Update docker-stacks/app-server/infisical.yml

.vscode/settings.json

@@ -1,5 +0,0 @@
-{
-    "yaml.schemas": {
-        "kubernetes://schema/traefik.io/v1alpha1%40ingressroute": "file:///mnt/c/Users/Admin/source/repos/mngomalab/k3s/stacks/droneci.yml"
-    }
-}

docker-stacks/app-server/docuseal.yml

@@ -0,0 +1,24 @@
+services:
+  docuseal:
+    image: docuseal/docuseal
+    restart: always
+    environment:
+      - DATABASE_URL=${DATABASE_URL}
+      - PORT=3000
+      - HOST=${PUBLIC_URL}
+      - SECRET_KEY_BASE=${SECRET_KEY_BASE}
+      - RAILS_ENV=production
+      - SKIP_MIGRATION_VALIDATION=true
+      - SMTP_USERNAME=${SMTP_USERNAME}
+      - SMTP_PASSWORD=${SMTP_PASSWORD}
+      - SMTP_ADDRESS=${SMTP_ADDRESS}      
+      - SMTP_FROM=${SMTP_FROM}
+      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
+      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
+      - AWS_REGION=${AWS_REGION}
+      - S3_ATTACHMENTS_BUCKET=${S3_ATTACHMENTS_BUCKET}
+
+    ports:
+      - "3001:3000"
+    volumes:
+      - ./docuseal_data:/data

docker-stacks/app-server/droneci.yml

@@ -0,0 +1,43 @@
+services:
+  drone:
+    image: drone/drone:2
+    container_name: drone
+    ports:
+      - "8080:80"
+    environment:
+      - DRONE_GITEA_SERVER=${GITEA_ADDRESS}
+      - DRONE_GITEA_CLIENT_ID=${DRONE_GITEA_CLIENT_ID}
+      - DRONE_GITEA_CLIENT_SECRET=${DRONE_GITEA_CLIENT_SECRET}
+      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
+      - DRONE_SERVER_HOST=${DRONE_SERVER_ADDRESS}
+      - DRONE_SERVER_PROTO=${DRONE_SERVER_PROTO}
+      - DRONE_USER_CREATE=username:drone,admin:true
+    volumes:
+      - drone-data:/data
+    restart: unless-stopped
+    networks:
+      - droneci-network
+
+  drone-runner:
+    image: drone/drone-runner-docker:1
+    container_name: drone-runner
+    environment:
+      - DRONE_RPC_PROTO=http
+      - DRONE_RPC_HOST=drone
+      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
+      - DRONE_RUNNER_CAPACITY=2
+      - DRONE_RUNNER_NAME=local-runner
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    depends_on:
+      - drone
+    restart: unless-stopped
+    networks:
+      - droneci-network
+
+volumes:
+  drone-data:
+
+networks:
+  droneci-network:
+    driver: bridge

docker-stacks/app-server/infisical.yml

@@ -0,0 +1,56 @@
+version: "3"
+
+services:
+  backend:
+    container_name: infisical-backend
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+    image: infisical/infisical:latest # PIN THIS TO A SPECIFIC TAG
+    pull_policy: always
+    env_file: .env
+    ports:
+      - 80:8080
+    environment:
+      - NODE_ENV=production
+    networks:
+      - infisical
+
+  redis:
+    image: redis
+    container_name: infisical-dev-redis
+    env_file: .env
+    restart: always
+    environment:
+      - ALLOW_EMPTY_PASSWORD=yes
+    networks:
+      - infisical
+    volumes:
+      - redis_data:/data
+
+  db:
+    container_name: infisical-db
+    image: postgres:14-alpine
+    restart: always
+    env_file: .env
+    volumes:
+      - pg_data:/var/lib/postgresql/data
+    networks:
+      - infisical
+    healthcheck:
+      test: "pg_isready --username=${POSTGRES_USER} && psql --username=${POSTGRES_USER} --list"
+      interval: 5s
+      timeout: 10s
+      retries: 10
+
+volumes:
+  pg_data:
+    driver: local
+  redis_data:
+    driver: local
+
+networks:
+  infisical:

docker-stacks/app-server/penpot.yml

@@ -0,0 +1,135 @@
+x-flags: &penpot-flags
+  # Merged disable-sandbox into the flags array to protect the headless engine
+  # PENPOT_FLAGS: disable-email-verification enable-smtp enable-prepl-server disable-secure-session-cookies enable-mcp disable-sandbox enable-login-with-password
+  PENPOT_FLAGS: disable-email-verification enable-smtp enable-prepl-server disable-secure-session-cookies disable-sandbox enable-login-with-password
+
+x-uri: &penpot-public-uri
+  PENPOT_PUBLIC_URI: ${PENPOT_PUBLIC_URI}
+
+x-body-size: &penpot-http-body-size
+  PENPOT_HTTP_SERVER_MAX_BODY_SIZE: 367001600
+  PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE: 367001600
+
+x-secret-key: &penpot-secret-key
+  PENPOT_SECRET_KEY: ${PENPOT_SECRET_KEY}
+
+networks:
+  penpot-net:
+    driver: bridge
+
+volumes:
+  penpot_assets:
+  penpot_postgres_v15:
+
+services:
+  penpot-frontend:
+    image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
+    restart: always
+    ports:
+      - "8084:8080"
+    volumes:
+      - penpot_assets:/opt/data/assets
+    depends_on:
+      - penpot-backend
+      - penpot-exporter
+      - penpot-mcp
+    networks:
+      - penpot-net
+    environment:
+      <<: [*penpot-flags, *penpot-http-body-size, *penpot-public-uri]
+
+  penpot-backend:
+    image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
+    restart: always
+    volumes:
+      - penpot_assets:/opt/data/assets
+    networks:
+      - penpot-net
+    ports:
+      - "6060:6060"
+    depends_on:
+      penpot-postgres:
+        condition: service_healthy # Wait for database stability
+      penpot-valkey:
+        condition: service_healthy # Wait for internal caching layer stability
+    environment:
+      << : [*penpot-flags, *penpot-public-uri, *penpot-http-body-size, *penpot-secret-key]
+      
+      # Security Handshake Key for internal Exporter validation routines
+      PENPOT_EXPORTER_SECRET_KEY: ${PENPOT_EXPORTER_SECRET_KEY}
+
+      ## Local Internal Database connection parameters
+      PENPOT_DATABASE_URI: postgresql://penpot-postgres/penpot
+      PENPOT_DATABASE_USERNAME: penpot
+      PENPOT_DATABASE_PASSWORD: penpot
+
+      ## Local Caching Layer connection parameter
+      PENPOT_REDIS_URI: redis://penpot-valkey/0
+
+      ## Storage Settings
+      PENPOT_OBJECTS_STORAGE_BACKEND: fs
+      PENPOT_OBJECTS_STORAGE_FS_DIRECTORY: /opt/data/assets
+
+      ## Telemetry & Optional settings
+      PENPOT_TELEMETRY_ENABLED: "false"
+
+  penpot-mcp:
+    image: "penpotapp/mcp:${PENPOT_VERSION:-latest}"
+    restart: always
+    networks:
+      - penpot-net
+
+  penpot-exporter:
+    image: "penpotapp/exporter:${PENPOT_VERSION:-latest}"
+    restart: always
+    shm_size: '2gb' # Protects Puppeteer rendering processes from memory crashes
+    depends_on:
+      penpot-valkey:
+        condition: service_healthy
+    networks:
+      - penpot-net
+    environment:
+      << : [*penpot-secret-key]
+      PENPOT_EXPORTER_SECRET_KEY: ${PENPOT_EXPORTER_SECRET_KEY}
+      PENPOT_PUBLIC_URI: http://penpot-frontend:8080
+
+      ## Local Caching Layer connections for the exporter sub-engine
+      PENPOT_REDIS_URI: redis://penpot-valkey/0
+      PENPOT_REDIS_URL: redis://penpot-valkey/0
+      PENPOT_FLAGS: disable-sandbox
+
+  # Integrated isolated Database Service
+  penpot-postgres:
+    image: "postgres:15"
+    restart: always
+    stop_signal: SIGINT
+    networks:
+      - penpot-net
+    volumes:
+      - penpot_postgres_v15:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_INITDB_ARGS=--data-checksums
+      - POSTGRES_DB=penpot
+      - POSTGRES_USER=penpot
+      - POSTGRES_PASSWORD=penpot
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U penpot"]
+      interval: 2s
+      timeout: 10s
+      retries: 5
+      start_period: 2s
+
+  # Integrated isolated Caching Engine (Valkey drop-in for Redis)
+  penpot-valkey:
+    image: valkey/valkey:8.1
+    restart: always
+    networks:
+      - penpot-net
+    environment:
+      - VALKEY_EXTRA_FLAGS=--maxmemory 128mb --maxmemory-policy volatile-lfu
+    healthcheck:
+      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
+      interval: 1s
+      timeout: 3s
+      retries: 5
+      start_period: 3s

docker-stacks/khongisa.co.za/config/traefik/dynamic_config.yml

@@ -1,91 +0,0 @@
-http:
-  middlewares:
-    nexus-buffer:
-      buffering:
-        maxRequestBodyBytes: 0
-        memRequestBodyBytes: 2097152 # 2MB
-    crowdsec:
-      plugin:
-        crowdsec:
-          crowdsecAppsecBodyLimit: 0
-    badger:
-      plugin:
-        badger:
-          disableForwardAuth: true
-    redirect-to-https:
-      redirectScheme:
-        scheme: https
-
-  routers:
-    nexus-docker-router:
-      rule: "Host(`nexus.khongisa.co.za`) && PathPrefix(`/v2`)"
-      service: api-service # Or whichever service points to Pangolin port 3000/3001
-      entryPoints:
-        - websecure
-      middlewares:
-        - nexus-buffer
-        - badger
-      tls:
-        certResolver: letsencrypt
-    # HTTP to HTTPS redirect router
-    main-app-router-redirect:
-      rule: "Host(`khongisa.co.za`)"
-      service: next-service
-      entryPoints:
-        - web
-      middlewares:
-        - redirect-to-https
-        - badger
-
-    # Next.js router (handles everything except API and WebSocket paths)
-    next-router:
-      rule: "Host(`khongisa.co.za`) && !PathPrefix(`/api/v1`)"
-      service: next-service
-      entryPoints:
-        - websecure
-      middlewares:
-        - badger
-      tls:
-        certResolver: letsencrypt
-
-    # API router (handles /api/v1 paths)
-    api-router:
-      rule: "Host(`khongisa.co.za`) && PathPrefix(`/api/v1`)"
-      service: api-service
-      entryPoints:
-        - websecure
-      middlewares:
-        - badger
-      tls:
-        certResolver: letsencrypt
-
-    # WebSocket router
-    ws-router:
-      rule: "Host(`khongisa.co.za`)"
-      service: api-service
-      entryPoints:
-        - websecure
-      middlewares:
-        - badger
-      tls:
-        certResolver: letsencrypt
-
-  services:
-    next-service:
-      loadBalancer:
-        servers:
-          - url: "http://pangolin:3002"  # Next.js server
-
-    api-service:
-      loadBalancer:
-        servers:
-          - url: "http://pangolin:3000"  # API/WebSocket server
-
-tcp:
-  serversTransports:
-    pp-transport-v1:
-      proxyProtocol:
-        version: 1
-    pp-transport-v2:
-      proxyProtocol:
-        version: 2

