gitea 28

media/jellyseerr.yaml

@@ -84,7 +84,7 @@ spec:
   - secretName: jellyseerr-ingress
     hosts:
     - jellyseerr.ntwl.xyz
-    - get.ntwl.xyz
+    - js.ntwl.xyz
   rules:
     - host: jellyseerr.ntwl.xyz
       http:
@@ -96,7 +96,7 @@ spec:
                   name: web
             path: /
             pathType: Prefix
-    - host: get.ntwl.xyz
+    - host: js.ntwl.xyz
       http:
         paths:
           - backend:

ops/git.yaml

@@ -1,18 +1,5 @@
 ---
 
-apiVersion: v1
-kind: Secret
-metadata:
-  name: gitea-admin-secret
-  namespace: ops
-type: Opaque
-stringData:
-  username: ntr
-  password: "REDACTED"
-  email: "ntr@strix.systems"
-
----
-
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
@@ -28,36 +15,6 @@ spec:
 
 ---
 
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: gitea-redis
-  namespace: ops
-spec:
-  storageClassName: fast
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 4Gi
-
----
-
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: gitea-pg
-  namespace: ops
-spec:
-  storageClassName: fast
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 4Gi
-
----
-
 apiVersion: helm.cattle.io/v1
 kind: HelmChart
 metadata:
@@ -66,9 +23,13 @@ metadata:
 spec:
   repo: https://dl.gitea.com/charts/
   chart: gitea
+  version: 12.7.0
   targetNamespace: ops
   valuesContent: |-
 
+    image:
+      tag: "28.0.0"
+
     ingress:
       enabled: true
       className: haproxy
@@ -95,27 +56,33 @@ spec:
         port: 60022
         externalTrafficPolicy: Local
 
-    redis-cluster:
+    valkey-cluster:
       enabled: false
 
-    redis:
+    valkey:
       enabled: true
-      persistence:
-        enabled: true
-        existingClaim: gitea-redis
+      architecture: standalone
+      primary:
+        persistence:
+          enabled: true
+          storageClass: zfs-fast
+          size: 8Gi
 
     postgresql:
       enabled: true
-      persistence:
-        enabled: true
-        existingClaim: gitea-pg
+      primary:
+        persistence:
+          enabled: true
+          storageClass: zfs-fast
+          size: 10Gi
 
     postgresql-ha:
       enabled: false
 
     persistence:
       enabled: true
-      existingClaim: gitea-data
+      create: false
+      claimName: gitea-data
 
     gitea:
       config:
@@ -124,7 +91,12 @@ spec:
         indexer:
           ISSUE_INDEXER_TYPE: bleve
           REPO_INDEXER_ENABLED: true
+        audit:
+          RECORD_OUTPUT: database
+          RETENTION_DAYS: 120
         server:
           SSH_PORT: 60022
+          LFS_START_SERVER: true
+          LFS_ALLOW_PURE_SSH: true
       admin:
-        existingSecret: gitea-admin-secret
+        existingSecret: gitea-admin-secret

ops/minio-auth.sh

@@ -0,0 +1,21 @@
+gen_password() { head -c 16 /dev/urandom | sha256sum | cut -d " " -f 1; }
+
+MINIO_ROOT_USER="minioadmin"
+MINIO_ROOT_PASSWORD=$(gen_password)
+
+kubectl create secret generic minio \
+    -n ops \
+   --from-literal=MINIO_ROOT_USER=${MINIO_ROOT_USER} \
+   --from-literal=MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD} \
+
+# cat <<EOF | ssh root@strix tee /etc/rancher/k3s/registries.yaml
+# mirrors:
+#   registry.ntwl.xyz:
+#     endpoint:
+#       - "https://registry.ntwl.xyz"
+# configs:
+#   "registry.ntwl.xyz":
+#     auth:
+#       username: ntr
+#       password: pw
+# EOF

surf/megastructure-surf.yaml

@@ -18,27 +18,58 @@ metadata:
   name: cssds-data
   namespace: surf
 spec:
-  storageClassName: zfs-fast
+  storageClassName: fast
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 50Gi
 
 ---
 
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: tf2ds-data
+  name: fastdl-maps
   namespace: surf
 spec:
-  storageClassName: zfs-fast
+  storageClassName: fast
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: 200Gi
+
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cfg
+  namespace: surf
+data:
+  mapcycle.txt: |
+    surf_fortum_fix
+    surf_anzchamps
+    surf_andromeda
+    surf_boreas
+    surf_deathstar
+    surf_ebony
+    surf_fornax
+    surf_garden
+    surf_in_space
+    surf_kepler
+    surf_kitsune
+    surf_kitsune2
+    surf_lt_omnific
+    surf_pantheon
+    surf_utopia_njv
+    surf_nyx
+    surf_stonks
+    surf_serenity
+    surf_tendies
+    surf_zoomboys
+    surf_calzone
 
