Update ghcr.io/juanfont/headscale Docker tag to v0.28.0

https://github.com/cilium/cilium/issues/38559

.gitlab-ci.yml

@@ -1,54 +0,0 @@
-# yaml-language-server: $schema=https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json
-default:
-  tags:
-    - nix
-
-include:
-  - project: oceanbox/gitlab-ci
-    ref: v4.5
-    file: template/Base.gitlab-ci.yml
-# stages:
-# - release
-
-# image:
-# name: alpine/helm:latest
-# entrypoint: ["/bin/bash", "-c"]
-
-# release:
-# stage: release
-# rules:
-# - if: "$CI_COMMIT_BRANCH =~ /^main/"
-# when: always
-# - when: never
-# script:
-# - |
-# cd $CI_PROJECT_DIR
-# for i in $(git show --pretty="" --name-only | grep '^charts/.*/Chart.yaml' | cut -d/ -f2); do
-# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-# if [ ! -z $pack ]; then
-# chart=$(basename $pack)
-# curl --request POST \
-# --user gitlab-ci-token:$CI_JOB_TOKEN \
-# --form "chart=@${chart}" \
-# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-# fi
-# done
-
-# rebuild:
-# stage: release
-# rules:
-# - when: manual
-# allow_failure: true
-# script:
-# - |
-# cd $CI_PROJECT_DIR
-# for i in $(find ./charts -maxdepth 2 -name Chart.yaml | cut -d/ -f3); do
-# pack=$(helm package ./charts/$i | sed 's/Success.*: \(.*\)/\1/')
-# if [ ! -z $pack ]; then
-# chart=$(basename $pack)
-# curl --request POST \
-# --user gitlab-ci-token:$CI_JOB_TOKEN \
-# --form "chart=@${chart}" \
-# "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/helm/api/stable/charts"
-# fi
-# done

bootstrap/helmfile-cmp/deploy.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-img=registry.gitlab.com/oceanbox/manifests/helmfile-cmp
+img=git.oceanbox.io/platform/manifests/helmfile-cmp
 tag=${1:-latest}
 
 docker build -t "${img}":"${tag}" .

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.35.2
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.35.2
+appVersion: v1.42.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: registry.gitlab.com/oceanbox/poseidon/atlantis
-  tag: v1.35.2
+  tag: v1.42.2
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -116,6 +116,5 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
 diagrid-dashboard:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.35.2
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.35.2"
+appVersion: "v1.42.2"

charts/codex/values.yaml

@@ -6,11 +6,11 @@
 replicaCount: 1
 # This sets the container image more information can be found here: https://kubernetes.io/docs/concepts/containers/images/
 image:
-  repository: registry.gitlab.com/oceanbox/poseidon/codex
+  repository: git.oceanbox.io/oceanbox/poseidon/codex
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.35.2
+  tag: v1.42.2
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/docs/.helmignore

@@ -0,0 +1,26 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+base/
+prod/
+staging/
+review/

charts/docs/Chart.yaml

@@ -0,0 +1,18 @@
+apiVersion: v2
+name: docs
+description: Oceanbox Documentation
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+version: v0.1.0
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application.
+appVersion: v0.1.0

charts/docs/templates/NOTES.txt

@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "docs.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "docs.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "docs.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "docs.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

charts/docs/templates/_helpers.tpl

@@ -0,0 +1,63 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "docs.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "docs.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "docs.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "docs.labels" -}}
+helm.sh/chart: {{ include "docs.chart" . }}
+{{ include "docs.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "docs.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "docs.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "docs.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "docs.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

charts/docs/templates/cluster.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.cluster.enabled -}}
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: {{ include "docs.fullname" . }}
+  annotations:
+    linkerd.io/inject: disabled
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+spec:
+  instances: {{ .Values.cluster.instances | default "2" }}
+
+  # Example of rolling update strategy:
+  # - unsupervised: automated update of the primary once all
+  #                 replicas have been upgraded (default)
+  # - supervised: requires manual supervision to perform
+  #               the switchover of the primary
+  primaryUpdateStrategy: unsupervised
+  backup:
+    retentionPolicy: {{ .Values.cluster.backupRetention | default "60d" }}
+
+  storage:
+    size: {{ .Values.cluster.size | default "5Gi" }}
+{{- end }}

charts/docs/templates/deployment.yaml

@@ -0,0 +1,84 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "docs.fullname" . }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "docs.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "docs.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "docs.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          env:
+            - name: LOG_LEVEL
+              value: "3"
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+          - name: data
+            mountPath: /data
+      {{- if .Values.init.enabled }}
+      initContainers:
+      - name: init
+        image: {{ .Values.init.image }}
+        command: {{- toYaml .Values.init.command | nindent 10 }}
+        volumeMounts:
+        - name: data
+          mountPath: /data
+      {{- end }}
+      volumes:
+      - name: data
+      {{- if .Values.persistence.enabled }}
+        persistentVolumeClaim:
+          claimName: {{ .Values.persistence.existingClaim | default (include "docs.fullname" .) }}
+      {{- else }}
+        emptyDir: {}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/docs/templates/hpa.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "docs.fullname" . }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "docs.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

charts/docs/templates/ingress.yaml

@@ -0,0 +1,61 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "docs.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/docs/templates/pvc.yaml