kubernetes-templates/drawio.yml

@@ -0,0 +1,73 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: drawio
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: drawio
+  namespace: drawio
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: drawio
+  template:
+    metadata:
+      labels:
+        app: drawio
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
+      containers:
+        - name: drawio
+          image: jgraph/drawio:latest
+          ports:
+            - containerPort: 8080
+          env:
+            - name: DRAWIO_SELF_CONTAINED
+              value: "1"
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: drawio-service
+  namespace: drawio
+spec:
+  type: ClusterIP 
+  selector:
+    app: drawio
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: drawio-web
+  namespace: drawio
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`drawio.khongisa.co.za`) 
+      kind: Rule
+      services:
+        - name: drawio-service
+          port: 80

kubernetes-templates/droneci.yml

@@ -1,4 +1,4 @@
---- 
+---
 apiVersion: v1
 kind: Namespace
 metadata:
@@ -45,7 +45,7 @@ spec:
   storageClassName: nfs-storage
   resources:
     requests:
-      storage: 5Gi
+      storage: 10Gi
 ---
 apiVersion: v1
 kind: Secret
@@ -90,11 +90,10 @@ spec:
               cpu: "500m"
               memory: "512Mi"
           env:
-            # FIX: Explicitly bind the address to bypass port validation logic
             - name: DRONE_SERVER_ADDR
               value: ":80"
             - name: DRONE_SERVER_HOST
-              value: "drone.khongisa.co.za"
+              value: "droneci.khongisa.co.za"
             - name: DRONE_SERVER_PROTO
               value: "https"
             - name: DRONE_GITEA_SERVER
@@ -162,11 +161,25 @@ metadata:
   name: drone-server
   namespace: drone-ci
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: drone-server
   ports:
     - name: http
       port: 80
       targetPort: 80
-      nodePort: 31001
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: drone-web
+  namespace: drone-ci
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`droneci.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: drone-server
+          port: 80

kubernetes-templates/filebrowser.yml

@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: Namespace
 metadata:
@@ -10,7 +11,6 @@ metadata:
   namespace: filebrowser
 type: Opaque
 data:
-  # Value: Blackstar2@home
   admin-password: QmxhY2tzdGFyMkBob21l
 ---
 apiVersion: v1
@@ -61,11 +61,9 @@ spec:
                     operator: DoesNotExist
       containers:
         - name: filebrowser
-          image: filebrowser/filebrowser:v2.30.0 # Using a specific version for stability
+          image: filebrowser/filebrowser:v2.30.0
           ports:
             - containerPort: 80
-          # We remove 'command' and 'args' that rely on /bin/sh
-          # and use the native environment variables
           env:
             - name: FB_DATABASE
               value: "/config/database.db"
@@ -94,7 +92,7 @@ metadata:
   name: filebrowser-service
   namespace: filebrowser
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: filebrowser
   ports:
@@ -102,4 +100,18 @@ spec:
       protocol: TCP
       port: 80
       targetPort: 80
-      nodePort: 33003
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: filebrowser-web
+  namespace: filebrowser
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`drive.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: filebrowser-service
+          port: 80

