Second drone ci port fix

ansible-playbooks/common/config.ini

@@ -3,19 +3,20 @@ ansible_python_interpreter=/usr/bin/python3
 ansible_user=ansible
 ansible_ssh_private_key_file=~/.ssh/id_ed25519
 
-[lxc-hosts]
+[lxc_hosts]
 postgres ansible_host=192.168.1.170
 gitea ansible_host=192.168.1.172
 appserver ansible_host=192.168.1.173
 
-[workload-hosts]
+[workload_hosts]
+vpn ansible_host=192.168.1.138
 authentik ansible_host=192.168.1.171
 pangolingw ansible_host=192.168.1.175
 
-[docker-hosts]
+[docker_hosts]
 authentik ansible_host=192.168.1.171
 appserver ansible_host=192.168.1.173
 
-[k3s-hosts]
+[k3s_hosts]
 k3smainnode ansible_host=192.168.1.177
 k3sworkernode ansible_host=192.168.1.178

ansible-playbooks/common/create-ansible-user.yml

@@ -2,7 +2,7 @@
 # Note: this playbook requires an interactive mode or passed secret for privilege escalation
 ---
 - name: Create ansible user and configure passwordless sudo
-  hosts: workload-hosts
+  hosts: workload_hosts
   become: true
   become_method: sudo
   vars:

ansible-playbooks/common/create-lxc-ansible-user.yml

@@ -2,7 +2,7 @@
 # Note: this playbook requires an interactive mode or passed secret for privilege escalation
 ---
 - name: Create ansible user and configure passwordless sudo
-  hosts: lxc-hosts
+  hosts: lxc_hosts
   become: true
   become_method: sudo
   vars:

ansible-playbooks/common/install-docker.yml

@@ -1,7 +1,7 @@
 # command: ansible-playbook -i common/config.ini common/install-docker.yml
 ---
 - name: Install Docker and Test
-  hosts: docker-hosts
+  hosts: docker_hosts
   become: true
   become_method: sudo
 

ansible-playbooks/common/reboot-hosts.yml

@@ -5,11 +5,11 @@
   become_method: sudo
   
   tasks:
-    - name: Trigger system reboot
-      ansible.builtin.reboot:
-        msg: "Reboot initiated by Semaphore UI"
-        connect_timeout: 5
-        reboot_timeout: 600
-        pre_reboot_delay: 0
-        post_reboot_delay: 30
-        test_command: whoami
+    - name: Trigger reboot with a slight delay
+      ansible.builtin.shell: "sleep 5 && reboot"
+      async: 1
+      poll: 0
+      ignore_errors: true
+
+    - name: Reboot command issues, exiting play
+      ansible.builtin.meta: end_host

ansible-playbooks/common/update-docker.yml

@@ -1,7 +1,7 @@
 # command: ansible-playbook -i common/config.ini common/update-docker.yml
 ---
 - name: Update Docker only on hosts where it is installed
-  hosts: docker-hosts
+  hosts: docker_hosts
   become: true
   become_method: sudo
 

ansible-playbooks/common/update-release.yml

@@ -1,7 +1,7 @@
 # command: ansible-playbook -i common/config.ini common/update-release.yml
 ---
 - name: Upgrade Ubuntu to next release
-  hosts: workload-hosts, k3s-hosts
+  hosts: workload_hosts, k3s_hosts
   become: true
   tasks:
     - name: Ensure update-manager-core is installed

ansible-playbooks/update-vpn.yml

@@ -0,0 +1,31 @@
+# command: ansible-playbook -i common/config.ini update-vpn.yml
+---
+- name: Maintain VPN and Pi-hole
+  hosts: vpn
+  become: yes  
+  become_method: sudo
+
+  tasks:
+    - name: Wait for VPN host to be ready after reboot
+      ansible.builtin.wait_for_connection:
+        delay: 5
+        timeout: 300
+
+    - name: Update Pi-hole
+      ansible.builtin.shell: pihole -up
+      args:
+        executable: /bin/bash
+      register: pihole_out
+      changed_when: "'everything is up to date' not in pihole_out.stdout"
+
+    - name: Run PiVPN diagnostics with automated 'Y' responses
+      ansible.builtin.shell: yes Y | pivpn -d
+      args:
+        executable: /bin/bash
+      register: pivpn_diag
+      changed_when: false
+
+    - name: Debug Output (Optional)
+      ansible.builtin.debug:
+        msg: "{{ pivpn_diag.stdout_lines }}"
+ 