@@ -0,0 +1,25 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ template "docs.fullname" . }}
+{{- with .Values.persistence.annotations  }}
+  annotations:
+{{ toYaml . | indent 4 }}
+{{- end }}
+  labels:
+{{ include "docs.labels" . | indent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- if .Values.persistence.storageClass }}
+{{- if (eq "-" .Values.persistence.storageClass) }}
+  storageClassName: ""
+{{- else }}
+  storageClassName: "{{ .Values.persistence.storageClass }}"
+{{- end }}
+{{- end }}
+{{- end }}

charts/docs/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "docs.fullname" . }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "docs.selectorLabels" . | nindent 4 }}

charts/docs/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "docs.serviceAccountName" . }}
+  labels:
+    {{- include "docs.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/docs/values.yaml

@@ -0,0 +1,82 @@
+# Default values for docs.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+replicaCount: 1
+image:
+  repository: git.oceanbox.io/oceanbox/documentation/docs
+  tag: v0.1.0
+  pullPolicy: IfNotPresent
+init:
+  enabled: false
+  image: ubuntu:rolling
+  command: ["/bin/sh", "-c", "true"]
+env:
+  - name: LOG_LEVEL
+    value: "2"
+  - name: APP_NAME
+    valueFrom:
+      fieldRef:
+        fieldPath: metadata.name
+  - name: APP_NAMESPACE
+    valueFrom:
+      fieldRef:
+        fieldPath: metadata.namespace
+imagePullSecrets:
+  - name: gitea-pull-secret
+nameOverride: ""
+fullnameOverride: ""
+serviceAccount:
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+podAnnotations: {}
+podSecurityContext:
+  fsGroup: 2000
+securityContext:
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+  runAsUser: 0
+service:
+  type: ClusterIP
+  port: 8080
+ingress:
+  enabled: true
+  className: nginx
+persistence:
+  enabled: false
+  size: 1G
+  storageClass: ""
+  accessMode: ReadWriteOnce
+cluster:
+  enabled: false
+  instances: 2
+  backupEnabled: true
+  backupRetention: 60d
+  size: 5Gi
+resources: {}
+# We usually recommend not to specify default resources and to leave this as a conscious
+# choice for the user. This also increases chances charts run on environments with little
+# resources, such as Minikube. If you do want to specify resources, uncomment the following
+# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
+#   memory: 128Mi
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+nodeSelector: {}
+tolerations: []
+affinity: {}

charts/makai/values.yaml

@@ -3,7 +3,7 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/makai
+  repository: git.oceanbox.io/oceanbox/makai/makai
   tag: v0.1.0
   pullPolicy: IfNotPresent
 init:

charts/plume/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.6.7
+version: v1.6.13
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.6.7
+appVersion: v1.6.13

charts/plume/values.yaml

@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: registry.gitlab.com/oceanbox/plume
+  repository: git.oceanbox.io/oceanbox/plume/plume
-  tag: v1.6.7
+  tag: v1.6.13
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.35.2
+version: v1.42.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.35.2
+appVersion: v1.42.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: registry.gitlab.com/oceanbox/poseidon/sorcerer
-  tag: v1.35.2
+  tag: v1.42.2
   pullPolicy: IfNotPresent
 init:
   enabled: false
@@ -108,7 +108,6 @@ serviceMonitor:
 nodeSelector: {}
 tolerations: []
 affinity: {}
-
 diagrid-dashboard:
   enabled: false
   statestore:

envs/environments.yaml.gotmpl

@@ -20,4 +20,11 @@ environments:
     - ../values/*/env.yaml.gotmpl
     - ../values/*/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
     missingFileHandler: Info
+  beta:
+    values:
+    - ../values/env.yaml
+    - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+    - ../values/*/env.yaml.gotmpl
+    - ../values/*/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+    missingFileHandler: Info
 

helmfile.d/argo.yaml.gotmpl

@@ -27,7 +27,7 @@ releases:
 - name: argocd-apps
   namespace: argocd
   chart: argo/argocd-apps
-  version: 2.0.3
+  version: 2.0.4
   condition: argo.apps.enabled
   values:
   - ../values/argo/values/apps.yaml.gotmpl

helmfile.d/cert-manager.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: cert-manager
   namespace: cert-manager
   chart: cert-manager/cert-manager
-  version: v1.19.2
+  version: v1.19.3
   condition: cert_manager.enabled
   values:
   - ../values/cert-manager/values/cert-manager.yaml.gotmpl

helmfile.d/cilium.yaml.gotmpl

@@ -3,7 +3,8 @@ bases:
 
 repositories:
 - name: cilium
-  url: 'https://helm.cilium.io'
+  oci: true
+  url: 'quay.io/cilium/charts'
 
 commonLabels:
   tier: system
@@ -15,11 +16,11 @@ releases:
 - name: cilium
   namespace: kube-system
   chart: cilium/cilium
-  version: 1.16.2
+  version: {{ if eq (requiredEnv "ARGOCD_ENV_CLUSTER_NAME") "hel1" }}1.18.6{{ else }}1.16.19{{ end }}
   condition: cilium.enabled
   values:
   - ../values/cilium/values/cilium.yaml.gotmpl
-  - ../values/cilium/values/cilium-{{ .Environment.Name }}.yaml.gotmpl
+  - ../values/cilium/values/cilium-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
   missingFileHandler: Info
 - name: manifests
   namespace: cilium
@@ -55,4 +56,3 @@ releases:
     - '{{`{{ .Environment.Name }}`}}'
     - ../values/cilium/cilium-manifests
     - manifests
-

