Added tautulli reverse proxy conf

Reviewed-on: #2

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "prettier.bracketSpacing": false
+}

README.md

@@ -117,4 +117,3 @@ This repo is really standing on the shoulders of giants. Thank you to all those
 
 - https://docs.k3s.io/installation/kube-dashboard
 - https://www.phillipsj.net/posts/k3s-enable-nfs-storage/
-- https://www.authelia.com/integration/kubernetes/chart/

inventory/my-cluster/group_vars/all.yml

@@ -7,9 +7,6 @@ systemd_dir: /etc/systemd/system
 # Set your timezone
 system_timezone: "Europe/Lisbon"
 
-# interface which will be used for flannel
-flannel_iface: "eth0"
-
 # apiserver_endpoint is virtual ip-address which will be configured on each master
 apiserver_endpoint: "10.0.3.1"
 
@@ -84,3 +81,145 @@ cloudflare_api_key: !vault |
   6631393564333230370a303634643030346166383235643666356164393232643832333238313664
   38346161306138653735303861646638653830633938326566663136393862643264353437623963
   3462616435653132623563316231343739333761653365333437
+
+dns_cloudflare_api_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          61306235353261303235646331356666643339393164333762303730646563646633626466306436
+          6565303031366262303161323536323236613861373536330a346564306238633461363765623030
+          33343566363163623532386463616431313865316563616162336633353162316134363266363263
+          6331353838343662380a303565643337653164613637323131363037613861306535326538333030
+          64313165343933343535623731393536396332613336316239363764653565346535666531656433
+          6131646439656638323561643264613834356662363332323835
+
+dns_cloudflare_email: cloudflare@lino.cooking
+
+cloudflare_ddns_api_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          32353865663337376239333232376630616436643435343862346164353466356563623930386461
+          3132306361653330356663613534626463373133616132620a313161316137313838666534313737
+          34336161373334356630326432626139666566316663373630656538333331656461373631613931
+          6364313538663464350a343061383835663264616238353965656635343564306635303830343266
+          38396530393133646133643232363061386265373234373832656135393764346462666566656264
+          3635316261393863393736383132386133313666306234343666
+
+homeassistant_pwd: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          34623865646265653733666136316164303765633036616464626133306339393032336465613735
+          3139333561366530383535363834316138303338313030390a306561366265643737623833633837
+          31353332646635353339373937393134376566643539363563613061393731623931643931336566
+          3039626631643930650a393163643534353731316261376638643736623232366431396136313666
+          37613864396630306335626532633832653633346465316332356236393239653063393630323461
+          3862316639643265373166373330333936303233383333653362
+
+gameyfin_pwd: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          64653937643761616366313263363039336262313832623035313635353638393633643330303733
+          3030373063343264633265616638373463383562626132650a643163333961353861626438356339
+          64326161373332396234656664343736356566356561306334306230343335323733306533343563
+          3639656666313434350a303432393831323338313331386262373130633930396365653836633965
+          35623030313533313462666464333339633832643261383839383432366462313262386236346434
+          39646434653137633062346234373965323036636663326437346238373764363261633736356532
+          346437633064623331653362303034653463
+
+igdb_client_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          36343238373066633635656365376331626231396666373039636330376132393861373739323061
+          3662366362633461383730633765323530316437626639630a613337333163393539653830366235
+          36636139666332393366366166343064623931326634633161666264333038643537386363663962
+          6430613364653562320a313934393633386262343933363835663639313630653631356563346435
+          61616130336366613066316134303866323838653938393630623763383762316432
+
+igdb_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          65383235643965353066343661616633353163393137326661363862353131333362383336613465
+          3730323833613961326161643730363434643363346138610a313230656534626137373232653633
+          30303163646261666461366161336131326134633832643834623438363137323531393865613761
+          3137316331353531350a306636306233326637623030666634353066396663623663386235393238
+          63303939666561353032396135646666623564616562306637613430663933626530
+
+mastodon_db_user: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          38613037323362636233336166643239636334333333366137306335643836636338343938303135
+          3134373363343964613236313562393966363033623231310a613236383134616566646466633334
+          61323031393663363438336265613062636432343338383936323161313264326662346538366436
+          3863633263643239390a383664663636343934383333623830333931326330613861353333643663
+          66303131633433376562643938313333383335323665643030623461623836643362633034613834
+          61626134386236616538366332313032383732356638356531613534313638316165383665313939
+          633035373238333032303637663366326431
+
