QiFY7Cv53/IIBFQvUSEtRzlzCKAn7WjMHx9hGgo050j97mNgs1uQp9vGeW8OAIaPidzOsPL2ISW6TGOpf6mSx1BsENkwbNsVJ2avFCi3yBGH26cOEWJBSnwBsmfcnSJbuQZFBBKARRaRMpXSm5qxMsjfbHUFHKtCnazb/xM/e52CFkbZl0M4jo2EHTlPFH8D+Oqo0b+Y43pMaFojaYx+mCnFImgl+3ArD+oMpazfzGlz6BQ2NetpNC8uy5AtP+8k75ZbUU+ZSiZPttyqQ/6PPCxC9H1UB0KEuWiTFQuiLoC1qeLR5+FDMgEsXPZCFu2hi/0WNXlQ+KHtlf5g3z3o0lz8YMHNAMDgArKRG3YPDQgT1iravTKlyduOu1GzIAGU+af30OO6NDSIFkdSu1PA9j4qTVNjdpgDu+OR5k5bOlJPqYVoVsZugkLAsILeIO6l9rygeJzTjG791RovaeeF7zaVGV/FsKtBD0hsa9Kg3WwI3+1IYnS3OPWPKxKiD5sHd9m
+    username: AgBLWJhYYenlLJQyyOFjibScElVtwT006b6QLTde1TZlLjqrLdw1PsH7rWAWfsCHbZJzRo/nWxIxiYWMAMQNTxco1wghBbalxWQsyhcreEPRgQJxRDKRf/+7gRVophUgrJ6Ej3EwDNGnEtdtCw+QIedXvCQtlt5MNzch+S/mxylhZF9CswpPDOEnoqbM5RELu8LUuYiThD5NNKFah4j/c92CZFVbtZzprUOLphUVWzGDde6krmJZpDhDSl4VwVbjPU700C0qrsJhGZlwDlXTwDXMH552X6qCh+GHeh1Ig6ll7npQSMlwFWsYyz0dRMYXkaASdrh4arhukzkTmjHXDtgIoiXqEdhjayZ0oIcSVgyzX0dK62wxWtYITPhREJkKSrLPs0vrz480qNiZ69gXKZiBSernyvwZ0w5oxlkMfMRQyUHUcpzfG1z94w9gh5GDvHS6r1hHH3Hndtt7owGbCtOtySUsrdeEiNG95uvI44vqpFc8RAzspYZ9HsiQnTu0Xg3hM40YRiAyFr4n/He0SMf1FQE7F4dPEv5zPK4/swAfq/n2DzpQDr/vhCnL+2y7VVG/pp+1Ox6qm5nhS0xmnlwDqkgFfTbUPPyvwY+oOBo0EDAYEY9a1CitlSD176FJomL4BP3KWB1OqgWpH3YwWBnI3QMKXKWd44Mt4Wh3ihJLhpzfLJQeBIhH1tu8ca4/hvs+pNA=
+  template:
+    metadata:
+      name: gitea-admin-secret
+      namespace: ops
 
 ---
 

ops/minio-auth.sh

@@ -0,0 +1,21 @@
+gen_password() { head -c 16 /dev/urandom | sha256sum | cut -d " " -f 1; }
+
+MINIO_ROOT_USER="minioadmin"
+MINIO_ROOT_PASSWORD=$(gen_password)
+
+kubectl create secret generic minio \
+    -n ops \
+   --from-literal=MINIO_ROOT_USER=${MINIO_ROOT_USER} \
+   --from-literal=MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD} \
+
+# cat <<EOF | ssh root@strix tee /etc/rancher/k3s/registries.yaml
+# mirrors:
+#   registry.ntwl.xyz:
+#     endpoint:
+#       - "https://registry.ntwl.xyz"
+# configs:
+#   "registry.ntwl.xyz":
+#     auth:
+#       username: ntr
+#       password: pw
+# EOF

surf/megastructure-surf.yaml

@@ -18,27 +18,58 @@ metadata:
   name: cssds-data
   namespace: surf
 spec:
-  storageClassName: zfs-fast
+  storageClassName: fast
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 50Gi
 
 ---
 
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: tf2ds-data
+  name: fastdl-maps
   namespace: surf
 spec:
-  storageClassName: zfs-fast
+  storageClassName: fast
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 200Gi
+
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cfg
+  namespace: surf
+data:
+  mapcycle.txt: |
+    surf_fortum_fix
+    surf_anzchamps
+    surf_andromeda
+    surf_boreas
+    surf_deathstar
+    surf_ebony
+    surf_fornax
+    surf_garden
+    surf_in_space
+    surf_kepler
+    surf_kitsune
+    surf_kitsune2
+    surf_lt_omnific
+    surf_pantheon
+    surf_utopia_njv
+    surf_nyx
+    surf_stonks
+    surf_serenity
+    surf_tendies
+    surf_zoomboys
+    surf_calzone
 