helmfile.d/docs.yaml.gotmpl

@@ -0,0 +1,38 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: oceanbox
+
+releases:
+- name: docs
+  namespace: docs
+  chart: ../charts/docs
+  condition: docs.enabled
+  values:
+  - ../values/docs/values/values.yaml
+  - ../values/docs/values/values-{{ .Environment.Name }}.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/docs/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: docs
+  chart: manifests
+  condition: docs.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/docs/env.yaml.gotmpl
+  - ../values/docs/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/docs/manifests
+    - manifests

helmfile.d/dragonfly.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
   namespace: dragonfly
   chart: dragonfly/dragonfly-operator
-  version: v1.3.1
+  version: v1.4.0
   condition: dragonfly.enabled
   values:
   - ../values/dragonfly/values/dragonfly.yaml.gotmpl

helmfile.d/drupal.yaml.gotmpl

@@ -0,0 +1,43 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+#repositories:
+#- name: drupal
+# url: "https://drupalwxt.github.io/helm-drupal/index.yaml"
+
+commonLabels:
+  tier: system
+
+releases:
+- name: drupal
+  namespace: drupal
+  #chart: drupal/drupal
+  #version: v1.3.0
+  condition: drupal.enabled
+  values:
+  - ../values/drupal/values/drupal.yaml.gotmpl
+  - ../values/drupal/values/drupal-{{ .Environment.Name }}.yaml.gotmpl
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/drupal/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: drupal
+  chart: manifests
+  condition: drupal.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/drupal/env.yaml.gotmpl
+  - ../values/drupal/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/drupal/manifests
+    - manifests

helmfile.d/gatus.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: gatus
   namespace: uptime
   chart: gatus/gatus
-  version: 1.4.4
+  version: 1.4.5
   condition: gatus.enabled
   values:
   - ../values/gatus/values/values.yaml

helmfile.d/gitea.yaml.gotmpl

@@ -2,35 +2,36 @@ bases:
  - ../envs/environments.yaml.gotmpl
 
 repositories:
-  - name: stevehipwell
+- name: gitea
-    url: 'https://stevehipwell.github.io/helm-charts/'
+  oci: true
+  url: docker.gitea.com/charts
 
 commonLabels:
   tier: system
 
 releases:
-- name: nexus3
+- name: gitea
-  namespace: nexus
+  namespace: gitea
-  chart: stevehipwell/nexus3
+  chart: gitea/gitea
-  version: 5.9.0
+  version: 12.5.0
-  condition: nexus.enabled
+  condition: gitea.enabled
   values:
-  - ../values/nexus/values/nexus.yaml.gotmpl
+  - ../values/gitea/values/values.yaml
-  - ../values/nexus/values/nexus-{{ .Environment.Name }}.yaml.gotmpl
+  - ../values/gitea/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:
-  - ../values/nexus/kustomize/{{ .Environment.Name }}
+  - ../values/gitea/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: nexus
+  namespace: gitea
   chart: manifests
-  condition: nexus.enabled
+  condition: gitea.enabled
   missingFileHandler: Info
   values:
   - ../values/env.yaml
   - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/nexus/env.yaml.gotmpl
+  - ../values/gitea/env.yaml.gotmpl
-  - ../values/nexus/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  - ../values/gitea/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
   hooks:
   - events: [ prepare, cleanup ]
     showlogs: true
@@ -39,5 +40,5 @@ releases:
     - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
     - '{{`{{ .Release.Chart }}`}}'
     - '{{`{{ .Environment.Name }}`}}'
-    - ../values/nexus/manifests
+    - ../values/gitea/manifests
     - manifests

helmfile.d/ingress-nginx.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: ingress-nginx
   namespace: ingress-nginx
   chart: ingress-nginx/ingress-nginx
-  version: 4.14.1
+  version: 4.14.3
   condition: nginx.enabled
   values:
   - ../values/ingress-nginx/values/ingress-nginx.yaml.gotmpl

helmfile.d/makai.yaml.gotmpl

@@ -6,7 +6,7 @@ commonLabels:
 
 releases:
 - name: makai
-  namespace: {{ .Environment.Name }}-makai
+  namespace: makai
   chart: ../charts/makai
   condition: makai.enabled
   values:
@@ -17,7 +17,7 @@ releases:
   - ../values/makai/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: {{ .Environment.Name }}-makai
+  namespace: makai
   chart: manifests
   condition: makai.enabled
   missingFileHandler: Info

helmfile.d/mariadb-operator.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: mariadb-operator
   namespace: mariadb-operator
   chart: mariadb-operator/mariadb-operator
-  version: 25.10.3
+  version: 25.10.4
   condition: mariadb_operator.enabled
   values:
   - ../values/mariadb-operator/values/mariadb-operator.yaml.gotmpl

helmfile.d/openfga.yaml.gotmpl

@@ -16,7 +16,7 @@ releases:
   namespace: {{ .Environment.Name }}-openfga
   {{- end }}
   chart: openfga/openfga
-  version: 0.2.50
+  version: 0.2.54
   condition: openfga.enabled
   values:
   - ../values/openfga/values/values.yaml

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.142.1
+  version: 0.145.0
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/postfix.yaml.gotmpl