+mastodon_db_name: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          64376131373562633437313062366334663738336463613938653564323831316531373233396634
+          3530613830303835666431366438376163383433623561350a653834353761616462316161613037
+          64353430643062316465363764653830313065363261356231356466613533643565613562613437
+          3338303632653865330a326337373830396230343764333231356134616365643138663731613264
+          61323132363839666365326665323236373935666361663063343763363062333130663135366530
+          30366231633932356662663863343330366266366538326232623136363934643334656366343763
+          363833363666643162396434636536323166
+
+mastodon_db_pass: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          66383339653334616233336439376164616532333062393161346238643839393161653932386265
+          3765376366323334613739316162336433623330373131360a653838663436663166373933353064
+          30646663316631653236383437616637396331616339323439353238643866633732323438636138
+          3530306635663631340a306237356664653033663865373964333835613733373565616638363864
+          36333139633033333538306335336165306537303265396631616530366534643465323232336334
+          33636635656130633131623437323764326565656635373265653065646135633066383561643033
+          373333313535343534346331643865616539
+
+mastodon_key_base: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          33346261623634626666383762613065613865306530363831303032656335636332393564653030
+          3866306433323432643930326133303831633437393265620a643234376332336262636364363866
+          33396431653531626538396266626337623735666165636163616262393263373065356330343139
+          3935356133653332370a313039366431343734363430353966386534363234316666613335353562
+          36316435363862646437333431303430613138353338663233646130636436316366323831343531
+          37623063656132336135313964333134323830373761316262386433363337303964366163313265
+          61376438386466636332383932346431313537656332656362376630646565626130303939313432
+          36646233633434383565386465376238373065303831326162386331653631633962353035376266
+          33653332316563333138336439393839336263393438333663383536663834396365666332356334
+          62316264633161363233346263366164643136656464373963303539623465383734326664386130
+          633539303831656364653861336263613432
+
+mastodon_otp_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          65316136326539313931396665656663356536636530613533306531663965303933643939643866
+          3635646438363739303730343834623035613135623130390a316463366362386465353134663264
+          64393337663866333333636635656535373064356263666161633033643635366533653530643336
+          6236396264303463350a306333373231343566653939306564323332633237343463353566343836
+          31323337633238393761656133613230393235663261383961616266373165376263376666333032
+          62313033383339643438376662613235333464323566323763623031616531303238386334623133
+          62653637323034613934313065646565323363313535653931306434393136663961663634313232
+          33653933373537333834363538343432643037646165386633363334613566653538353464303839
+          63373632653235376338336332303064356363653537333363326432306139666238393966306535
+          66633266313465333066613161393734353263366561643865323666633733656439386564326233
+          666338346237313564313937633466373937
+
+mastodon_vapid_private_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          38396438623163636339353633356339363435616262303865663834633436326331363365326433
+          6438633038623639346566376233356339333832383939370a353533356630346163633434346533
+          35386565386438383665623661653533646530623337373334356336396636376630356232656632
+          6634376435383163300a613635613633383765646363643563393062653465353663353935333262
+          35313830623635393737316337336436373730303963303962393365643165656164303633656233
+          3766303666323931623230623533316139666265363231356237
+
+mastodon_vapid_public_key: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          61653763663734616263633063323466333064636230643263383935313134306163383135353131
+          6166383263353435306333336131373431313363373334330a383031303163346238343061356537
+          36653764366265323165336161303965353434366262616464646162353038353665363132616630
+          6465353939316534340a626533343835303433383531373666643462326162653535313966373963
+          65636561633532613166356666303833306332656266383237363561663239616139666465383532
+          65613361663534616533343631386634316661616132383035333734353561643934353339373832
+          34626531373530306464336437383636633830616336393265373934613030386534323335303436
+          32373034336162346364643139353961323831636134313538333162373665373330636564306162
+          3337
+
+gmail_smtp_pass: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          31396436653866313237616361636439343765323730383231633739643433646365383137343037
+          3535373866653261303761396163373334383461323661380a376561663864346633646230633531
+          35326435323434386564363037383961383934363163653635346233306139303664323037383435
+          3763313639656566620a623639386437353662316631316638363862323334323838643037336464
+          64373730623035616464303230626462666166636236363033633132363236306132