docker-stacks/app-server/semaphore.yml

@@ -6,24 +6,22 @@ services:
     ports:
       - "4011:3000"
     environment:
-      SEMAPHORE_SCHEDULE_TIMEZONE: "Africa/Johannesburg"
-      
-      # Database Connection (External)
+      SEMAPHORE_SCHEDULE_TIMEZONE: "Africa/Johannesburg"      
       SEMAPHORE_DB_USER: "${SEMAPHORE_DB_USER}"
       SEMAPHORE_DB_PASS: "${SEMAPHORE_DB_PASSWORD}"
       SEMAPHORE_DB_HOST: "${SEMAPHORE_DB_HOST}"
       SEMAPHORE_DB_PORT: "5432"
       SEMAPHORE_DB_DIALECT: "postgres"
       SEMAPHORE_DB: "${SEMAPHORE_DB_NAME}"
-      
-      # Initial Admin Setup
       SEMAPHORE_ADMIN: "${SEMAPHORE_ADMIN_USERNAME}"
       SEMAPHORE_ADMIN_PASSWORD: "${SEMAPHORE_ADMIN_PASSWORD}"
       SEMAPHORE_ADMIN_NAME: "${SEMAPHORE_ADMIN_USERNAME}"
       SEMAPHORE_ADMIN_EMAIL: "${SEMAPHORE_ADMIN_EMAIL}"
-      
-      # Encryption Key (Required)
       SEMAPHORE_ACCESS_KEY_ENCRYPTION: "${SEMAPHORE_ACCESS_KEY_ENCRYPTION}"
-      
     volumes:
-      - /tmp/semaphore:/tmp/semaphore
+      - semaphore-tmp:/tmp/semaphore
+      - semaphore-ssh:/home/semaphore/.ssh
+
+volumes:
+  semaphore-tmp:
+  semaphore-ssh:

kubernetes-templates/droneci.yml

@@ -1,331 +1,172 @@
 ---
-# Namespace for Drone CI
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: droneci
-
+  name: drone-ci
 ---
-# Service Account
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: droneci-sa
-  namespace: droneci
-
+  name: drone-runner-sa
+  namespace: drone-ci
 ---
-# ConfigMap for Drone configuration
-apiVersion: v1
-kind: ConfigMap
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
 metadata:
-  name: droneci-config
-  namespace: droneci
-data:
-  server.domain: "droneci.apps.mngoma.lab"
-  server.proto: "https"
-  server.runnername: "drone-runner"
-  server.runnercapacity: "2"
-  server.runnernetworks: "default"
-  database.type: "postgres"
-  database.host: "192.168.1.137:5432"
-  database.name: "dronecim"
-  gitea.server: "https://gitea.apps.mngoma.lab"
-  gitea.server.internal: "https://gitea-server.gitea.svc.cluster.local"
-
+  name: drone-runner-role
+  namespace: drone-ci
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "pods/log", "secrets"]
+    verbs: ["get", "create", "delete", "list", "watch", "update"]
 ---
-# Secret for Drone credentials
-apiVersion: v1
-kind: Secret
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
 metadata:
-  name: droneci-secret
-  namespace: droneci
-type: Opaque
-data:
-  server.rpctoken: MDFLNlFHTkE4VEMxQjJGVzNGV0JSWDJFNE4=
-  database.username: YXBwX3VzZXI=
-  database.password: MTIzNDU=
-  database.connectstring: cG9zdGdyZXM6Ly9hcHBfdXNlcjoxMjM0NUAxOTIuMTY4LjEuMTM3OjU0MzIvZHJvbmVjaW0/c3NsbW9kZT1kaXNhYmxl
-  gitea.clientid: MGRiNTliZDAtMGI3Ni00ODgxLThhODQtNjI0N2ZlYTExOTcz
-  gitea.clientsecret: Z3RvX3l6bXB6NmJvZG52cmRnMnM1MmVmNWF1c3ozZTYzNGdyeTc0MjJqZ2hwd3ZnbGc2M2JtcnE=
-
+  name: drone-runner-rb
+  namespace: drone-ci
+subjects:
+  - kind: ServiceAccount
+    name: drone-runner-sa
+    namespace: drone-ci
+roleRef:
+  kind: Role
+  name: drone-runner-role
+  apiGroup: rbac.authorization.k8s.io
 ---
-# Persistent Volume for Drone data
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: droneci-pv
-  labels:
-    type: local
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes: ["ReadWriteOnce"]
-  storageClassName: local-pvs
-  local:
-    path: /home/ansible/k3s/makhiwane/droneci
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values: ["lead"]
-  persistentVolumeReclaimPolicy: Retain
-
----
-# Persistent Volume Claim
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: droneci-pvc
-  namespace: droneci
+  name: drone-server-data-pvc
+  namespace: drone-ci
 spec:
-  accessModes: ["ReadWriteOnce"]
-  storageClassName: local-pvs
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-storage
   resources:
     requests:
       storage: 5Gi
-
 ---
-# Drone Server Deployment
+apiVersion: v1
+kind: Secret
+metadata:
+  name: drone-secrets
+  namespace: drone-ci
+type: Opaque
+stringData:
+  DRONE_RPC_SECRET: "b505b2906ae213070b10d9698cc35e84"
+  DRONE_GITEA_CLIENT_ID: "a9b4a947-0b4c-4782-a5f8-3ed79a4b295d"
+  DRONE_GITEA_CLIENT_SECRET: "gto_ukxcserdy7vei36git4tbuz2tdyez4rb2eo5woownmtyct3lz3aq"
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: drone
-  namespace: droneci
-  labels:
-    app.kubernetes.io/name: drone
+  name: drone-server
+  namespace: drone-ci
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: drone
+      app: drone-server
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: drone
+        app: drone-server
     spec:
-      serviceAccountName: droneci-sa
       hostAliases:
-        - ip: "192.168.1.160"
-          hostnames:
-            - "gitea.apps.mngoma.lab"
+        - ip: "169.255.58.144"
+          hostnames: ["gitea.khongisa.co.za"]
       containers:
-        - name: drone
-          image: drone/drone:latest
+        - name: drone-server
+          image: drone/drone:2
           ports:
             - containerPort: 80
               name: http
           resources:
             requests:
+              cpu: "100m"
               memory: "256Mi"
-              cpu: "250m"
             limits:
-              memory: "512Mi"
               cpu: "500m"
+              memory: "512Mi"
           env:
-            - name: DRONE_SERVER_HOST
-              valueFrom:
-                configMapKeyRef:
-                  name: droneci-config
-                  key: server.domain
-            - name: DRONE_SERVER_PROTO
-              valueFrom:
-                configMapKeyRef:
-                  name: droneci-config
-                  key: server.proto
-            - name: DRONE_SERVER_PORT
+            # FIX: Explicitly bind the address to bypass port validation logic
+            - name: DRONE_SERVER_ADDR
               value: ":80"
-            - name: DRONE_TLS_AUTOCERT
-              value: "false"
-            - name: DRONE_LOGS_DEBUG
-              value: "true"
-            - name: DRONE_RPC_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: droneci-secret
-                  key: server.rpctoken
-            - name: DRONE_DATABASE_DRIVER
-              valueFrom:
-                configMapKeyRef:
-                  name: droneci-config
-                  key: database.type
-            - name: DRONE_DATABASE_DATASOURCE
-              valueFrom:
-                secretKeyRef:
-                  name: droneci-secret
-                  key: database.connectstring
-            - name: DRONE_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: droneci-secret
-                  key: database.username
-            - name: DRONE_DB_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: droneci-secret
-                  key: database.password
+            - name: DRONE_SERVER_HOST
+              value: "drone.khongisa.co.za"
+            - name: DRONE_SERVER_PROTO
+              value: "https"
             - name: DRONE_GITEA_SERVER
-              valueFrom:
-                configMapKeyRef:
-                  name: droneci-config
-                  key: gitea.server
+              value: "https://gitea.khongisa.co.za"
+            - name: DRONE_RPC_SECRET
+              valueFrom: { secretKeyRef: { name: drone-secrets, key: DRONE_RPC_SECRET } }
             - name: DRONE_GITEA_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: droneci-secret
-                  key: gitea.clientid
+              valueFrom: { secretKeyRef: { name: drone-secrets, key: DRONE_GITEA_CLIENT_ID } }
             - name: DRONE_GITEA_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: droneci-secret
-                  key: gitea.clientsecret
-            - name: DRONE_GITEA_SKIP_VERIFY
-              value: "true"
+              valueFrom: { secretKeyRef: { name: drone-secrets, key: DRONE_GITEA_CLIENT_SECRET } }
+            - name: DRONE_DATABASE_DRIVER
+              value: "sqlite3"
+            - name: DRONE_DATABASE_DATASOURCE
+              value: "/data/database.sqlite"
           volumeMounts:
-            - name: drone-storage
+            - name: data
               mountPath: /data
       volumes:
-        - name: drone-storage
+        - name: data
           persistentVolumeClaim:
-            claimName: droneci-pvc
-
+            claimName: drone-server-data-pvc
 ---
-# Drone Server Service
-apiVersion: v1
-kind: Service
-metadata:
-  name: drone-server
-  namespace: droneci
-spec:
-  selector:
-    app.kubernetes.io/name: drone
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-  type: ClusterIP
-
----
-# Drone Runner Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: drone-runner
-  namespace: droneci
-  labels:
-    app.kubernetes.io/name: drone-runner
+  namespace: drone-ci
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: drone-runner
+      app: drone-runner
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: drone-runner
+        app: drone-runner
     spec:
-      serviceAccountName: droneci-sa
+      serviceAccountName: drone-runner-sa
       hostAliases:
-        - ip: "192.168.1.160"
-          hostnames:
-            - "droneci.apps.mngoma.lab"
+        - ip: "169.255.58.144"
+          hostnames: ["gitea.khongisa.co.za"]
       containers:
-        - name: runner
+        - name: drone-runner
           image: drone/drone-runner-kube:latest
-          ports:
-            - containerPort: 3000
-          env:
-            # propagate SSL skip and internal Gitea to ephemeral pods
-            - name: DRONE_RUNNER_ENV_VARS
-              valueFrom:
-                configMapKeyRef:
-                  name: droneci-config
-                  key: gitea.server.internal
-            - name: DRONE_RPC_HOST
-              value: drone-server.droneci.svc.cluster.local
-            - name: DRONE_RPC_PROTO
-              value: "http"
-            - name: DRONE_RPC_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: droneci-secret
-                  key: server.rpctoken
-            - name: DRONE_RUNNER_NAME
-              valueFrom:
-                configMapKeyRef:
-                  name: droneci-config
-                  key: server.runnername
-            - name: DRONE_RUNNER_CAPACITY
-              valueFrom:
-                configMapKeyRef:
-                  name: droneci-config
-                  key: server.runnercapacity
-            - name: DRONE_RUNNER_NETWORKS
-              valueFrom:
-                configMapKeyRef:
-                  name: droneci-config
-                  key: server.runnernetworks
           resources:
             requests:
+              cpu: "100m"
               memory: "128Mi"
-              cpu: "200m"
             limits:
+              cpu: "300m"
               memory: "256Mi"
-              cpu: "400m"
-
+          env:
+            - name: DRONE_RPC_PROTO
+              value: "http"
+            - name: DRONE_RPC_HOST
+              value: "drone-server.drone-ci.svc.cluster.local"
+            - name: DRONE_RPC_SECRET
+              valueFrom: { secretKeyRef: { name: drone-secrets, key: DRONE_RPC_SECRET } }
+            - name: DRONE_NAMESPACE_DEFAULT
+              value: "drone-ci"
 ---
-# Drone IngressRoute for Traefik
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
+apiVersion: v1
+kind: Service
 metadata:
-  name: droneci-web
-  namespace: droneci
+  name: drone-server
+  namespace: drone-ci
 spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`droneci.apps.mngoma.lab`)
-      kind: Rule
-      services:
-        - name: drone-server
-          port: 80
-          scheme: http
-  tls: {}
----
-# ClusterRole for Drone CI Service Account
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: droneci-cluster-role
-rules:
-  - apiGroups: [""] # core API
-    resources: ["pods", "pods/exec", "pods/log", "services", "endpoints", "configmaps", "secrets", "persistentvolumeclaims", "namespaces"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["apps"]
-    resources: ["deployments", "replicasets", "statefulsets"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["batch"]
-    resources: ["jobs", "cronjobs"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["extensions", "networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["policy"]
-    resources: ["poddisruptionbudgets"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-
----
-# ClusterRoleBinding for Drone CI Service Account
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: droneci-cluster-rolebinding
-subjects:
-  - kind: ServiceAccount
-    name: droneci-sa
-    namespace: droneci
-roleRef:
-  kind: ClusterRole
-  name: droneci-cluster-role
-  apiGroup: rbac.authorization.k8s.io
+  type: NodePort
+  selector:
+    app: drone-server
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      nodePort: 31001