@@ -2,36 +2,35 @@ bases:
  - ../envs/environments.yaml.gotmpl
 
 repositories:
-- name: forgejo
+- name: postfix
-  oci: true
+  url: https://bokysan.github.io/docker-postfix
-  url: code.forgejo.org/forgejo-helm
 
 commonLabels:
   tier: system
 
 releases:
-- name: forgejo
+- name: postfix
-  namespace: forgejo
+  namespace: postfix
-  chart: forgejo/forgejo
+  chart: postfix/mail
-  version: 16.0.0
+  version: 5.1.0
-  condition: forgejo.enabled
+  condition: postfix.enabled
   values:
-  - ../values/forgejo/values/values.yaml
+  - ../values/postfix/values/values.yaml
-  - ../values/forgejo/values/values-{{ .Environment.Name }}.yaml
+  - ../values/postfix/values/values-{{ .Environment.Name }}.yaml
   postRenderer: ../bin/kustomizer
   postRendererArgs:
-  - ../values/forgejo/kustomize/{{ .Environment.Name }}
+  - ../values/postfix/kustomize/{{ .Environment.Name }}
   missingFileHandler: Info
 - name: manifests
-  namespace: forgejo
+  namespace: postfix
   chart: manifests
-  condition: forgejo.enabled
+  condition: postfix.enabled
   missingFileHandler: Info
   values:
   - ../values/env.yaml
   - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/forgejo/env.yaml.gotmpl
+  - ../values/postfix/env.yaml.gotmpl
-  - ../values/forgejo/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  - ../values/postfix/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
   hooks:
   - events: [ prepare, cleanup ]
     showlogs: true
@@ -40,5 +39,5 @@ releases:
     - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
     - '{{`{{ .Release.Chart }}`}}'
     - '{{`{{ .Environment.Name }}`}}'
-    - ../values/forgejo/manifests
+    - ../values/postfix/manifests
     - manifests

helmfile.d/postgres-operator.yaml.gotmpl

@@ -27,7 +27,7 @@ releases:
 - name: plugin-barman-cloud
   namespace: cnpg
   chart: cloudnative-pg/plugin-barman-cloud
-  version: 0.3.1
+  version: 0.5.0
   condition: postgres_operator.enabled
   values:
   - ../values/postgres-operator/values/plugin-barman-cloud.yaml.gotmpl

nix/sources.json

@@ -9,15 +9,15 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "f0927703b7b1c8d97511c4116eb9b4ec6645a0fa",
+      "revision": "a1ef738813b15cf8ec759bdff5761b027e3e1d23",
-      "url": "https://github.com/cachix/git-hooks.nix/archive/f0927703b7b1c8d97511c4116eb9b4ec6645a0fa.tar.gz",
+      "url": "https://github.com/cachix/git-hooks.nix/archive/a1ef738813b15cf8ec759bdff5761b027e3e1d23.tar.gz",
-      "hash": "sha256-6MkqajPICgugsuZ92OMoQcgSHnD6sJHwk8AxvMcIgTE="
+      "hash": "sha256-Efs3VUPelRduf3PpfPP2ovEB4CXT7vHf8W+xc49RL/U="
     },
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre927565.13868c071cc7/nixexprs.tar.xz",
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre930822.ed142ab1b3a0/nixexprs.tar.xz",
-      "hash": "sha256-wufp5c0nWh/87f9eK7xy1eZXms5zd4yl6S4SR+LfA08="
+      "hash": "sha256-XH6awru9NnBc/m+2YhRNT8r1PAKEiPGF3gs//F3ods0="
     }
   },
   "version": 7

renovate.json

@@ -6,7 +6,6 @@
   "dependencyDashboard": true,
   "semanticCommits": "disabled",
   "ignorePaths": [
-    "**/attic/**",
     "**/bootstrap/**"
   ],
   "helmfile": {

shell.nix

@@ -31,6 +31,7 @@ pkgs.mkShellNoCC {
       kubectl-graph
       kubectl-klock
       graphviz
+      hubble
 
       # other tools activate when needed
       # step-cli
@@ -38,7 +39,7 @@ pkgs.mkShellNoCC {
       # cmctl
       # rclone
       # velero
-      # renovate
+      renovate
 
       # dapr
       dapr-cli
@@ -46,7 +47,7 @@ pkgs.mkShellNoCC {
     ++ checks.enabledPackages;
 
   # Environment variables
-  ARGOCD_ENV_CLUSTER_NAME = "hel1";
+  ARGOCD_ENV_CLUSTER_NAME = "oceanbox";
   HELM_GIT_ACCESS_TOKEN = "glpat-xxx";
 
   shellHook = builtins.concatStringsSep "\n" [

values/argo/manifests/sys-project.yaml

@@ -88,11 +88,15 @@ spec:
     server: https://kubernetes.default.svc
   - namespace: uptime
     server: https://kubernetes.default.svc
-  - namespace: forgejo
+  - namespace: gitea
+    server: https://kubernetes.default.svc
+  - namespace: postfix
     server: https://kubernetes.default.svc
   sourceRepos:
   - https://argoproj.github.io/argo-helm
   - https://kubernetes-sigs.github.io/metrics-server/
+  - https://git.oceanbox.io/platform/manifests.git
+  - https://git.oceanbox.io/platform/manifests
   - https://gitlab.com/oceanbox/manifests.git
   - https://kubernetes.github.io/ingress-nginx
   - https://cloudnative-pg.github.io/charts
@@ -120,12 +124,15 @@ spec:
   - https://open-telemetry.github.io/opentelemetry-helm-charts
   - https://ghcr.io/slinkyproject/charts/slurm-operator
   - https://ghcr.io/slinkyproject/charts/slurm-operator-crds
+  - https://bokysan.github.io/docker-postfix/
   - ghcr.io/slinkyproject/charts
   - ghcr.io/slinkyproject/charts/slurm-operator
   - ghcr.io/slinkyproject/charts/slurm-operator-crds
   - ghcr.io/spegel-org/helm-charts
+  - quay.io/cilium/charts
+  - quay.io/jetstack/charts
   - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
-  - code.forgejo.org/forgejo-helm
+  - docker.gitea.com
   - https://operator.mariadb.com/mariadb-enterprise-operator
   - https://operator.mariadb.com
   - https://ot-container-kit.github.io/helm-charts