inventory/my-cluster/host_vars/cloudflare-ddns

@@ -1,5 +1,6 @@
 ---
 
 ansible_user: root
-ansible_host: 10.0.3.106
+ansible_host: 10.0.2.16
 ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 607

inventory/my-cluster/host_vars/dahua-to-mqtt

@@ -1,5 +1,6 @@
 ---
 
 ansible_user: root
-ansible_host: 10.0.3.105
+ansible_host: 10.0.2.17
 ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 608

inventory/my-cluster/host_vars/daruk

@@ -1,14 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.6
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.6
-k3s_mac_addr: DE:05:FF:02:47:D8
-k3s_hostname: k3s-agent-daruk
-k3s_lxc_host: 10.0.3.6
-k3s_vm_host: 10.0.3.106
-k3s_cores: 8
-k3s_memory: 4096
-k3s_disk: 150
-k3s_vmid: 606
-k3s_template_id: 900

inventory/my-cluster/host_vars/epona

@@ -1,14 +1,10 @@
 ---
+
 ansible_user: root
 ansible_host: 10.0.2.2
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 ip_addr: 10.0.2.2
-k3s_mac_addr: de:05:ff:02:47:d7
-k3s_hostname: k3s-master-epona
-k3s_lxc_host: 10.0.3.2
-k3s_vm_host: 10.0.3.102
-k3s_cores: 4
-k3s_memory: 8192
-k3s_disk: 75
-k3s_vmid: 601
-k3s_template_id: 901
+
+# interface which will be used for flannel
+
+flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/folding

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.19
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 610

inventory/my-cluster/host_vars/frigate

@@ -3,3 +3,4 @@
 ansible_user: root
 ansible_host: 10.0.2.14
 ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 605

inventory/my-cluster/host_vars/hyrule

@@ -1,5 +1,6 @@
 ---
 
 ansible_user: root
-ansible_host: 10.0.3.102
+ansible_host: 10.0.0.2
 ansible_ssh_pass: "{{ proxmox_api_password }}"
+

inventory/my-cluster/host_vars/immich

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.18
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 609

inventory/my-cluster/host_vars/impa

@@ -0,0 +1,9 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.3.111
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+
+# interface which will be used for flannel
+
+flannel_iface: "eth0"

inventory/my-cluster/host_vars/k3s-master-mipha

@@ -1,5 +0,0 @@
----
-
-ansible_user: root
-ansible_host: 10.0.3.103
-ansible_ssh_pass: "{{ proxmox_api_password }}"

inventory/my-cluster/host_vars/mastodon

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.20
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 611

inventory/my-cluster/host_vars/mipha

@@ -3,12 +3,5 @@ ansible_user: root
 ansible_host: 10.0.2.3
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 ip_addr: 10.0.2.3
-k3s_mac_addr: 0e:a0:ff:8c:70:df
-k3s_hostname: k3s-master-mipha
-k3s_lxc_host: 10.0.3.3
-k3s_vm_host: 10.0.3.103
-k3s_cores: 4
-k3s_memory: 6144
-k3s_disk: 75
-k3s_vmid: 602
-k3s_template_id: 902
+# interface which will be used for flannel
+flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/revali

@@ -3,12 +3,5 @@ ansible_user: root
 ansible_host: 10.0.2.4
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 ip_addr: 10.0.2.4
-k3s_mac_addr: 32:47:89:3f:1a:e2
-k3s_hostname: k3s-agent-revali
-k3s_lxc_host: 10.0.3.4
-k3s_vm_host: 10.0.3.104
-k3s_cores: 2
-k3s_memory: 4096
-k3s_disk: 200
-k3s_vmid: 603
-k3s_template_id: 903
+# interface which will be used for flannel
+flannel_iface: "vmbr0"

inventory/my-cluster/host_vars/swag

@@ -1,5 +1,6 @@
 ---
 
 ansible_user: root
-ansible_host: 10.0.3.104
+ansible_host: 10.0.2.15
 ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 606

inventory/my-cluster/host_vars/tautulli

@@ -0,0 +1,6 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.2.21
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+vmid: 612

inventory/my-cluster/host_vars/tingle

@@ -0,0 +1,9 @@
+---
+
+ansible_user: root
+ansible_host: 10.0.3.110
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+
+# interface which will be used for flannel
+
+flannel_iface: "eth0"