kubernetes-templates/headlamp.yml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: headlamp
+  namespace: kube-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: headlamp
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: headlamp
+    spec:
+      containers:
+      - name: headlamp
+        image: ghcr.io/headlamp-k8s/headlamp:latest
+        # We only use -in-cluster. No other flags allowed.
+        args:
+          - "-in-cluster"
+        ports:
+        - containerPort: 4466
+          name: http
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: headlamp
+  namespace: kube-system
+spec:
+  type: NodePort
+  selector:
+    app.kubernetes.io/name: headlamp
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 4466
+      nodePort: 30001

kubernetes-templates/nexus.yml

@@ -0,0 +1,145 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nexus
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nexus-data-pvc
+  namespace: nexus
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: nfs-nexus
+  resources:
+    requests:
+      storage: 200Gi
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nexus-secrets
+  namespace: nexus
+type: Opaque
+data:
+  nexus.secrets.json: ewogICJhY3RpdmUiOiAia2hvbmdpc2Eta2V5LTIwMjYiLAogICJrZXlzIjogWwogICAgewogICAgICAiaWQiOiAia2hvbmdpc2Eta2V5LTIwMjYiLAogICAgICAia2V5IjogIk5tTmhZMll3TkdNMUltVXdOVGt4WkROa1l6a3habVk1WVRJek5UWTVOalE9IgogICAgfQogIF0KfQo=
+  postgres-password: TWd6dUxVakZianA5ZjQ=
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nexus-configs
+  namespace: nexus
+data:
+  POSTGRES_HOST: "192.168.1.170"
+  POSTGRES_PORT: "5432"
+  POSTGRES_USER: "nexus"
+  POSTGRES_DBNAME: "nexus"
+  JVM_PARAMS: "-Xms2g -Xmx2g -XX:MaxDirectMemorySize=2g -Dnexus.secrets.file=/nexus-data/nexus.secrets.json"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nexus
+  namespace: nexus
+  labels:
+    app: nexus
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nexus
+  template:
+    metadata:
+      labels:
+        app: nexus
+    spec:
+      securityContext:
+        fsGroup: 200
+      containers:
+        - name: nexus
+          image: sonatype/nexus3:latest
+          ports:
+            - containerPort: 8081
+              name: nexus-ui
+            - containerPort: 8082
+              name: docker-repo
+          env:
+            - name: INSTALL4J_ADD_VM_PARAMS
+              valueFrom:
+                configMapKeyRef:
+                  name: nexus-configs
+                  key: JVM_PARAMS
+            - name: NEXUS_DATABAS_TYPE
+              value: "postgresql"
+            - name: NEXUS_DATABASE_POSTGRES_HOST
+              valueFrom:
+                configMapKeyRef:
+                  name: nexus-configs
+                  key: POSTGRES_HOST
+            - name: NEXUS_DATABASE_POSTGRES_PORT
+              valueFrom:
+                configMapKeyRef:
+                  name: nexus-configs
+                  key: POSTGRES_PORT
+            - name: NEXUS_DATABASE_POSTGRES_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: nexus-configs
+                  key: POSTGRES_USER
+            - name: NEXUS_DATABASE_POSTGRES_DBNAME
+              valueFrom:
+                configMapKeyRef:
+                  name: nexus-configs
+                  key: POSTGRES_DBNAME
+            - name: NEXUS_DATABASE_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nexus-secrets
+                  key: postgres-password
+          resources:
+            requests:
+              cpu: "500m"
+              memory: "2Gi"
+            limits:
+              cpu: "4"
+              memory: "4Gi"
+          volumeMounts:
+            - name: nexus-data
+              mountPath: /nexus-data
+            - name: secrets-volume
+              mountPath: /nexus-data/nexus.secrets.json
+              subPath: nexus.secrets.json
+      volumes:
+        - name: nexus-data
+          persistentVolumeClaim:
+            claimName: nexus-data-pvc
+        - name: secrets-volume
+          secret:
+            secretName: nexus-secrets
+            items:
+              - key: nexus.secrets.json
+                path: nexus.secrets.json
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nexus-service
+  namespace: nexus
+spec:
+  type: NodePort
+  selector:
+    app: nexus
+  ports:
+    - name: ui
+      protocol: TCP
+      port: 8081
+      targetPort: 8081
+      nodePort: 31009 
+    - name: docker
+      protocol: TCP
+      port: 8082
+      targetPort: 8082
+      nodePort: 31010