values/atlantis/env-oceanbox.yaml.gotmpl

@@ -1,3 +1,2 @@
 atlantis:
   enabled: true
-

values/atlantis/env.yaml.gotmpl

@@ -1,5 +1,4 @@
 atlantis:
   enabled: false
-  autosync: {{ if eq .Environment.Name "prod" }} false {{ else }} true {{ end }}
+  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
   env: {{ .Environment.Name }}
-

values/atlantis/kustomize/beta/appsettings.json

@@ -0,0 +1,96 @@
+{
+    "oidc": {
+        "issuer": "https://auth.oceanbox.io/realms/oceanbox",
+        "authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
+        "token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
+        "jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
+        "userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
+        "end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
+        "device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
+        "clientId": "atlantis",
+        "clientSecret": "",
+        "scopes": [
+            "openid",
+            "email",
+            "offline_access",
+            "profile"
+        ],
+        "audiences": [
+            "atlantis",
+            "atlantis_dev",
+            "sorcerer",
+            "sorcerer_dev"
+        ]
+    },
+    "sso": {
+        "cookieDomain": ".oceanbox.io",
+        "cookieName": ".obx.beta",
+        "ttl": 12.0,
+        "signedOutRedirectUri": "https://maps.beta.oceanbox.io",
+        "realm": "atlantis",
+        "environment": "prod",
+        "keyStore": {
+            "kind": "azure",
+            "uri": "https://atlantis.blob.core.windows.net",
+            "key": "dataprotection-keys"
+        },
+        "keyVault": {
+            "kind": "azure",
+            "uri": "https://atlantisvault.vault.azure.net",
+            "key": "dataencryption-keys"
+        }
+    },
+    "fga": {
+      "apiUrl": "http://prod-openfga.openfga.svc.cluster.local:8080",
+      "apiKey": "",
+      "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
+      "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
+    },
+    "sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
+    "plainAuthUsers": [
+        {
+            "username": "admin",
+            "password": "en-to-tre-fire",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        },
+        {
+            "username": "sorcerer",
+            "password": "fire tre to en",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        },
+        {
+            "username": "archivist",
+            "password": "en-to-tre-fire",
+            "groups": [ "/oceanbox" ],
+            "roles": [ "admin" ]
+        }
+    ],
+    "plume": "plume.data.oceanbox.io",
+    "redis": "beta-atlantis-redis:6379",
+    "objectStore": "https://atlantis.blob.core.windows.net",
+    "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
+    "sorcerer" : "https://sorcerer.beta.ekman.oceanbox.io",
+    "allowedOrigins": [
+        "https://maps.beta.oceanbox.io"
+    ],
+    "appName": "atlantis",
+    "appEnv": "prod",
+    "appNamespace": "atlantis",
+    "appVersion": "2.95.1",
+    "otelCollector": "http://opentelemetry-collector.otel.svc:4317",
+    "pubsubName": "pubsub",
+    "pubsubTopic": "hipster-atlantis",
+    "slurm": {
+        "baseUrl": "https://slurmrestd.ekman.oceanbox.io/",
+        "slurmApi": "slurm/v0.0.42/",
+        "dbdApi": "slurmdbd/v0.0.42/",
+        "accessToken": ""
+    },
+    "amqp": {
+        "auth": "user:hunny-bunny",
+        "host": "10.255.241.201:30673"
+    },
+    "fenceRadius": 1250.0
+}

values/atlantis/kustomize/beta/bindings.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: slurm-events
+spec:
+  type: bindings.rabbitmq
+  version: v1
+  metadata:
+  - name: host
+    secretKeyRef:
+      name: prod-atlantis-rabbitmq
+      key:  connString
+  - name: queueName
+    value: beta-slurm-job-events
+  - name: durable
+    value: true
+  - name: contentType
+    value: "application/json"
+  - name: route
+    value: /events/slurm
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/configurations.yaml

@@ -0,0 +1,20 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: configstore
+spec:
+  type: configuration.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: beta-atlantis-redis:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: beta-atlantis-redis
+      key:  redis-password
+  - name: redisDB
+    value: "1"
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/default.env

@@ -0,0 +1 @@
+OIDC_CLIENT_SECRET=KOJ6bDHzE5vdyfSrzgwLjtM5PzA809Zm

values/atlantis/kustomize/beta/deployment_patch.yaml

@@ -0,0 +1,10 @@
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: azure-keyvault
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: prod-atlantis-env

values/atlantis/kustomize/beta/keyvault.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: azure-keyvault
+spec:
+  type: secretstores.azure.keyvault
+  version: v1
+  metadata:
+  - name: vaultName
+    value: atlantisvault
+  - name: azureTenantId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_TENANT_ID
+  - name: azureClientId
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_ID
+  - name: azureClientSecret
+    secretKeyRef:
+      name: azure-keyvault
+      key: AZURE_CLIENT_SECRET

values/atlantis/kustomize/beta/kustomization.yaml

@@ -0,0 +1,24 @@
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+- name: beta-atlantis-appsettings
+  files:
+    - appsettings.json
+patches:
+  - target:
+      group: apps
+      version: v1
+      kind: Deployment
+    path: deployment_patch.yaml
+
+resources:
+  - ../base
+  - rbac.yaml
+  - tracing.yaml
+  - bindings.yaml
+  - pubsub.yaml
+  - statestore.yaml
+  - subscriptions.yaml
+  - configurations.yaml
+  - secretstore.yaml
+  - keyvault.yaml