inventory/my-cluster/host_vars/urbosa

@@ -1,14 +0,0 @@
----
-ansible_user: root
-ansible_host: 10.0.2.5
-ansible_ssh_pass: "{{ proxmox_api_password }}"
-ip_addr: 10.0.2.5
-# k3s_mac_addr: ee:36:d5:79:f8:ff
-# k3s_hostname: k3s-agent-urbosa
-# k3s_lxc_host: 10.0.3.5
-# k3s_vm_host: 10.0.3.105
-# k3s_cores: 3
-# k3s_memory: 2048
-# k3s_disk: 80
-# k3s_vmid: 604
-# k3s_template_id: 904

inventory/my-cluster/host_vars/urbosa-pihole

@@ -1,8 +1,7 @@
 ---
-
 ansible_user: root
 ansible_host: 10.0.2.11
 ansible_ssh_pass: "{{ proxmox_api_password }}"
 mac_addr: 72:2E:3C:F0:2A:B3
 vmid: 201
-node: urbosa
+node: mipha

inventory/my-cluster/host_vars/yuga

@@ -0,0 +1,7 @@
+---
+ansible_user: root
+ansible_host: 10.0.2.7
+ansible_ssh_pass: "{{ proxmox_api_password }}"
+ip_addr: 10.0.2.7
+# interface which will be used for flannel
+flannel_iface: "vmbr0"

inventory/my-cluster/hosts.ini

@@ -1,35 +1,21 @@
-[master]
-k3s-master-mipha
-k3s-master-epona
-
-[node]
-k3s-agent-revali
-k3s-agent-daruk
-
-[k3s_cluster:children]
-master
-node
-
 [lxc]
 frigate
-
-[lxc:children]
-k3s_cluster
-
-[k3s_hosts]
-mipha
-epona
-revali
-daruk
+swag
+cloudflare-ddns
+dahua-to-mqtt
+immich
+folding
+mastodon
+tautulli
 
 [baremetal]
 mipha
 epona
-urbosa
 revali
-daruk
+yuga
+hyrule
 
 [pihole]
 epona-pihole
 revali-pihole
-urbosa-pihole
+urbosa-pihole

playbook-cloudflare-ddns.yml

@@ -0,0 +1,19 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    # - role: cloudflare-ddns/provision/delete
+    - role: cloudflare-ddns/provision/create
+    - role: cloudflare-ddns/provision/start
+
+- hosts: revali
+  become: yes
+  roles:
+    - role: lxc/enable-ssh
+
+- hosts: cloudflare-ddns
+  become: yes
+  roles:
+    - role: cloudflare-ddns/update
+    - role: cloudflare-ddns/install-docker
+    - role: cloudflare-ddns/install-app

playbook-dahua-to-mqtt.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    # - role: dahua-to-mqtt/provision/delete
+    # - role: dahua-to-mqtt/provision/create
+    - role: dahua-to-mqtt/provision/start
+      vars:
+        vmid: 608
+
+- hosts: revali
+  become: yes
+  roles:
+    - role: dahua-to-mqtt/enable-ssh
+      vars:
+        vmid: 608
+
+- hosts: dahua-to-mqtt
+  become: yes
+  roles:
+    - role: dahua-to-mqtt/update
+    - role: dahua-to-mqtt/install-docker
+    - role: dahua-to-mqtt/install-app

playbook-folding.yml

@@ -0,0 +1,22 @@
+---
+# - hosts: localhost
+#   become: yes
+#   roles:
+#     - role: folding/provision/delete
+#     - role: folding/provision/create
+#     - role: folding/provision/start
+#       vars:
+#         vmid: 610
+
+- hosts: hyrule
+  become: yes
+  roles:
+    - role: folding/enable-ssh
+      vars:
+        vmid: 610
+
+- hosts: folding
+  become: yes
+  roles:
+    - role: folding/update
+    - role: folding/install-app

playbook-frigate.yml

@@ -18,7 +18,7 @@
 - hosts: epona
   become: yes
   roles:
-    - role: frigate/provision/enable-ssh
+    - role: lxc/enable-ssh
 
