pi-ux-ce/Terraform_kube
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

adding all missed external_manifests

Browse Source
This commit is contained in:
pi-ux-ce
2026-03-05 21:07:28 +00:00
parent 17e6ea2251
commit 400e8f00fe
22 changed files with 508 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
external_manifests/bitwarden/bitwarden.backup_db.cronjob.yaml
+46
View File
@@ -0,0 +1,46 @@
apiVersion: batch/v1
kind: CronJob
metadata:
name: bitwarden-calendar-backup
namespace: bitwarden
spec:
schedule: "0 0 * * *"
jobTemplate:
spec:
backoffLimit: 4
ttlSecondsAfterFinished: 100
template:
spec:
containers:
- name: bitwarden-database-backup
image: mcr.microsoft.com/mssql-tools
envFrom:
- secretRef:
name: bitwarden-mssql-db-terraform
optional: false
command: ["/bin/sh","-c"]
#args: ["mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "]
args: ["sleep 3600"]
volumeMounts:
- name: backup
mountPath: /backup
volumes:
- name: backup
persistentVolumeClaim:
claimName: bitwarden-database-backup
restartPolicy: Never
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: bitwarden-database-backup
namespace: bitwarden
annotations:
fileType: Backup
spec:
storageClassName: nfs-storage-fastaccess
accessModes:
- ReadWriteMany
resources:
requests:
storage: 2Gi
external_manifests/django/django-db.secret.yaml
-1
View File
@@ -6,6 +6,5 @@ data:
DB_USERNAME: ZGphbmdvX3VzZXJuYW1l
kind: Secret
metadata:
creationTimestamp: null
name: django-db-credentials
namespace: django
external_manifests/django/django-db.svc.yaml
+17
View File
@@ -0,0 +1,17 @@
---
apiVersion: v1
kind: Service
metadata:
name: django-db-nodeport
namespace: django
spec:
ports:
- name: http
nodePort: 32345
port: 5432
protocol: TCP
targetPort: 5432
selector:
app: django-db
type: NodePort
external_manifests/django/kubeconfig.secret.yaml
+1 -2
View File
File diff suppressed because one or more lines are too long
external_manifests/fail2ban/command.txt
+1
View File
@@ -0,0 +1 @@
kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload
external_manifests/fail2ban/fail2ban-nginx-http-auth-jail.configmap.yaml
+23
View File
@@ -0,0 +1,23 @@
apiVersion: v1
data:
nginx-http-auth.local: |
## Version 2022/08/06
# Fail2Ban jail configuration for nginx-http-auth
# To use more aggressive http-auth modes set filter parameter "mode" in jail.local:
# normal (default), aggressive (combines all), auth or fallback
# See "tests/files/logs/nginx-http-auth" or "filter.d/nginx-http-auth.conf" for usage example and details.
[nginx-http-auth]
enabled = false
port = http,https
filter = nginx-unauthorized
action = nginx-block-map
logpath = /var/log/nginx/backend_debug.log
maxretry = 5
kind: ConfigMap
metadata:
creationTimestamp: null
name: fail2ban-nginx-http-auth-jail
namespace: fail2ban
external_manifests/fail2ban/fail2ban-nginx-unauthorized-filter.configmap.yaml
+30
View File
@@ -0,0 +1,30 @@
apiVersion: v1
data:
nginx-unauthorized.local: |
## Version 2022/08/06
# Fail2Ban filter configuration for nginx unauthorized
[INCLUDES]
before = common.conf
[Definition]
#original
#failregex = ^<HOST>.*"(GET|POST|HEAD).*" (401) .*$
#try this one
failregex = ^<HOST> - .* "(?:GET|POST|HEAD) [^"]+" 401
^<HOST> - .* upstream_status=401
#for servarr
^<HOST> -.*"GET /login\?returnUrl=/&loginFailed=true HTTP/.*" 200
^<HOST> -.*"POST /login\?returnUrl=/&loginFailed=true HTTP/.*" 200
#for bitwarden
^<HOST> -.*"POST /identity/accounts/prelogin *HTTP/.*" 200
#actionban = touch /tmp/<name>.ban
#actionunban = touch /tmp/<name>.unban
kind: ConfigMap
metadata:
creationTimestamp: null
name: fail2ban-nginx-unauthorized-filter
namespace: fail2ban
external_manifests/fail2ban/fail2ban.Role.yaml
+19
View File
@@ -0,0 +1,19 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: role:service-acc
namespace: reverse-proxy
rules:
- apiGroups: [""]
resources:
- pods
- pods/exec
verbs:
- create
- list
- apiGroups: ["apps"]
resources:
- deployments
verbs:
- get
external_manifests/fail2ban/fail2ban.RoleBinding.yaml
+15
View File
@@ -0,0 +1,15 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: rolebinding:service-acc
namespace: reverse-proxy