kubernetes-templates/garage.yml

@@ -0,0 +1,207 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: garage
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: garage-secrets
+  namespace: garage
+type: Opaque
+data:
+  GARAGE_RPC_SECRET: "Yjk2YzRjZDE2ZDY4NDFjYTZhZTEwNDQxOGJiNTIxMDc4MTYyMzkyMzk4OGZiMWRmNWI0MmQzMmQzYmQwMGIwZQ=="
+  GARAGE_ADMIN_TOKEN: "c1dHNW8yc2E5eEp4NUVyM0NnWHF2T1VTSFhvZkZhejBwRWoyRzlyb1E1aERSRUdRVlZvQUZTRXY4aU1MUTZxTw=="
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: garage-config
+  namespace: garage
+data:
+  garage.toml: |
+    metadata_dir = "/var/lib/garage/meta"
+    data_dir = "/var/lib/garage/data"
+    replication_factor = 1
+
+    rpc_bind_addr = "[::]:3901"
+    rpc_public_addr = "garage.garage.svc.cluster.local:3901"
+
+    [s3_api]
+    s3_region = "garage"
+    api_bind_addr = "[::]:3900"
+    # Leaving this blank removes the hostname restriction on the API port.
+    # This allows internal pods to use 'garage.garage.svc.cluster.local' AND 
+    # external apps to use '192.168.1.177:30900' or 's3.khongisa.co.za' without signature errors.
+    root_domain = "" 
+
+    [admin]
+    api_bind_addr = "[::]:3903"
+    admin_token = "sWG5o2sa9xJx5Er3CgXqvOUSHXofFaz0pEj2G9roQ5hDREGQVVoAFSEv8iMLQ6qO"
+
+    [s3_web]
+    bind_addr = "[::]:3902"
+    # This enforces that public web traffic matches 'test-bucket.s3.khongisa.co.za'
+    root_domain = ".cdn.khongisa.co.za"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: garage-data-pvc
+  namespace: garage
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: nfs-storage
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: garage
+  namespace: garage
+spec:
+  serviceName: "garage"
+  replicas: 1
+  selector:
+    matchLabels:
+      app: garage
+  template:
+    metadata:
+      labels:
+        app: garage
+    spec:
+      securityContext:
+        fsGroup: 999 
+      containers:
+        - name: garage
+          image: dxflrs/garage:v2.3.0
+          args: ["/garage", "server"]
+          env:
+            - name: GARAGE_RPC_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: garage-secrets
+                  key: GARAGE_RPC_SECRET
+          ports:
+            - containerPort: 3900
+              name: s3-api
+            - containerPort: 3903
+              name: admin-api
+            - containerPort: 3902
+              name: s3-web
+          volumeMounts:
+            - name: config
+              mountPath: /etc/garage.toml
+              subPath: garage.toml
+            - name: data
+              mountPath: /var/lib/garage
+      volumes:
+        - name: config
+          configMap:
+            name: garage-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: garage-data-pvc
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: garage-ui
+  namespace: garage
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: garage-ui
+  template:
+    metadata:
+      labels:
+        app: garage-ui
+    spec:
+      containers:
+        - name: garage-ui
+          image: khairul169/garage-webui:latest
+          ports:
+            - containerPort: 3909
+          env:
+            - name: API_BASE_URL
+              value: "http://garage:3903"
+            - name: S3_ENDPOINT_URL
+              value: "http://garage:3900"
+            - name: API_ADMIN_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: garage-secrets
+                  key: GARAGE_ADMIN_TOKEN
+          volumeMounts:
+            - name: config
+              mountPath: /etc/garage.toml
+              subPath: garage.toml
+      volumes:
+        - name: config
+          configMap:
+            name: garage-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage
+  namespace: garage
+spec:
+  selector:
+    app: garage
+  ports:
+    - name: s3-api
+      port: 3900
+    - name: admin-api
+      port: 3903
+    - name: s3-web
+      port: 3902
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-ui
+  namespace: garage
+spec:
+  selector:
+    app: garage-ui
+  ports:
+    - name: http
+      port: 80
+      targetPort: 3909
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-external-nodeport
+  namespace: garage
+spec:
+  type: NodePort
+  selector:
+    app: garage
+  ports:
+    - name: s3-api-external
+      port: 3900
+      targetPort: 3900
+      nodePort: 30900    
+    - name: s3-web-external
+      port: 3902
+      targetPort: 3902
+      nodePort: 30902
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: garage-ui-external
+  namespace: garage
+spec:
+  entryPoints: ["websecure"]
+  routes:
+    - match: Host(`s3.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: garage-ui
+          port: 80

kubernetes-templates/headlamp.yml

@@ -1,3 +1,4 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -16,7 +17,6 @@ spec:
       containers:
       - name: headlamp
         image: ghcr.io/headlamp-k8s/headlamp:latest
-        # We only use -in-cluster. No other flags allowed.
         args:
           - "-in-cluster"
         ports:
@@ -29,11 +29,25 @@ metadata:
   name: headlamp
   namespace: kube-system
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app.kubernetes.io/name: headlamp
   ports:
     - protocol: TCP
       port: 80
       targetPort: 4466
-      nodePort: 30001
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: headlamp-web
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`cluster.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: headlamp
+          port: 80