 - hosts: frigate
   become: yes

playbook-immich.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: immich/provision/delete
+    - role: immich/provision/create
+    - role: immich/provision/start
+      vars:
+        vmid: 609
+
+- hosts: hyrule
+  become: yes
+  roles:
+    - role: immich/enable-ssh
+      vars:
+        vmid: 609
+
+- hosts: immich
+  become: yes
+  roles:
+    - role: immich/update
+    - role: immich/install-docker
+    - role: immich/install-app

playbook-k3s.yml

@@ -1,56 +1,38 @@
 ---
-# - hosts: localhost
-#   gather_facts: no
+# - hosts: k3s_cluster
+#   gather_facts: yes
 #   become: yes
 #   roles:
-#     - role: k3s/provision/delete
-- hosts: localhost
-  gather_facts: no
-  become: yes
-  roles:
-    - role: k3s/provision/create
-- hosts: k3s_hosts
-  gather_facts: yes
-  become: yes
-  roles:
-    - role: k3s/provision/pre
-    - role: k3s/provision/cloud-init
-- hosts: localhost
-  gather_facts: no
-  become: yes
-  roles:
-    - role: k3s/provision/start
-- hosts: k3s_cluster
-  gather_facts: yes
-  become: yes
-  roles:
-    - role: prereq
-    - role: download
-- hosts: master
-  become: yes
-  roles:
-    - role: k3s/master
+#     - role: prereq
+#     - role: download
 
-- hosts: node
-  become: yes
-  roles:
-    - role: k3s/node
+# - hosts: master
+#   become: yes
+#   roles:
+#     - role: k3s/master
 
-- hosts: master
-  become: yes
-  roles:
-    - role: k3s/post
+# - hosts: node
+#   become: yes
+#   roles:
+#     - role: k3s/node
+
+# - hosts: master
+#   become: yes
+#   roles:
+#     - role: k3s/post
+
+# - hosts: master
+#   become: yes
+#   roles:
+#     - role: k3s/copy-config
 
-- hosts: master
-  become: yes
-  roles:
-    - role: k3s/copy-config
 - hosts: localhost
   become: yes
   roles:
-    - role: longhorn
-    - role: traefik
-    - role: nginx
-    - role: cert-manager
-    - role: authelia
-    - role: redis
+    # - role: traefik
+    # - role: cert-manager
+    # - role: authentik
+    - role: argocd
+    # - role: nginx
+    # - role: arr
+    # - role: redis

playbook-mastodon.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: mastodon/provision/delete
+    - role: mastodon/provision/create
+    - role: mastodon/provision/start
+      vars:
+        vmid: 611
+
+- hosts: epona
+  become: yes
+  roles:
+    - role: mastodon/enable-ssh
+      vars:
+        vmid: 611
+
+- hosts: mastodon
+  become: yes
+  roles:
+    - role: mastodon/update
+    - role: mastodon/install-docker
+    - role: mastodon/install-app

playbook-swag.yml

@@ -0,0 +1,19 @@
+---
+# - hosts: localhost
+#   become: yes
+#   roles:
+#     - role: swag/provision/delete
+#     - role: swag/provision/create
+#     - role: swag/provision/start
+
+# - hosts: mipha
+#   become: yes
+#   roles:
+#     - role: lxc/enable-ssh
+
+- hosts: swag
+  become: yes
+  roles:
+    # - role: swag/update
+    # - role: swag/install-docker
+    - role: swag/install-app

playbook-tautulli.yml

@@ -0,0 +1,23 @@
+---
+- hosts: localhost
+  become: yes
+  roles:
+    - role: tautulli/provision/delete
+    - role: tautulli/provision/create
+    - role: tautulli/provision/start
+      vars:
+        vmid: 612
+
+- hosts: epona
+  become: yes
+  roles:
+    - role: tautulli/enable-ssh
+      vars:
+        vmid: 612
+
+- hosts: tautulli
+  become: yes
+  roles:
+    - role: tautulli/update
+    - role: tautulli/install-docker
+    - role: tautulli/install-app

playbook-update-lxc.yml

@@ -0,0 +1,15 @@
+---
+- hosts: frigate
+  become: yes
+  roles:
+    - role: frigate/update
+
+- hosts: cloudflare-ddns
+  become: yes
+  roles:
+    - role: cloudflare-ddns/update
+
+- hosts: swag
+  become: yes
+  roles:
+    - role: swag/update