 ---
 
@@ -49,23 +80,30 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: megastructure-surf
+  name: cssds
   namespace: surf
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: megastructure-surf
+      app: cssds
   template:
     metadata:
       labels:
-        app: megastructure-surf
+        app: cssds
     spec:
+      initContainers:
+        - name: fix-permissions
+          image: busybox
+          command: ['sh', '-c', 'chown -R 1000:1000 /home/steam/cssds']
+          volumeMounts:
+            - name: cssds
+              mountPath: /home/steam/cssds
       containers:
-        - name: megastructure-surf
-          image: registry.ntwl.xyz/megastructure-surf
+        - name: cssds
+          image: registry.ntwl.xyz/megastructure-surf-cssds
           imagePullPolicy: Always
-          command: ["sleep", "100000000"]
+          # command: ["sleep", "100000000"]
           ports:
             - containerPort: 27015
             - containerPort: 27005
@@ -75,15 +113,22 @@ spec:
           volumeMounts:
             - name: cssds
               mountPath: /home/steam/cssds
-            - name: tf2ds
-              mountPath: /home/steam/tf2ds
+            - name: fastdl-maps
+              mountPath: /fastdl/maps
+              readOnly: true
+            - name: cfg
+              mountPath: /home/steam/cfg
+              readOnly: true
       volumes:
         - name: cssds
           persistentVolumeClaim:
             claimName: cssds-data
-        - name: tf2ds
+        - name: fastdl-maps
           persistentVolumeClaim:
-            claimName: tf2ds-data
+            claimName: fastdl-maps
+        - name: cfg
+          configMap:
+            name: cfg
 
 ---
 
@@ -94,22 +139,165 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: megastructure-surf
+  name: cssds
   namespace: surf
 spec:
   type: NodePort
   selector:
-    app: megastructure-surf
+    app: cssds
   ports:
     - name: game-port
       protocol: UDP
       port: 27015
       targetPort: 27015
       nodePort: 32015
+    - name: rcon
+      protocol: TCP
+      port: 27015
+      targetPort: 27015
+      nodePort: 32015
     - name: client-port
       protocol: UDP
       port: 27005
       targetPort: 27005
       nodePort: 32005
 
+---
+
+# -----------------------------------------------------------------------
+# MAP DOWNLOADER
+# -----------------------------------------------------------------------
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: mapsdl
+  namespace: surf
+spec:
+  schedule: "*/1 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: mapsdl
+              image: registry.ntwl.xyz/megastructure-surf-mapsdl:latest
+              imagePullPolicy: Always
+              command:
+                - "deno"
+                - "run"
+                - "-A"
+                - "mapsdl.ts"
+              env:
+                - name: MAPS_DIR
+                  value: "/maps"
+                - name: TEMP_DIR
+                  value: "/tmp/mapsdl"
+                - name: GOOGLE_APPLICATION_CREDENTIALS
+                  value: "/app/credentials/service-account.json"
+                - name: MAPS_LIST_FILE
+                  value: "/cfg/mapcycle.txt"
+              volumeMounts:
+                - name: fastdl-maps
+                  mountPath: /maps
+                - name: credentials
+                  mountPath: /app/credentials
+                  readOnly: true
+                - name: cfg
+                  mountPath: /cfg
+                  readOnly: true
+          volumes:
+            - name: fastdl-maps
+              persistentVolumeClaim:
+                claimName: fastdl-maps
+            - name: credentials
+              secret:
+                secretName: mapsdl-credentials
+            - name: cfg
+              configMap:
+                name: cfg
+
+---
+
+# -----------------------------------------------------------------------
+# FASTDL
+# -----------------------------------------------------------------------
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fastdl
+  namespace: surf
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: fastdl
+  template:
+    metadata:
+      labels:
+        app: fastdl
+    spec:
+      containers:
+        - name: fastdl
+          image: registry.ntwl.xyz/megastructure-surf-fastdl
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - name: fastdl-maps
+              mountPath: /srv/maps
+              readOnly: true
+      volumes:
+        - name: fastdl-maps
+          persistentVolumeClaim:
+            claimName: fastdl-maps
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: fastdl
+  namespace: surf
+spec:
+  selector:
+    app: fastdl
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: 80
+
+---
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: fastdl
+  namespace: surf
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  ingressClassName: haproxy
+  tls:
+  - hosts:
+    - fastdl.megastructure.surf
+    secretName: fastdl-megastructure-surf-tls
+  rules:
+  - host: fastdl.megastructure.surf
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: fastdl
+            port:
+              number: 80
+
 ---