values/atlantis/kustomize/beta/pubsub.yaml

@@ -0,0 +1,52 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: pubsub
+spec:
+  version: v1
+  type: pubsub.rabbitmq
+  metadata:
+  - name: hostname
+    value: prod-rabbitmq.rabbitmq
+  - name: username
+    value: user
+  - name: password
+    secretKeyRef:
+      name: prod-atlantis-rabbitmq
+      key:  rabbitmq-password
+  - name: protocol
+    value: amqp
+  - name: durable
+    value: true
+  - name: deletedWhenUnused
+    value: false
+  - name: autoAck
+    value: false
+  - name: deliveryMode
+    value: 1
+  - name: requeueInFailure
+    value: false
+  - name: prefetchCount
+    value: 0
+  - name: reconnectWait
+    value: 0
+  - name: concurrencyMode
+    value: parallel
+  - name: publisherConfirm
+    value: false
+  - name: backOffPolicy
+    value: exponential
+  - name: backOffInitialInterval
+    value: 100
+  - name: backOffMaxRetries
+    value: 16
+  - name: enableDeadLetter # Optional enable dead Letter or not
+    value: true
+  - name: maxLen # Optional max message count in a queue
+    value: 3000
+  - name: maxLenBytes # Optional maximum length in bytes of a queue.
+    value: 10485760
+  - name: exchangeKind
+    value: fanout
+  - name: clientName
+    value: "{appID}"

values/atlantis/kustomize/beta/rbac.yaml

@@ -0,0 +1,40 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: beta-atlantis
+  namespace: beta-atlantis
+rules:
+- apiGroups:
+  - ""
+  resourceNames:
+  - beta-atlantis-appsettings
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - watch
+- apiGroups:
+  - ""
+  resourceNames:
+  - azure-keyvault
+  - beta-atlantis-redis
+  - slurm-access-token
+  resources:
+  - secrets
+  verbs:
+  - get
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: beta-atlantis
+  namespace: beta-atlantis
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: beta-atlantis
+subjects:
+- kind: ServiceAccount
+  name: beta-atlantis
+  namespace: beta-atlantis

values/atlantis/kustomize/beta/secretstore.yaml

@@ -0,0 +1,10 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: secretstore
+spec:
+  type: secretstores.kubernetes
+  version: v1
+  metadata:
+   - name: defaultNamespace
+     value: beta-atlantis

values/atlantis/kustomize/beta/statestore.yaml

@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: statestore
+spec:
+  type: state.redis
+  version: v1
+  metadata:
+  - name: redisHost
+    value: beta-atlantis-redis:6379
+  - name: redisUsername
+    value: default
+  - name: redisPassword
+    secretKeyRef:
+      name: beta-atlantis-redis
+      key:  redis-password
+  - name: actorStateStore
+    value: "true"
+  - name: redisDB
+    value: "0"
+scopes:
+  - beta-atlantis

values/atlantis/kustomize/beta/subscriptions.yaml

@@ -0,0 +1,27 @@
+apiVersion: dapr.io/v2alpha1
+kind: Subscription
+metadata:
+  name: hipster-events
+spec:
+  topic: hipster
+  routes:
+    default: /events/hipster
+  pubsubname: pubsub
+  metadata:
+    queueType: quorum
+scopes:
+- beta-atlantis
+---
+apiVersion: dapr.io/v2alpha1
+kind: Subscription
+metadata:
+  name: inbox-events
+spec:
+  topic: inbox
+  routes:
+    default: /events/inbox
+  pubsubname: pubsub
+  metadata:
+    queueType: quorum
+scopes:
+- beta-atlantis

values/atlantis/kustomize/beta/tracing.yaml

@@ -0,0 +1,11 @@
+apiVersion: dapr.io/v1alpha1
+kind: Configuration
+metadata:
+  name: tracing
+spec:
+  tracing:
+    samplingRate: "1"
+    otel:
+      endpointAddress: "opentelemetry-collector.otel.svc.cluster.local:4317"
+      protocol: grpc
+      isSecure: false

values/atlantis/manifests/atlantis.yaml

@@ -27,16 +27,24 @@ spec:
         value: {{ .Values.atlantis.env }}
       - name: HELMFILE_FILE_PATH
         value: atlantis.yaml.gotmpl
+  {{- if ne .Values.atlantis.env "beta" }}
   - repoURL: https://charts.bitnami.com/bitnami
     targetRevision: 20.1.7
     chart: redis
     helm:
       valueFiles:
       - $values/values/atlantis/values/redis-{{ .Values.atlantis.env }}.yaml
+  {{- end }}
   - repoURL: https://gitlab.com/oceanbox/manifests.git
     targetRevision: main
     ref: values
   ignoreDifferences:
+    - kind: Secret
+      name: beta-atlantis-db-superuser
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
     - kind: Secret
       name: azure-keyvault
       jqPathExpressions:
@@ -67,6 +75,12 @@ spec:
         - '.data'
         - '.metadata.labels'
         - '.metadata.annotations'
+    - kind: Secret
+      name: slurm-access-token
+      jqPathExpressions:
+        - '.data'
+        - '.metadata.labels'
+        - '.metadata.annotations'
   syncPolicy:
     syncOptions:
       - CreateNamespace=true

values/atlantis/values/sec.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  redis-password: N2drUGlEN0ZMNA==
+kind: Secret
+metadata:
+  name: beta-sorcerer-redis
+  namespace: beta-sorcerer
+type: Opaque