reset.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
 
-ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini
+ansible-playbook reset.yml -i inventory/my-cluster/hosts.ini --ask-become-pass --ask-vault-pass

roles/archive/argocd/tasks/main.yml

@@ -0,0 +1,27 @@
+---
+- name: Create argocd namespace
+  kubernetes.core.k8s:
+    name: argocd
+    kubeconfig: /Users/lino.silva/.kube/config
+    api_version: v1
+    kind: Namespace
+    state: present
+
+- name: Install argocd
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    namespace: argocd
+    definition: "{{ lookup('template', 'install.yml') | from_yaml }}"
+
+- name: Deploy forwardauth middleware
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
+
+- name: Deploy argocd - ingress
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"

roles/archive/argocd/templates/ingress.yml

@@ -0,0 +1,37 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd
+  namespace: argocd
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`argocd.lino.cooking`)
+      kind: Rule
+      services:
+        - name: argocd-server
+          port: 80
+      middlewares:
+        - name: argocd-forwardauth
+          namespace: argocd
+    - match: Host(`argocd.lino.cooking`) && Headers(`Content-Type`, `application/grpc`)
+      kind: Rule
+      services:
+        - name: argocd-server
+          port: 80
+          scheme: h2c
+    - match: "Host(`argocd.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      kind: Rule
+      priority: 15
+      services:
+        - kind: Service
+          # Or, to use an external Outpost, create an ExternalName service and reference that here.
+          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
+          name: authentik
+          port: 9000
+  tls:
+    secretName: lino-cooking-tls

roles/archive/argocd/templates/middleware-forwardauth.yml

@@ -0,0 +1,21 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: argocd-forwardauth
+  namespace: argocd
+spec:
+  forwardAuth:
+    address: https://argocd.lino.cooking/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

roles/archive/arr/tasks/main.yml

@@ -0,0 +1,64 @@
+---
+# - name: Create a arr-apps namespace
+#   kubernetes.core.k8s:
+#     name: arr-apps
+#     kubeconfig: /Users/lino.silva/.kube/config
+#     api_version: v1
+#     kind: Namespace
+#     state: present
+
+- name: Deploy arr - deployment
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'deployment.yml') | from_yaml }}"
+  loop:
+    - { name: 'radarr', port: 7878 }
+    - { name: 'prowlarr', port: 9696 }
+    - { name: 'sonarr', port: 8989 }
+    - { name: 'overseerr', port: 5055 }
+    - { name: 'transmission', port: 9091 }
+    - { name: 'bazarr', port: 6767 }
+    - { name: 'lidarr', port: 8686 }
+
+- name: Deploy arr services
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
+  loop:
+    - { name: 'radarr', port: 7878 }
+    - { name: 'prowlarr', port: 9696 }
+    - { name: 'sonarr', port: 8989 }
+    - { name: 'overseerr', port: 5055 }
+    - { name: 'transmission', port: 9091 }
+    - { name: 'bazarr', port: 6767 }
+    - { name: 'lidarr', port: 8686 }
+
+- name: Deploy forwardauth middleware
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
+  loop:
+    - radarr
+    - prowlarr
+    - sonarr
+    - overseerr
+    - transmission
+    - bazarr
+    - lidarr
+
+- name: Deploy arr - ingress
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'ingress.yml') | from_yaml }}"
+  loop:
+    - { name: 'radarr', port: 7878 }
+    - { name: 'prowlarr', port: 9696 }
+    - { name: 'sonarr', port: 8989 }
+    - { name: 'overseerr', port: 5055 }
+    - { name: 'transmission', port: 9091 }
+    - { name: 'bazarr', port: 6767 }
+    - { name: 'lidarr', port: 8686 }

roles/archive/arr/templates/deployment.yml

@@ -0,0 +1,30 @@
+---
+- kind: Deployment
+  apiVersion: apps/v1
+  metadata:
+    name: {{ item.name }}
+    namespace: default
+    labels:
+      app: {{ item.name }}
+  spec:
+    replicas: 1
+    progressDeadlineSeconds: 600
+    revisionHistoryLimit: 2
+    strategy:
+      type: Recreate
+    selector:
+      matchLabels:
+        app: {{ item.name }}
+    template:
+      metadata:
+        labels:
+          app: {{ item.name }}
+      spec:
+        containers:
+          - name: {{ item.name }}
+            image: linuxserver/{{ item.name }}
+            ports:
+              - name: app-port
+                containerPort: {{ item.port }}
+                hostPort: {{ item.port }}
+                protocol: TCP