kubernetes-templates/pgadmin.yml

@@ -1,95 +1,46 @@
+---
 apiVersion: v1
 kind: Namespace
 metadata:
   name: pgadmin
 ---
 apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pgadmin-data-pvc
+  namespace: pgadmin
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: nfs-storage
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: pgadmin-auth
+  namespace: pgadmin
+type: Opaque
+data:
+  pgadmin-password: QmxhY2tzdGFyMkBob21l
+---
+apiVersion: v1
 kind: ConfigMap
 metadata:
   name: pgadmin-config
   namespace: pgadmin
 data:
-  server.email: "khwezi@mngoma.lab"
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: pgadmin-secret
-  namespace: pgadmin
-type: Opaque
-data:
-  server.password: M3pDQTQz
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: pgadmin-sa
-  namespace: pgadmin
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: pgadmin-role
-  namespace: pgadmin
-rules:
-- apiGroups: [""]
-  resources: ["pods", "services", "persistentvolumeclaims", "configmaps", "secrets"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: pgadmin-rolebinding
-  namespace: pgadmin
-subjects:
-- kind: ServiceAccount
-  name: pgadmin-sa
-  namespace: pgadmin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: pgadmin-role
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pgadmin-pv
-spec:
-  capacity:
-    storage: 2Gi
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-pvs
-  local:
-    path: /home/ansible/k3s/makhiwane/pgadmin
-  nodeAffinity:
-    required:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: kubernetes.io/hostname
-              operator: In
-              values:
-                - lead
-  persistentVolumeReclaimPolicy: Retain
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pgadmin-pvc
-  namespace: pgadmin
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-pvs
-  resources:
-    requests:
-      storage: 2Gi
+  PGADMIN_DEFAULT_EMAIL: "khwezi@litecharms.co.za"
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pgadmin
   namespace: pgadmin
+  labels:
+    app: pgadmin
 spec:
   replicas: 1
   selector:
@@ -100,60 +51,63 @@ spec:
       labels:
         app: pgadmin
     spec:
-      serviceAccountName: pgadmin-sa
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
       securityContext:
         runAsUser: 5050
-        runAsGroup: 5050
         fsGroup: 5050
       containers:
-      - name: pgadmin
-        image: dpage/pgadmin4:latest        
-        ports:
-        - containerPort: 80
-        volumeMounts:
-        - name: pgadmin-data
-          mountPath: /var/lib/pgadmin
-        env:
-        - name: PGADMIN_DEFAULT_EMAIL
-          valueFrom:
-            configMapKeyRef:
-              name: pgadmin-config
-              key: server.email
-        - name: PGADMIN_DEFAULT_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: pgadmin-secret
-              key: server.password
+        - name: pgadmin
+          image: dpage/pgadmin4:latest
+          ports:
+            - containerPort: 80
+              name: http
+          env:
+            - name: PGADMIN_DEFAULT_EMAIL
+              valueFrom:
+                configMapKeyRef:
+                  name: pgadmin-config
+                  key: PGADMIN_DEFAULT_EMAIL
+            - name: PGADMIN_DEFAULT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: pgadmin-auth
+                  key: pgadmin-password
+            - name: PGADMIN_CONFIG_UPGRADE_CHECK_ENABLED
+              value: "False"
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "256Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+          volumeMounts:
+            - name: pgadmin-storage
+              mountPath: /var/lib/pgadmin
       volumes:
-      - name: pgadmin-data
-        persistentVolumeClaim:
-          claimName: pgadmin-pvc
+        - name: pgadmin-storage
+          persistentVolumeClaim:
+            claimName: pgadmin-data-pvc
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: pgadmin
+  name: pgadmin-service
   namespace: pgadmin
 spec:
-  type: ClusterIP
+  type: NodePort
   selector:
     app: pgadmin
   ports:
-    - port: 80
+    - name: http
+      protocol: TCP
+      port: 80
       targetPort: 80
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: pgadmin-ingress
-  namespace: pgadmin
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`pgadmin.apps.mngoma.lab`)
-      kind: Rule
-      services:
-        - name: pgadmin
-          port: 80
-  tls: {}
+      nodePort: 32081
+      