values/atlantis/values/values-beta.yaml.gotmpl

@@ -0,0 +1,103 @@
+replicaCount: 1
+
+image:
+  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  tag: v1.42.2
+
+podAnnotations:
+  dapr.io/app-id: "beta-atlantis"
+
+env:
+  - name: APP_NAMESPACE
+    value: beta-atlantis
+  - name: APP_VERSION
+    value: "2.97.4-beta"
+  - name: LOG_LEVEL
+    value: "1"
+  - name: ANALYTICS_WEB_ID
+    value: "16e7d807-4db5-45fd-92a9-27393445a153"
+  - name: REDIS_USER
+    value: default
+  - name: REDIS_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: beta-atlantis-redis
+        key: redis-password
+  # Share production database
+  - name: DB_HOST
+    value: prod-atlantis-db-rw.prod-atlantis
+  - name: DB_PORT
+    value: "5432"
+  - name: DB_USER
+    valueFrom:
+      secretKeyRef:
+        name: prod-atlantis-db-superuser
+        key: username
+  - name: DB_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: prod-atlantis-db-superuser
+        key: password
+  - name: DAPR_API_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: dapr-api-token
+        key: token
+
+ingress:
+  enabled: true
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+  hosts:
+    - host: maps.beta.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+      internal:
+        - path: /internal
+          pathType: ImplementationSpecific
+        - path: /dapr
+          pathType: ImplementationSpecific
+        - path: /actors
+          pathType: ImplementationSpecific
+        - path: /job
+          pathType: ImplementationSpecific
+        - path: /events
+          pathType: ImplementationSpecific
+        - path: /metrics
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+       - maps.beta.oceanbox.io
+      secretName: beta-atlantis-tls
+
+cluster:
+  enabled: false
+  bootstrap: false
+
+redis:
+  enabled: true
+  size: 2Gi
+  secret:
+    name: beta-atlantis-redis
+    key: redis-password
+  backup:
+    enabled: true
+  resources:
+    cpu: 150m
+    memory: 256Mi
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 250m
+    memory: 512Mi
+
+diagrid-dashboard:
+  enabled: false
+  statestore:
+    scope: beta-atlantis
+    redis: beta-atlantis-redis

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,6 +1,7 @@
 replicaCount: 1
 image:
-  tag: 503ccbb2-debug
+  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
+  tag: bc9dccaa-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/attic/env-oceanbox.yaml.gotmpl

@@ -1,2 +1,2 @@
 attic:
-  enabled: true
+  enabled: false

values/attic/manifests/attic.yaml

@@ -4,15 +4,15 @@ metadata:
   name: attic
   namespace: argocd
   finalizers:
-  - resources-finalizer.argocd.argoproj.io
+    - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
     namespace: attic
-    server: 'https://kubernetes.default.svc'
+    server: "https://kubernetes.default.svc"
   sources:
-  - repoURL: https://gitlab.com/oceanbox/manifests.git
+    - repoURL: https://git.oceanbox.io/oceanbox/manifests.git
-    targetRevision: HEAD
+      targetRevision: HEAD
-    path: values/attic/manifests
+      path: values/attic/manifests
   project: aux
   syncPolicy:
     managedNamespaceMetadata:

values/cert-manager/env-hel1.yaml.gotmpl

@@ -0,0 +1,5 @@
+cert_manager:
+ enabled: true
+ autosync: true
+ gatewayApi:
+  enabled: true

values/cert-manager/env.yaml.gotmpl

@@ -1,3 +1,5 @@
 cert_manager:
  enabled: true
  autosync: true
+ gatewayApi:
+  enabled: false

values/cert-manager/values/cert-manager.yaml.gotmpl

@@ -3,3 +3,9 @@ enableCertificateOwnerRef: true
 startupapicheck:
   podAnnotations:
     linkerd.io/inject: disabled
+{{- if .Values.cert_manager.gatewayApi.enabled }}
+config:
+  apiVersion: controller.config.cert-manager.io/v1alpha1
+  enableGatewayAPI: true
+  kind: ControllerConfiguration
+{{- end }}

values/cilium/cilium-manifests/gateway.yaml

@@ -0,0 +1,68 @@
+{{- if eq .Values.cilium.cluster "hel1" }}
+# TODO: Move to ListernerSets when those get Promoted to GA
+# Resources:
+# - https://gateway-api.sigs.k8s.io/geps/gep-1713/
+# - https://github.com/kubernetes-sigs/gateway-api/issues/1713
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: shared-gateway
+  namespace: kube-system
+spec:
+  infrastructure:
+    annotations:
+      load-balancer.hetzner.cloud/location: hel1
+      load-balancer.hetzner.cloud/type: lb11
+      load-balancer.hetzner.cloud/name: load-balancer-2
+      load-balancer.hetzner.cloud/use-private-ip: "true"
+      load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
+      load-balancer.hetzner.cloud/http-redirect-https: "false"
+  gatewayClassName: cilium
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: https
+      protocol: HTTPS
+      port: 443
+      tls:
+        certificateRefs:
+          - group: ''
+            kind: Secret
+            name: wildcard-oceanbox-io
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+    - name: ssh
+      protocol: TCP
+      port: 22
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              shared-gateway-access: "true"
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-oceanbox-io
+spec:
+  secretName: wildcard-oceanbox-io
+  commonName: oceanbox.io
+  dnsNames:
+    - oceanbox.io
+    - "*.oceanbox.io"
+  issuerRef:
+    name: letsencrypt-prod-dns01
+    kind: ClusterIssuer
+{{- end}}