kubernetes-templates/mealie-recipes.yml

@@ -0,0 +1,122 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mealie
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mealie-secrets
+  namespace: mealie
+type: Opaque
+data:
+  POSTGRES_PASSWORD: RmJsV0xPTlM4alVjNUE=
+  SMTP_PASSWORD: XylSUURvK2ZiXig0eF1eLg==
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mealie-config
+  namespace: mealie
+data:
+  BASE_URL: "https://mealie.khongisa.co.za"
+  TRUSTED_PROXIES: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.255.58.144"
+  ALLOW_SIGNUP: "true"
+  PUID: "1000"
+  PGID: "1000"
+  TZ: "Africa/Johannesburg"
+  SMTP_HOST: "mail.mngoma.africa"
+  SMTP_PORT: "465"
+  SMTP_FROM_NAME: "Mealie Recipes"
+  SMTP_FROM_EMAIL: "mealie@mngoma.africa"
+  SMTP_USER: "mealie@mngoma.africa"
+  SMTP_AUTH_STRATEGY: "SSL"
+  DB_ENGINE: "postgres"
+  POSTGRES_USER: "mealie_user"
+  POSTGRES_DB: "mealie"
+  POSTGRES_SERVER: "192.168.1.170"
+  POSTGRES_PORT: "5432"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mealie-data-pvc
+  namespace: mealie
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mealie
+  namespace: mealie
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mealie
+  template:
+    metadata:
+      labels:
+        app: mealie
+      annotations:
+        last-updated: "2026-04-24T17:52:00"
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
+      containers:
+        - name: mealie
+          image: ghcr.io/mealie-recipes/mealie:latest
+          ports:
+            - containerPort: 9000
+          envFrom:
+            - configMapRef:
+                name: mealie-config
+            - secretRef:
+                name: mealie-secrets
+          volumeMounts:
+            - name: mealie-data
+              mountPath: /app/data
+      volumes:
+        - name: mealie-data
+          persistentVolumeClaim:
+            claimName: mealie-data-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mealie-service
+  namespace: mealie
+spec:
+  type: ClusterIP
+  selector:
+    app: mealie
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 9000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mealie-web
+  namespace: mealie
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`mealie.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: mealie-service
+          port: 80

kubernetes-templates/n8n.yml

@@ -0,0 +1,200 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: n8n
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: n8n-secrets
+  namespace: n8n
+type: Opaque
+data:
+  # Base64 values from your previous manifest
+  N8N_ADMIN_USER: a2h3ZXpp
+  N8N_ADMIN_PASSWORD: cWVaVllWQ20wOEhaWmU=
+  POSTGRES_PASSWORD: RmJsV0xPTlM4alVjNUE=
+  N8N_ENCRYPTION_KEY: Tm90U2VjcmV0S2V5MTIzIQ== 
+  N8N_TASKS_RUNNER_AUTH_TOKEN: bXktc2hhcmVkLXNlY3JldC10b2tlbi0xMjM=
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: n8n-config
+  namespace: n8n
+data:
+  N8N_HOST: "n8n.khongisa.co.za"
+  N8N_PROTOCOL: "https"
+  NODE_ENV: "production"
+  WEBHOOK_URL: "https://n8n.khongisa.co.za/"
+  GENERIC_TIMEZONE: "Africa/Johannesburg"
+  DB_TYPE: "postgresdb"
+  DB_POSTGRESDB_HOST: "n8n-db-service"
+  DB_POSTGRESDB_PORT: "5432"
+  DB_POSTGRESDB_DATABASE: "n8n_db"
+  DB_POSTGRESDB_USER: "n8n_user"
+  N8N_PROXY_HOPS: "1"
+  # DEFINITIVE FIX: Force n8n to listen on all interfaces
+  N8N_LISTEN_ADDRESS: "0.0.0.0"
+  N8N_PORT: "5678"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-data-pvc
+  namespace: n8n
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-db-pvc
+  namespace: n8n
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 10Gi
+---
+# Database Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n-db
+  namespace: n8n
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: n8n-db
+  template:
+    metadata:
+      labels:
+        app: n8n-db
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:14-alpine
+          env:
+            - name: POSTGRES_USER
+              value: "n8n_user"
+            - name: POSTGRES_DB
+              value: "n8n_db"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: n8n-secrets
+                  key: POSTGRES_PASSWORD
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: db-storage
+              mountPath: /var/lib/postgresql/data
+      volumes:
+        - name: db-storage
+          persistentVolumeClaim:
+            claimName: n8n-db-pvc
+---
+# Database Internal Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: n8n-db-service
+  namespace: n8n
+spec:
+  ports:
+    - port: 5432
+  selector:
+    app: n8n-db
+---
+# n8n Application Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n
+  namespace: n8n
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: n8n-app # Standardized label selector
+  template:
+    metadata:
+      labels:
+        app: n8n-app # Matches selector and service
+    spec:
+      containers:
+        - name: n8n
+          image: docker.n8n.io/n8nio/n8n:latest
+          ports:
+            - containerPort: 5678
+            - containerPort: 5679 # Explicitly open the Task Broker port
+          envFrom:
+            - configMapRef:
+                name: n8n-config
+          env:
+            # DEFINITIVE FIX: Align communication between main process and Task Runner
+            - name: N8N_TASKS_RUNNER_BROKER_HOST
+              value: "127.0.0.1"
+            - name: N8N_TASKS_RUNNER_BROKER_PORT
+              value: "5679"
+            - name: N8N_TASKS_RUNNER_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: n8n-secrets
+                  key: N8N_TASKS_RUNNER_AUTH_TOKEN
+            # Database and Admin overrides
+            - name: DB_POSTGRESDB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: n8n-secrets
+                  key: POSTGRES_PASSWORD
+            - name: N8N_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: n8n-secrets
+                  key: N8N_ENCRYPTION_KEY
+            - name: N8N_USER_MANAGEMENT_ADMIN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: n8n-secrets
+                  key: N8N_ADMIN_USER
+            - name: N8N_USER_MANAGEMENT_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: n8n-secrets
+                  key: N8N_ADMIN_PASSWORD
+            - name: N8N_SECURE_COOKIE
+              value: "false"
+            - name: N8N_COOKIES_SAME_SITE
+              value: "lax"
+            - name: N8N_PROXY_HOPS
+              value: "1"
+          volumeMounts:
+            - name: n8n-data
+              mountPath: /home/node/.n8n
+      volumes:
+        - name: n8n-data
+          persistentVolumeClaim:
+            claimName: n8n-data-pvc
+---
+# NodePort Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: n8n-service
+  namespace: n8n
+spec:
+  type: NodePort
+  selector:
+    app: n8n-app # Correctly targets the refactored Deployment labels
+  ports:
+    - protocol: TCP
+      port: 5678
+      targetPort: 5678
+      nodePort: 30567