kubernetes-templates/searxng.yml

@@ -38,6 +38,13 @@ spec:
               value: "0.0.0.0"
             - name: SEARXNG_SERVER_PORT
               value: "8080"
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
 ---
 apiVersion: v1
 kind: Service
@@ -45,6 +52,7 @@ metadata:
   name: searxng-server
   namespace: searxng
 spec:
+  type: NodePort
   selector:
     app.kubernetes.io/name: searxng-server
   ports:
@@ -52,7 +60,7 @@ spec:
       protocol: TCP
       port: 8080
       targetPort: 8080
-  type: ClusterIP
+      nodePort: 32080
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute

kubernetes-templates/semaphoreui.yml

@@ -0,0 +1,199 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: semaphore
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: semaphore-sa
+  namespace: semaphore
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: semaphore-role
+  namespace: semaphore
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "secrets", "configmaps"]
+    verbs: ["get", "watch", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: semaphore-rb
+  namespace: semaphore
+subjects:
+  - kind: ServiceAccount
+    name: semaphore-sa
+    namespace: semaphore
+roleRef:
+  kind: Role
+  name: semaphore-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: semaphore-data-pvc
+  namespace: semaphore
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: nfs-storage
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: semaphore-secrets
+  namespace: semaphore
+type: Opaque
+data:
+  db-password: c2VYbk42RGt1cFJaN0Y=
+  admin-password: QmxhY2tzdGFyMkBob21l
+  access-key-encryption: NHZKMm1LMnBMNW5COHhSMnpRN3dFM3RZNnVJMG9QOWE=
+  id_ed25519: LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEbkRQMDZzbmM0Q2k3M0ZPSW1nTmszTWJsc25vNTNoajZYRDJTSzE1ZFpiQUFBQUpnZWwvMndIcGY5CnNBQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRG5EUDA2c25jNENpNzNGT0ltZ05rM01ibHNubzUzaGo2WEQyU0sxNWRaYkEKQUFBRUJUaHFjcnNXZWVVWnpFeVdWWmJoRGlKZE9FQkZYSkg4NXNhMUNjK1dXQ0krY00vVHF5ZHpnS0x2Y1U0aWFBMlRjeAp1V3llam5lR1BwY1BaSXJYbDFsc0FBQUFEbXRvZDJWNmFVQkVRVkpMVTFWT0FRSURCQVVHQnc9PQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K
+  id_ed25519.pub: c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU9jTS9UcXlkemdLTHZjVTRpYUEyVGN4dVd5ZWpuZUdQcGNQWklyWGwxbHMga2h3ZXppQERBUktTVU4K
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: semaphore-configs
+  namespace: semaphore
+data:
+  SEMAPHORE_DB_USER: "semaphore_user"
+  SEMAPHORE_DB_HOST: "192.168.1.170"
+  SEMAPHORE_DB_NAME: "semaphore"
+  SEMAPHORE_ADMIN_USERNAME: "khwezi"
+  SEMAPHORE_ADMIN_EMAIL: "khwezi@litecharms.co.za"
+  SEMAPHORE_SCHEDULE_TIMEZONE: "Africa/Johannesburg"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: semaphore
+  namespace: semaphore
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: semaphore
+  template:
+    metadata:
+      labels:
+        app: semaphore
+    spec:
+      serviceAccountName: semaphore-sa
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: DoesNotExist
+      hostAliases:
+        - ip: "169.255.58.144"
+          hostnames:
+            - "gitea.khongisa.co.za"
+      
+      securityContext:
+        runAsUser: 1001
+        fsGroup: 1001
+        fsGroupChangePolicy: "Always"
+
+      initContainers:
+        - name: fix-ssh-permissions
+          image: busybox:latest
+          # We ensure the directory exists and has 700. 
+          # We don't touch the files yet because they are mounted by the main container.
+          command: ["sh", "-c", "mkdir -p /home/semaphore/.ssh && chmod 700 /home/semaphore/.ssh"]