roles/archive/arr/templates/ingress.yml

@@ -0,0 +1,32 @@
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ item.name }}
+  namespace: default
+  annotations:
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`{{ item.name }}.lino.cooking`)
+      kind: Rule
+      services:
+        - name: {{ item.name }}
+          port: {{ item.port }}
+      middlewares:
+        - name: default-headers
+        - name: {{ item.name }}-forwardauth
+          namespace: traefik
+    - match: "Host(`{{ item.name }}.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      kind: Rule
+      priority: 15
+      services:
+        - kind: Service
+          # Or, to use an external Outpost, create an ExternalName service and reference that here.
+          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
+          name: authentik
+          port: 9000
+  tls:
+    secretName: lino-cooking-tls

roles/archive/arr/templates/middleware-forwardauth.yml

@@ -0,0 +1,21 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ item }}-forwardauth
+  namespace: traefik
+spec:
+  forwardAuth:
+    address: https://{{ item }}.lino.cooking/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

roles/archive/arr/templates/service.yml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ item.name }}
+  namespace: default
+spec:
+  selector:
+    app: {{ item.name }}
+  ports:
+    - name: http
+      targetPort: {{ item.port }}
+      port: {{ item.port }}

roles/archive/authentik/tasks/main.yml

@@ -1,8 +1,8 @@
 ---
-- name: Add traefik helm repo
+- name: Add authentik helm repo
   kubernetes.core.helm_repository:
-    name: authelia
-    repo_url: "https://charts.authelia.com"
+    name: authentik
+    repo_url: "https://charts.goauthentik.io"
 
 - name: Update the repository cache
   kubernetes.core.helm:
@@ -12,9 +12,10 @@
     state: absent
     update_repo_cache: true
 
-- name: Deploy latest version of Authelia chart inside
+- name: Deploy latest version of Authentik chart inside
   kubernetes.core.helm:
     kubeconfig: /Users/lino.silva/.kube/config
-    name: authelia
-    chart_ref: authelia/authelia
+    name: authentik
+    namespace: traefik
+    chart_ref: authentik/authentik
     values: "{{ lookup('template', 'values.yml') | from_yaml }}"

roles/archive/authentik/templates/values.yml

@@ -0,0 +1,22 @@
+authentik:
+  secret_key: "fKkVEXDoUdGYwoNb$97xQuG9uw7zu$rFDe6y7!UZ&6$5*cyx6h"
+  # This sends anonymous usage-data, stack traces on errors and
+  # performance data to sentry.io, and is fully opt-in
+  error_reporting:
+    enabled: true
+  postgresql:
+    password: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
+
+ingress:
+  enabled: true
+  hosts:
+    - host: auth.lino.cooking
+      paths:
+        - path: "/"
+          pathType: Prefix
+
+postgresql:
+  enabled: true
+  postgresqlPassword: "uNP9W3zMpp4853QF9f@mpJDEXprca@tX@cEj3#BLFR&WFZVBU^"
+redis:
+  enabled: true

roles/archive/k3s/dashboard/tasks/main.yml

@@ -0,0 +1,12 @@
+---
+- name: Deploy admin user
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'dashboard.admin-user.yml') | from_yaml }}"
+
+- name: Deploy admin user role
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'dashboard.admin-user-role.yml') | from_yaml }}"

roles/archive/k3s/master/defaults/main.yml

@@ -5,7 +5,7 @@ server_init_args: >-
     {% if ansible_hostname == hostvars[groups['master'][0]]['ansible_hostname'] %}
       --cluster-init
     {% else %}
-      --server https://{{ hostvars[groups['master'][0]].k3s_node_ip }}:6443
+      --server https://{{ hostvars[groups['master'][0]].ansible_host }}:6443
     {% endif %}
     --token {{ k3s_token }}
   {% endif %}

roles/archive/nginx/tasks/main.yml

@@ -11,6 +11,12 @@
     state: present
     definition: "{{ lookup('template', 'service.yml') | from_yaml }}"
 