kubernetes-templates/nexus.yml

@@ -24,8 +24,10 @@ metadata:
   namespace: nexus
 type: Opaque
 data:
+  # Contains khongisa-key-2026
   nexus.secrets.json: ewogICJhY3RpdmUiOiAia2hvbmdpc2Eta2V5LTIwMjYiLAogICJrZXlzIjogWwogICAgewogICAgICAiaWQiOiAia2hvbmdpc2Eta2V5LTIwMjYiLAogICAgICAia2V5IjogIk5tTmhZMll3TkdNMUltVXdOVGt4WkROa1l6a3habVk1WVRJek5UWTVOalE9IgogICAgfQogIF0KfQo=
   postgres-password: TWd6dUxVakZianA5ZjQ=
+  redis-password: NjI4akZL 
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -37,6 +39,8 @@ data:
   POSTGRES_PORT: "5432"
   POSTGRES_USER: "nexus"
   POSTGRES_DBNAME: "nexus"
+  REDIS_HOST: "redis-service.redis.svc.cluster.local"
+  REDIS_PORT: "6379"
   JVM_PARAMS: "-Xms2g -Xmx2g -XX:MaxDirectMemorySize=2g -Dnexus.secrets.file=/nexus-data/nexus.secrets.json"
 ---
 apiVersion: apps/v1
@@ -64,7 +68,7 @@ spec:
           ports:
             - containerPort: 8081
               name: nexus-ui
-            - containerPort: 8082
+            - containerPort: 8082 # Match internal HTTP connector
               name: docker-repo
           env:
             - name: INSTALL4J_ADD_VM_PARAMS
@@ -99,6 +103,24 @@ spec:
                 secretKeyRef:
                   name: nexus-secrets
                   key: postgres-password
+            # Redis Caching Layer
+            - name: NEXUS_CACHE_TYPE
+              value: "redis"
+            - name: NEXUS_CACHE_REDIS_HOST
+              valueFrom:
+                configMapKeyRef:
+                  name: nexus-configs
+                  key: REDIS_HOST
+            - name: NEXUS_CACHE_REDIS_PORT
+              valueFrom:
+                configMapKeyRef:
+                  name: nexus-configs
+                  key: REDIS_PORT
+            - name: NEXUS_CACHE_REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nexus-secrets
+                  key: redis-password
           resources:
             requests:
               cpu: "500m"
@@ -140,6 +162,22 @@ spec:
       nodePort: 31009 
     - name: docker
       protocol: TCP
-      port: 8082
+      port: 8082        # Internal Nexus Port
       targetPort: 8082
-      nodePort: 31010
+      nodePort: 31010   # External NodePort
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: nexus-web-ui
+  namespace: nexus
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # Only for UI. Docker now uses direct NodePort 31010
+    - match: Host(`nexus.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: nexus-service
+          port: 8081

kubernetes-templates/pgadmin.yml

@@ -101,7 +101,7 @@ metadata:
   name: pgadmin-service
   namespace: pgadmin
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: pgadmin
   ports:
@@ -109,5 +109,18 @@ spec:
       protocol: TCP
       port: 80
       targetPort: 80
-      nodePort: 32081
-       
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: pgadmin-web
+  namespace: pgadmin
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pgadmin.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: pgadmin-service
+          port: 80