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: role:service-acc
subjects:
- kind: ServiceAccount
name: kubectl-service-account
namespace: fail2ban
external_manifests/fail2ban/fail2ban.ServiceAccount.yaml
+6
View File
@@ -0,0 +1,6 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: kubectl-service-account
namespace: fail2ban
external_manifests/fail2ban/nginx-block-map-action.configmap.yaml
+58
View File
@@ -0,0 +1,58 @@
apiVersion: v1
data:
nginx-block-map.local: "## Version 2022/08/06\n# Fail2Ban configuration file for
black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use
'nginx-block-map' action you should define some special blocks in your nginx configuration,\n#
and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx
by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used
here as unique identifier for user):\n#\n# http {\n# ...\n# # maps to
check user is blacklisted (banned in f2b):\n# #map $arg_token_id $blck_lst_tok
{ include blacklisted-tokens.map; }\n# map $cookie_session_id $blck_lst_ses
{ include blacklisted-sessions.map; }\n# ...\n# # special log-format to
notify fail2ban about failures:\n# log_format f2b_session_errors '$msec failure
\"$cookie_session_id\" - $remote_addr - $remote_user '\n# ;# '\"$request\"
$status $bytes_sent '\n# # '\"$http_referer\" \"$http_user_agent\"';\n#\n#
\ # location checking blacklisted values:\n# location ... {\n# #
check banned sessionid:\n# if ($blck_lst_ses != \"\") {\n# try_files
\"\" @f2b-banned;\n# }\n# ...\n# # notify fail2ban about a failure
inside nginx:\n# error_page 401 = @notify-f2b;\n# ...\n# }\n#
\ ...\n# # location for return with \"403 Forbidden\" if banned:\n# location
@f2b-banned {\n# default_type text/html;\n# return 403 \"<br/><center>\n#
\ <b style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\">\n#
\ You are banned!</b></center>\";\n# }\n# ...\n# # location
to notify fail2ban about a failure inside nginx:\n# location @notify-f2b {\n#
\ access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n# }\n#
\ }\n# ...\n#\n# Note that quote-character (and possibly other special characters)
are not allowed currently as session-id.\n# Thus please add any session-id validation
rule in your locations (or in the corresponding backend-service), \n# like in
example below:\n#\n# location ... {\n# if ($cookie_session_id !~ \"^[\\w\\-]+$\")
{\n# return 403 \"Wrong session-id\"\n# }\n# ...\n# }\n#\n# The
parameters for jail corresponding log-format (f2b_session_errors):\n#\n# [nginx-blck-lst]\n#
\ filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"<F-ID>[^\"]+</F-ID>\"
- <ADDR>\n# usedns = no\n#\n# The same log-file can be used for IP-related jail
(additionally to session-related, to ban very bad IPs):\n#\n# [nginx-blck-ip]\n#
\ maxretry = 100\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure
\"[^\"]+\" - <ADDR>\n# usedns = no\n#\n\n[Definition]\n\n# path to configuration
of nginx (used to target nginx-instance in multi-instance system,\n# and as path
for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n#
cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd
= nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n#
command used to check whether nginx is running and configuration is valid:\nsrv_is_running
= [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt\n\n#
first test nginx is running and configuration is correct, hereafter send reload
signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n# %(srv_cmd)s
-s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n# fi;\n\nrestart_file
= /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep
20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action
= nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n#
Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush
= truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck
= \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"<fid>\"\n\nactionban = echo <ip>
| awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' >> '%(blck_lst_file)s';
%(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\&/g');
sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
kind: ConfigMap
metadata:
creationTimestamp: null
name: nginx-block-map-action
namespace: fail2ban
external_manifests/fail2ban/nginx-block-map.local
+124
View File
@@ -0,0 +1,124 @@
## Version 2022/08/06
# Fail2Ban configuration file for black-listing via nginx
#
# Author: Serg G. Brester (aka sebres)
#
# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
#
# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
#
# http {
# ...
# # maps to check user is blacklisted (banned in f2b):
# #map $arg_token_id $blck_lst_tok { include blacklisted-tokens.map; }
# map $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
# ...
# # special log-format to notify fail2ban about failures:
# log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
# ;# '"$request" $status $bytes_sent '
# # '"$http_referer" "$http_user_agent"';
#
# # location checking blacklisted values:
# location ... {
# # check banned sessionid:
# if ($blck_lst_ses != "") {
# try_files "" @f2b-banned;
# }
# ...
# # notify fail2ban about a failure inside nginx:
# error_page 401 = @notify-f2b;
# ...
# }
# ...
# # location for return with "403 Forbidden" if banned:
# location @f2b-banned {
# default_type text/html;
# return 403 "<br/><center>
# <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
# You are banned!</b></center>";
# }
# ...
# # location to notify fail2ban about a failure inside nginx:
# location @notify-f2b {
# access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
# }
# }
# ...
#
# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service),
# like in example below:
#
# location ... {
# if ($cookie_session_id !~ "^[\w\-]+$") {
# return 403 "Wrong session-id"
# }
# ...
# }
#
# The parameters for jail corresponding log-format (f2b_session_errors):
#
# [nginx-blck-lst]
# filter =
# datepattern = ^Epoch
# failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
# usedns = no
#
# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
#
# [nginx-blck-ip]
# maxretry = 100
# filter =
# datepattern = ^Epoch
# failregex = ^ failure "[^"]+" - <ADDR>
# usedns = no
#
[Definition]
# path to configuration of nginx (used to target nginx-instance in multi-instance system,
# and as path for the blacklisted map):
#srv_cfg_path = /etc/nginx/
srv_cfg_path = /blacklisted.d/
# cmd-line arguments to supply to test/reload nginx:
#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
srv_cmd = nginx
# pid file (used to check nginx is running):
srv_pid = /run/nginx.pid
# command used to check whether nginx is running and configuration is valid:
srv_is_running = [ -f "%(srv_pid)s" ]
srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt
# first test nginx is running and configuration is correct, hereafter send reload signal:
#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then
# %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
# fi;
restart_file = /restart-signal/restart.txt
blck_lst_reload = kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload
# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf
# Action definition:
actionstart_on_demand = false
actionstart = touch '%(blck_lst_file)s'
actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
actionstop = %(actionflush)s
actioncheck =
_echo_blck_row = printf '\%%s 1;\n' "<fid>"
actionban = kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- sh -c "echo 'deny <ip>;' > /etc/nginx/blacklisted.d/blacklisted-sessions.conf"; %(blck_lst_reload)s
actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s
external_manifests/immich/immich-db.secret.yaml
+3 -4
View File
@@ -1,11 +1,10 @@
apiVersion: v1
data:
DB_DATABASE_NAME: aW1taWNo
DB_HOST: aW1taWNodC1kYi1zdmM=
DB_HOST: aW1taWNoLWRiLXN2Yw==
DB_PASSWORD: U3Bvb24tQm9yb3VnaC1CYXNpczg=
DB_USERNAME: aW1taWNoX3VzZXJuYW1l
DB_USERNAME: aW1taWNo
kind: Secret
metadata:
creationTimestamp: null
name: immich-db-credentials
namespace: immicht
namespace: immich
external_manifests/paperless/Paperless.secret.yaml
+2 -2
View File
@@ -5,9 +5,9 @@ data:
POSTGRES_PASSWORD: cGFwZXJsZXNz
PAPERLESS_ADMIN_USER: YWRtaW4=
PAPERLESS_ADMIN_PASSWORD: YWRtaW4=
POSTGRES_HOST: cGFwZXItZGItc3Zj
POSTGRES_HOST: cGFwZXJsZXNzLWRiLXN2Yw==
kind: Secret
metadata:
name: paperless-credentials
namespace: paper
namespace: paperless
type: Opaque
external_manifests/paperless/emailproxy.config
+5
View File
@@ -0,0 +1,5 @@
[IMAP-1993]
documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
server_address = outlook.office365.com
server_port = 993