+- name: Deploy forwardauth middleware
+  kubernetes.core.k8s:
+    kubeconfig: /Users/lino.silva/.kube/config
+    state: present
+    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
+
 - name: Deploy nginx - ingress
   kubernetes.core.k8s:
     kubeconfig: /Users/lino.silva/.kube/config

roles/archive/nginx/templates/ingress.yml

@@ -10,11 +10,6 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`www.nginx.lino.cooking`)
-      kind: Rule
-      services:
-        - name: nginx
-          port: 80
     - match: Host(`nginx.lino.cooking`)
       kind: Rule
       services:
@@ -22,5 +17,16 @@ spec:
           port: 80
       middlewares:
         - name: default-headers
+        - name: nginx-middleware-forwardauth
+          namespace: traefik
+    - match: "Host(`nginx.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      kind: Rule
+      priority: 15
+      services:
+        - kind: Service
+          # Or, to use an external Outpost, create an ExternalName service and reference that here.
+          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
+          name: authentik
+          port: 9000
   tls:
     secretName: lino-cooking-tls

roles/archive/nginx/templates/middleware-forwardauth.yml

@@ -0,0 +1,21 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: nginx-middleware-forwardauth
+  namespace: traefik
+spec:
+  forwardAuth:
+    address: https://nginx.lino.cooking/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

roles/archive/prereq/tasks/main.yml

@@ -7,30 +7,6 @@
   ansible.builtin.apt:
     upgrade: full
 
-- name: Install QMEU Guest Agent
-  ansible.builtin.apt:
-    name: qemu-guest-agent
-    update_cache: yes
-    state: present
-
-- name: Install NFS-Common
-  ansible.builtin.apt:
-    name: nfs-common
-    update_cache: yes
-    state: present
-
-- name: Install open-iscsi
-  ansible.builtin.apt:
-    name: open-iscsi
-    update_cache: yes
-    state: present
-
-- name: Install util-linux
-  ansible.builtin.apt:
-    name: util-linux
-    update_cache: yes
-    state: present
-
 - name: Set same timezone on every Server
   community.general.system.timezone:
     name: "{{ system_timezone }}"
@@ -112,6 +88,3 @@
     owner: root
     group: root
     mode: a+x
-
-- name: Reboot
-  ansible.builtin.reboot:

roles/archive/traefik/tasks/main.yml

@@ -34,11 +34,12 @@
     state: present
     definition: "{{ lookup('template', 'secret-dashboard.yml') | from_yaml }}"
 
-- name: Deploy dashboard middleware for auth
+- name: Deploy forwardauth middleware
   kubernetes.core.k8s:
     kubeconfig: /Users/lino.silva/.kube/config
     state: present
-    definition: "{{ lookup('template', 'dashboard-middleware.yml') | from_yaml }}"
+    namespace: traefik
+    definition: "{{ lookup('template', 'middleware-forwardauth.yml') | from_yaml }}"
 
 - name: Create dashboard ingress
   kubernetes.core.k8s:

roles/archive/traefik/templates/dashboard-ingress.yml

@@ -12,10 +12,19 @@ spec:
     - match: Host(`traefik-dash.lino.cooking`)
       kind: Rule
       middlewares:
-        - name: traefik-dashboard-basicauth
+        - name: traefik-dash-middleware-forwardauth
           namespace: traefik
       services:
         - name: api@internal
           kind: TraefikService
+    - match: "Host(`traefik-dash.lino.cooking`) && PathPrefix(`/outpost.goauthentik.io/`)"
+      kind: Rule
+      priority: 15
+      services:
+        - kind: Service
+          # Or, to use an external Outpost, create an ExternalName service and reference that here.
+          # See https://kubernetes.io/docs/concepts/services-networking/service/#externalname
+          name: authentik
+          port: 9000
 #  tls:
 #    secretName: lino-cooking-staging-tls

roles/archive/traefik/templates/middleware-forwardauth.yml

@@ -0,0 +1,20 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: traefik-dash-middleware-forwardauth
+spec:
+  forwardAuth:
+    address: https://traefik-dash.lino.cooking/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

roles/archive/traefik/templates/values.yml

@@ -30,6 +30,7 @@ providers:
     enabled: true
     ingressClass: traefik-external
     allowExternalNameServices: true
+    allowCrossNamespace: true
   kubernetesIngress:
     enabled: true
     publishedService:

roles/authelia/defaults/main.yml

@@ -1 +0,0 @@
----