 ---
 
@@ -49,23 +80,30 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: megastructure-surf
+  name: cssds
   namespace: surf
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: megastructure-surf
+      app: cssds
   template:
     metadata:
       labels:
-        app: megastructure-surf
+        app: cssds
     spec:
+      initContainers:
+        - name: fix-permissions
+          image: busybox
+          command: ['sh', '-c', 'chown -R 1000:1000 /home/steam/cssds']
+          volumeMounts:
+            - name: cssds
+              mountPath: /home/steam/cssds
       containers:
-        - name: megastructure-surf
-          image: registry.ntwl.xyz/megastructure-surf
+        - name: cssds
+          image: registry.ntwl.xyz/megastructure-surf-cssds
           imagePullPolicy: Always
-          command: ["sleep", "100000000"]
+          # command: ["sleep", "100000000"]
           ports:
             - containerPort: 27015
             - containerPort: 27005
@@ -75,15 +113,22 @@ spec:
           volumeMounts:
             - name: cssds
               mountPath: /home/steam/cssds
-            - name: tf2ds
-              mountPath: /home/steam/tf2ds
+            - name: fastdl-maps
+              mountPath: /fastdl/maps
+              readOnly: true
+            - name: cfg
+              mountPath: /home/steam/cfg
+              readOnly: true
       volumes:
         - name: cssds
           persistentVolumeClaim:
             claimName: cssds-data
-        - name: tf2ds
+        - name: fastdl-maps
           persistentVolumeClaim:
-            claimName: tf2ds-data
+            claimName: fastdl-maps
+        - name: cfg
+          configMap:
+            name: cfg
 
 ---
 
@@ -94,22 +139,165 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: megastructure-surf
+  name: cssds
   namespace: surf
 spec:
   type: NodePort
   selector:
-    app: megastructure-surf
+    app: cssds
   ports:
     - name: game-port
       protocol: UDP
       port: 27015
       targetPort: 27015
       nodePort: 32015
+    - name: rcon
+      protocol: TCP
+      port: 27015
+      targetPort: 27015
+      nodePort: 32015
     - name: client-port
       protocol: UDP
       port: 27005
       targetPort: 27005
       nodePort: 32005
 
+---
+
+# -----------------------------------------------------------------------
+# MAP DOWNLOADER
+# -----------------------------------------------------------------------
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: mapsdl
+  namespace: surf
+spec:
+  schedule: "*/1 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: mapsdl
+              image: registry.ntwl.xyz/megastructure-surf-mapsdl:latest
+              imagePullPolicy: Always
+              command:
+                - "deno"
+                - "run"
+                - "-A"
+                - "mapsdl.ts"
+              env:
+                - name: MAPS_DIR
+                  value: "/maps"
+                - name: TEMP_DIR
+                  value: "/tmp/mapsdl"
+                - name: GOOGLE_APPLICATION_CREDENTIALS
+                  value: "/app/credentials/service-account.json"
+                - name: MAPS_LIST_FILE
+                  value: "/cfg/mapcycle.txt"
+              volumeMounts:
+                - name: fastdl-maps
+                  mountPath: /maps
+                - name: credentials
+                  mountPath: /app/credentials
+                  readOnly: true
+                - name: cfg
+                  mountPath: /cfg
+                  readOnly: true
+          volumes:
+            - name: fastdl-maps
+              persistentVolumeClaim:
+                claimName: fastdl-maps
+            - name: credentials
+              secret:
+                secretName: mapsdl-credentials
+            - name: cfg
+              configMap:
+                name: cfg
+
+---
+
+# -----------------------------------------------------------------------
+# FASTDL
+# -----------------------------------------------------------------------
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fastdl
+  namespace: surf
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: fastdl
+  template:
+    metadata:
+      labels:
+        app: fastdl
+    spec:
+      containers:
+        - name: fastdl
+          image: registry.ntwl.xyz/megastructure-surf-fastdl
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: fastdl-maps
+              mountPath: /srv/maps
+              readOnly: true
+      volumes:
+        - name: fastdl-maps
+          persistentVolumeClaim:
+            claimName: fastdl-maps
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: fastdl
+  namespace: surf
+spec:
+  selector:
+    app: fastdl
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: 80
+
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: fastdl
+  namespace: surf
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  ingressClassName: haproxy
+  tls:
+  - hosts:
+    - fastdl.megastructure.surf
+    secretName: fastdl-megastructure-surf-tls
+  rules:
+  - host: fastdl.megastructure.surf
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: fastdl
+            port:
+              number: 80
+
 ---