+          volumeMounts:
+            - name: semaphore-persistent-storage
+              mountPath: /home/semaphore
+
+      containers:
+        - name: semaphore
+          image: semaphoreui/semaphore:latest
+          ports:
+            - containerPort: 3000
+              name: http
+          resources:
+            requests:
+              cpu: "200m"
+              memory: "512Mi"
+            limits:
+              cpu: "1"
+              memory: "1Gi"
+          env:
+            - name: SEMAPHORE_DB_DIALECT
+              value: "postgres"
+            - name: SEMAPHORE_DB_PORT
+              value: "5432"
+            - name: SEMAPHORE_DB_USER
+              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_DB_USER } }
+            - name: SEMAPHORE_DB_HOST
+              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_DB_HOST } }
+            - name: SEMAPHORE_DB
+              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_DB_NAME } }
+            - name: SEMAPHORE_ADMIN
+              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_ADMIN_USERNAME } }
+            - name: SEMAPHORE_ADMIN_NAME
+              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_ADMIN_USERNAME } }
+            - name: SEMAPHORE_ADMIN_EMAIL
+              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_ADMIN_EMAIL } }
+            - name: SEMAPHORE_SCHEDULE_TIMEZONE
+              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_SCHEDULE_TIMEZONE } }
+            - name: SEMAPHORE_DB_PASS
+              valueFrom: { secretKeyRef: { name: semaphore-secrets, key: db-password } }
+            - name: SEMAPHORE_ADMIN_PASSWORD
+              valueFrom: { secretKeyRef: { name: semaphore-secrets, key: admin-password } }
+            - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
+              valueFrom: { secretKeyRef: { name: semaphore-secrets, key: access-key-encryption } }
+          volumeMounts:
+            - name: semaphore-persistent-storage
+              mountPath: /home/semaphore
+            - name: semaphore-persistent-storage
+              mountPath: /tmp/semaphore
+              subPath: tmp
+            - name: ssh-keys-volume
+              mountPath: /home/semaphore/.ssh/id_ed25519
+              subPath: id_ed25519
+              readOnly: true
+            - name: ssh-keys-volume
+              mountPath: /home/semaphore/.ssh/id_ed25519.pub
+              subPath: id_ed25519.pub
+              readOnly: true
+      volumes:
+        - name: semaphore-persistent-storage
+          persistentVolumeClaim:
+            claimName: semaphore-data-pvc
+        - name: ssh-keys-volume
+          secret:
+            secretName: semaphore-secrets
+            defaultMode: 384 # 0600
+            items:
+              - key: id_ed25519
+                path: id_ed25519
+              - key: id_ed25519.pub
+                path: id_ed25519.pub
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: semaphore-service
+  namespace: semaphore
+spec:
+  type: NodePort
+  selector:
+    app: semaphore
+  ports:
+    - name: http
+      protocol: TCP
+      port: 3000
+      targetPort: 3000
+      nodePort: 31011

kubernetes-templates/traefik-dashboard.yml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-dashboard-nodeport
+  namespace: kube-system
+spec:
+  type: NodePort
+  selector:
+    app.kubernetes.io/name: traefik
+  ports:
+    - name: admin
+      protocol: TCP
+      port: 8080
+      targetPort: 8080
+      nodePort: 30000