kubernetes-templates/phpmyadmin.yml

@@ -10,48 +10,11 @@ metadata:
   name: phpmyadmin-config
   namespace: phpmyadmin
 data:
-  database.address: "192.168.1.137"
-  database.port: "3306"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: mysql-secret
-  namespace: phpmyadmin
-type: Opaque
-data:
-  username: cm9vdA==
-  password: QmxhY2tzdGFyMkBob21l
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: phpmyadmin-sa
-  namespace: phpmyadmin
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: phpmyadmin-role
-  namespace: phpmyadmin
-rules:
-- apiGroups: [""]
-  resources: ["pods", "services", "configmaps", "secrets"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: phpmyadmin-rolebinding
-  namespace: phpmyadmin
-subjects:
-- kind: ServiceAccount
-  name: phpmyadmin-sa
-  namespace: phpmyadmin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: phpmyadmin-role
+  PMA_HOST: "192.168.1.180"
+  PMA_PORT: "3306"
+  PMA_USER: "root"
+  PMA_ABSOLUTE_URI: "https://phpmyadmin.khongisa.co.za/"
+  ALLOW_NO_PASSWORD: "true"
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -68,7 +31,13 @@ spec:
       labels:
         app: phpmyadmin
     spec:
-      serviceAccountName: phpmyadmin-sa
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
       containers:
       - name: phpmyadmin
         image: phpmyadmin/phpmyadmin:latest
@@ -79,48 +48,54 @@ spec:
           valueFrom:
             configMapKeyRef:
               name: phpmyadmin-config
-              key: database.address
+              key: PMA_HOST
         - name: PMA_PORT
           valueFrom:
             configMapKeyRef:
               name: phpmyadmin-config
-              key: database.port
+              key: PMA_PORT
         - name: PMA_USER
           valueFrom:
-            secretKeyRef:
-              name: mysql-secret
-              key: username
-        - name: PMA_PASSWORD
+            configMapKeyRef:
+              name: phpmyadmin-config
+              key: PMA_USER
+        - name: ALLOW_NO_PASSWORD
           valueFrom:
-            secretKeyRef:
-              name: mysql-secret
-              key: password
+            configMapKeyRef:
+              name: phpmyadmin-config
+              key: ALLOW_NO_PASSWORD
+        - name: PMA_ABSOLUTE_URI
+          valueFrom:
+            configMapKeyRef:
+              name: phpmyadmin-config
+              key: PMA_ABSOLUTE_URI
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: phpmyadmin
+  name: phpmyadmin-service
   namespace: phpmyadmin
 spec:
   type: ClusterIP
   selector:
     app: phpmyadmin
   ports:
-    - port: 80
+    - name: http
+      protocol: TCP
+      port: 80
       targetPort: 80
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: phpmyadmin-ingress
+  name: phpmyadmin-web
   namespace: phpmyadmin
 spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`phpmyadmin.apps.mngoma.lab`)
+    - match: Host(`phpmyadmin.khongisa.co.za`)
       kind: Rule
       services:
-        - name: phpmyadmin
-          port: 80
-  tls: {}
+        - name: phpmyadmin-service
+          port: 80

kubernetes-templates/redis.yml

@@ -0,0 +1,85 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: redis
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: redis-secret
+  namespace: redis
+type: Opaque
+data:
+  password: NjI4akZL
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-data-pvc
+  namespace: redis
+spec:
+  accessModes: ["ReadWriteMany"]
+  storageClassName: nfs-storage
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          command: ["redis-server", "--requirepass", "$(REDIS_PASSWORD)", "--appendonly", "yes"]
+          ports:
+            - containerPort: 6379
+              name: redis
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: redis-secret
+                  key: password
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: redis-data-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-service
+  namespace: redis
+spec:
+  type: NodePort
+  selector:
+    app: redis
+  ports:
+    - name: redis
+      protocol: TCP
+      port: 6379
+      targetPort: 6379
+      nodePort: 36379

kubernetes-templates/redisinsight.yml

@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: Namespace
 metadata:
@@ -9,7 +10,8 @@ metadata:
   name: redisinsight-config
   namespace: redisinsight
 data:
-  database.host: "192.168.1.137"
+  # Pointing to the internal service name of the new Redis instance
+  database.host: "redis-service.redis.svc.cluster.local"
   database.port: "6379"
   database.instance: "redis"
   RI_LOG_LEVEL: "info"
@@ -56,36 +58,13 @@ roleRef:
   name: redisinsight-role
 ---
 apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: redisinsight-pv
-spec:
-  capacity:
-    storage: 2Gi
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-pvs
-  local:
-    path: /home/ansible/k3s/makhiwane/redisinsight
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - lead
-  persistentVolumeReclaimPolicy: Retain
----
-apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: redisinsight-pvc
   namespace: redisinsight
 spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-pvs
+  accessModes: ["ReadWriteMany"]
+  storageClassName: nfs-storage
   resources:
     requests:
       storage: 2Gi
@@ -106,6 +85,13 @@ spec:
         app: redisinsight
     spec:
       serviceAccountName: redisinsight-sa
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
       containers:
       - name: redisinsight
         image: redislabs/redisinsight:latest
@@ -170,20 +156,19 @@ spec:
     app: redisinsight
   ports:
     - port: 8001
-      targetPort: 8001 # maybe 5540
+      targetPort: 8001
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: redisinsight-ingress
+  name: redisinsight-web
   namespace: redisinsight
 spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`redisinsight.apps.mngoma.lab`)
+    - match: Host(`redisinsight.khongisa.co.za`)
       kind: Rule
       services:
         - name: redisinsight
-          port: 8001
-  tls: {}
+          port: 8001

kubernetes-templates/searxng.yml

@@ -38,6 +38,9 @@ spec:
               value: "0.0.0.0"
             - name: SEARXNG_SERVER_PORT
               value: "8080"
+            # Ensures the application generates internal links correctly for the public URL
+            - name: SEARXNG_BASE_URL
+              value: "https://search.khongisa.co.za"
           resources:
             requests:
               cpu: "100m"
@@ -52,7 +55,8 @@ metadata:
   name: searxng-server
   namespace: searxng
 spec:
-  type: NodePort
+  # Internal-only service; nodePort 32080 is no longer required
+  type: ClusterIP 
   selector:
     app.kubernetes.io/name: searxng-server
   ports:
@@ -60,7 +64,6 @@ spec:
       protocol: TCP
       port: 8080
       targetPort: 8080
-      nodePort: 32080
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
@@ -71,10 +74,11 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`searxng.apps.mngoma.lab`)
+    # Matches the specific subdomain configured in Pangolin
+    - match: Host(`search.khongisa.co.za`) 
       kind: Rule
       services:
         - name: searxng-server
           port: 8080
           scheme: http
-  tls: {}
+  tls: {}