local_address = 127.0.0.1
external_manifests/paperless/emailproxyconfig.configmap.yml
+13
View File
@@ -0,0 +1,13 @@
apiVersion: v1
data:
emailproxy.config: |
[IMAP-1993]
documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
server_address = outlook.office365.com
server_port = 993
local_address = 127.0.0.1
kind: ConfigMap
metadata:
creationTimestamp: null
name: emailproxyconfig
namespace: paperless
external_manifests/paperless/paperless_backup_db.cronjob.yaml
+45
View File
@@ -0,0 +1,45 @@
apiVersion: batch/v1
kind: CronJob
metadata:
name: paperless-calendar-backup
namespace: paperless
spec:
schedule: "0 0 * * *"
jobTemplate:
spec:
backoffLimit: 4
ttlSecondsAfterFinished: 100
template:
spec:
containers:
- name: paperless-database-backup
image: alpine/psql
envFrom:
- secretRef:
name: paperless-db-terraform
optional: false
command: ["/bin/sh","-c"]
args: ["pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "]
volumeMounts:
- name: backup
mountPath: /backup
volumes:
- name: backup
persistentVolumeClaim:
claimName: paperless-database-backup
restartPolicy: Never
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: paperless-database-backup
namespace: paperless
annotations:
fileType: Backup
spec:
storageClassName: nfs-storage-fastaccess
accessModes:
- ReadWriteMany
resources:
requests:
storage: 2Gi
external_manifests/servarr/prowlarr.secret.yaml
-1
View File
@@ -6,6 +6,5 @@ data:
DB_USER: cHJvd2xhcnJfdXNlcm5hbWU=
kind: Secret
metadata:
creationTimestamp: null
name: prowlarr-credentials
namespace: bookstack
external_manifests/servarr/servarr-db.secret.yaml
-1
View File
@@ -6,6 +6,5 @@ data:
DB_USER: c2VydmFycl91c2VybmFtZQ==
kind: Secret
metadata:
creationTimestamp: null
name: servarr-db-credentials
namespace: servarr
external_manifests/stash/download.sh_curl_error_20250808.sh
+85
View File
@@ -0,0 +1,85 @@
#!/bin/bash
#install required packages
apk add curl wget
#named argument generation
skip_searching_gallery="${skip_searching_gallery:-false}"
while [ $# -gt 0 ]; do
if [[ $1 == "--"* ]]; then
v="${1/--/}"
declare "$v"="$2"
shift
fi
shift
done
#check if we will use a HTTP proxy or not
if [[ -z $http_proxy ]]; then
echo "not using proxy"
curl_command="curl"
else
echo "using proxy"
echo $http_proxy
curl_command="curl -x $http_proxy"
fi
#dowload from https://www.pornpics.com/pornstars/eiby-shine/
DESTINATION_FOLDER="/data"
PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888"
#BASE_URL="https://www.pornpics.com/pornstars/eiby-shine/"
#pornstars="eiby-shine"
#BASE_URL="https://www.pornpics.com/?q=shy+imp"
#pornstars="shy-imp"
#BASE_URL="https://www.pornpics.com/pornstars/gloria-sol/"
#pornstars="gloria-sol"
#BASE_URL="https://www.pornpics.com/pornstars/becky-summer"
#pornstars="becky-summer"
#clear files beforehand
echo "Pornstar: "$pornstars
echo "URL: "$BASE_URL
mkdir -p $DESTINATION_FOLDER/$pornstars
if [[ $skip_searching_gallery == true ]]; then
echo "not looping through galleries"
echo "using existing file instead"
#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt with the existing URL , in this condition,
#no deletion of this file
else
echo "looping through galleries"
#because we will re-generate this file, can be emptied
echo "" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
$curl_command -s $BASE_URL | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://www.pornpics.com/galleries/" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
fi
echo "" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt
for f in $(cat $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do
echo "$curl_command $f"
$curl_command "$f"
$curl_command "$f" | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/1280" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt
echo $f
done
for g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do
$curl_command -O --output-dir $DESTINATION_FOLDER/$pornstars "$g"
# wget -e use_proxy=yes -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars
echo $g
done
exit 0
external_manifests/tdarr/tdarr.svc.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: tdarr-svc-ext
namespace: servarr
spec:
ports:
- name: tdarr
nodePort: 30266
port: 8266
protocol: TCP
targetPort: 8266
selector:
app: tdarr
type: NodePort
external_manifests/wikijs/wikijs-db.secret.yaml
-1
View File
@@ -6,6 +6,5 @@ data:
DB_USER: d2lraWpzX3VzZXJuYW1l
kind: Secret
metadata:
creationTimestamp: null
name: wikijs-db-credentials
namespace: wikijs