kubernetes-templates/semaphoreui.yml

@@ -58,7 +58,7 @@ data:
   admin-password: QmxhY2tzdGFyMkBob21l
   access-key-encryption: NHZKMm1LMnBMNW5COHhSMnpRN3dFM3RZNnVJMG9QOWE=
   id_ed25519: LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEbkRQMDZzbmM0Q2k3M0ZPSW1nTmszTWJsc25vNTNoajZYRDJTSzE1ZFpiQUFBQUpnZWwvMndIcGY5CnNBQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRG5EUDA2c25jNENpNzNGT0ltZ05rM01ibHNubzUzaGo2WEQyU0sxNWRaYkEKQUFBRUJUaHFjcnNXZWVVWnpFeVdWWmJoRGlKZE9FQkZYSkg4NXNhMUNjK1dXQ0krY00vVHF5ZHpnS0x2Y1U0aWFBMlRjeAp1V3llam5lR1BwY1BaSXJYbDFsc0FBQUFEbXRvZDJWNmFVQkVRVkpMVTFWT0FRSURCQVVHQnc9PQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K
-  id_ed25519.pub: c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU9jTS9UcXlkemdLTHZjVTRpYUEyVGN4dVd5ZWpuZUdQcGNQWklyWGwxbHMga2h3ZXppQERBUktTVU4K
+  id_ed25519.pub: c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU9jTS9UcXlkemdLTHZjVTRpYUEyVGN4dVd5ZWpuZUdQcGNQWklyWGwxbHMga2h3ZXpkeEBkYXJrc3VuCg==
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -109,8 +109,6 @@ spec:
       initContainers:
         - name: fix-ssh-permissions
           image: busybox:latest
-          # We ensure the directory exists and has 700. 
-          # We don't touch the files yet because they are mounted by the main container.
           command: ["sh", "-c", "mkdir -p /home/semaphore/.ssh && chmod 700 /home/semaphore/.ssh"]
           volumeMounts:
             - name: semaphore-persistent-storage
@@ -188,7 +186,7 @@ metadata:
   name: semaphore-service
   namespace: semaphore
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: semaphore
   ports:
@@ -196,4 +194,18 @@ spec:
       protocol: TCP
       port: 3000
       targetPort: 3000
-      nodePort: 31011
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: semaphore-web
+  namespace: semaphore
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`semaphore.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: semaphore-service
+          port: 3000

kubernetes-templates/traefik-dashboard.yml

@@ -1,10 +1,11 @@
+---
 apiVersion: v1
 kind: Service
 metadata:
-  name: traefik-dashboard-nodeport
+  name: traefik-dashboard
   namespace: kube-system
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app.kubernetes.io/name: traefik
   ports:
@@ -12,4 +13,18 @@ spec:
       protocol: TCP
       port: 8080
       targetPort: 8080
-      nodePort: 30000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-dashboard-web
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`traefik.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: api@internal
+          kind: TraefikService

kubernetes-templates/vaultwarden.yml

@@ -112,7 +112,7 @@ metadata:
   name: vaultwarden-service
   namespace: vaultwarden
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: vaultwarden
   ports:
@@ -120,4 +120,18 @@ spec:
       protocol: TCP
       port: 80
       targetPort: 80
-      nodePort: 32085
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vaultwarden-web
+  namespace: vaultwarden
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`vault.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: vaultwarden-service
+          port: 80

kubernetes-templates/vscode.yml

@@ -119,7 +119,7 @@ metadata:
   name: vscode-service
   namespace: vscode
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: vscode
   ports:
@@ -127,7 +127,6 @@ spec:
       protocol: TCP
       port: 8080
       targetPort: 8080
-      nodePort: 33000
 ---
 apiVersion: v1
 kind: Service
@@ -135,7 +134,7 @@ metadata:
   name: vscode-dev-service
   namespace: vscode
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: vscode
   ports:
@@ -143,9 +142,52 @@ spec:
       protocol: TCP
       port: 3000
       targetPort: 3000
-      nodePort: 33001
     - name: dotnet-dev
       protocol: TCP
       port: 5000
       targetPort: 5000
-      nodePort: 33002
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vscode-web
+  namespace: vscode
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`code.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: vscode-service
+          port: 8080
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vscode-node-uat
+  namespace: vscode
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`node.uat.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: vscode-dev-service
+          port: 3000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vscode-dotnet-uat
+  namespace: vscode
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`dotnet.uat.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: vscode-dev-service
+          port: 5000

kubernetes-templates/whoami.yml

@@ -45,7 +45,7 @@ metadata:
   name: whoami
   namespace: whoami
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: whoami
   ports:
@@ -53,4 +53,18 @@ spec:
       protocol: TCP
       port: 80
       targetPort: 80
-      nodePort: 31002
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: whoami-web
+  namespace: whoami
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`whoami.khongisa.co.za`)
+      kind: Rule
+      services:
+        - name: whoami
+          port: 80