values/cilium/cilium-manifests/policies/allow-ingress-to-cluster.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: "cilium.io/v2"
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: allow-ingress-to-cluster
+  namespace: default
+spec:
+  endpointSelector:
+    matchExpressions:
+      - key: reserved:ingress
+        operator: Exists
+  egress:
+    - toEntities:
+        - cluster
+  ingress:
+    - fromEntities:
+        - world
+        - cluster
+{{- end }}

values/cilium/env-hel1.yaml.gotmpl

@@ -0,0 +1,12 @@
+cilium:
+  enabled: true
+  nodePort:
+    enabled: true
+  l2announcement:
+    enabled: true
+  gatewayAPI:
+    enabled: true
+  gatewayTest:
+    enabled: true
+  policyAuditMode: true
+  upgradeCompatability: 1.18

values/cilium/env.yaml.gotmpl

@@ -1,6 +1,6 @@
 cilium:
   enabled: false
-  autosync: true
+  autosync: false
   spire:
     enabled: false
   envoy:
@@ -30,4 +30,4 @@ cilium:
   loadbalancerPool:
     enabled: false
     cidr: []
-
+  cluster: {{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}

values/cilium/values/cilium.yaml.gotmpl

@@ -61,6 +61,25 @@ nodePort:
   enabled: {{ .Values.cilium.nodePort.enabled }}
 gatewayAPI:
   enabled: {{ .Values.cilium.gatewayAPI.enabled }}
+{{- if eq .Values.cilium.cluster "hel1"}}
+  gatewayClass:
+    create: 'true'
+  enableProxyProtocol: true
+  hostNetwork:
+    enabled: false
+    nodes:
+      matchLabels:
+        ingresshost: "cilium"
+envoy:
+  enabled: true
+  securityContext:
+    capabilities:
+      keepCapNetBindService: true
+      envoy:
+        - NET_ADMIN
+        - BPF
+        - NET_BIND_SERVICE
+{{- end}}
 ingressController:
   enabled: {{ .Values.cilium.ingressController.enabled }}
   default: {{ .Values.cilium.ingressController.defaultClass }}

values/codex/values/values-staging.yaml

@@ -31,4 +31,4 @@ volumeMounts:
     readOnly: true
     subPath: appsettings.json
 image:
-  tag: 2e1165d9-debug
+  tag: d34652dd-debug

values/docs/env-hel1.yaml.gotmpl

@@ -1,3 +1,2 @@
-plausible:
+docs:
   enabled: true
-

values/docs/env-oceanbox.yaml.gotmpl

@@ -0,0 +1,2 @@
+docs:
+  enabled: false

values/docs/env.yaml.gotmpl

@@ -0,0 +1,4 @@
+docs:
+  enabled: true
+  autosync: {{ if eq .Environment.Name "prod" }} false {{ else }} true {{ end }}
+  env: {{ .Environment.Name }}

values/docs/manifests/docs.yaml

@@ -1,13 +1,19 @@
-{{- if .Values.clusterConfig.argo.enabled }}
+{{ if .Values.clusterConfig.argo.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: plausible-analytics
+  name: docs
   namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/compare-options: ServerSideDiff=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
 spec:
   destination:
-    namespace: plausible
+    namespace: docs
-    server: 'https://kubernetes.default.svc'
+    server: https://kubernetes.default.svc
+  project: default
   sources:
   - repoURL: {{ .Values.clusterConfig.manifests }}
     targetRevision: HEAD
@@ -20,25 +26,14 @@ spec:
       - name: HELMFILE_ENVIRONMENT
         value: default
       - name: HELMFILE_FILE_PATH
-        value: plausible.yaml.gotmpl
+        value: docs.yaml.gotmpl
-  project: aux
   syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: aux
     syncOptions:
       - CreateNamespace=true
       - ApplyOutOfSyncOnly=true
-    {{- if .Values.plausible.autosync }}
+    {{- if .Values.docs.autosync }}
     automated:
       prune: true
-      selfHeal: true
+      selfHeal: false
     {{- end }}
-  ignoreDifferences:
-    - kind: Secret
-      name: plausible-analytics
-      jqPathExpressions:
-        - '.data'
-        - '.metadata.labels'
-        - '.metadata.annotations'
 {{- end }}

values/docs/values/values.yaml

@@ -1,9 +1,9 @@
 replicaCount: 1
 image:
-  tag: "ce1340fa-debug"
+  tag: "5c4cda2e-debug"
 env:
   - name: APP_VERSION
-    value: "0.0.0-staging"
+    value: "0.0.0"
   - name: LOG_LEVEL
     value: "1"
 ingress:
@@ -17,11 +17,11 @@ ingress:
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     oceanbox.io/expose: internal
   hosts:
-    - host: makai.dev.oceanbox.io
+    - host: docs.oceanbox.io
       paths:
         - path: /
           pathType: ImplementationSpecific
   tls:
     - hosts:
-        - makai.dev.oceanbox.io
+        - docs.oceanbox.io
-      secretName: staging-makai-tls
+      secretName: docs-tls

values/env-ekman.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/platform/manifests.git
   cilium:
     enabled: false
   env: "prod"

values/env-hel1.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/platform/manifests.git
   env: "prod"
   distro: "talos"
   domain: "adm.hel1.obx"

values/env-oceanbox.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/platform/manifests.git
   env: "prod"
   distro: "talos"
   domain: "adm.oceanbox.io"

values/env-rossby.yaml

@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/oceanbox/manifests.git
   cilium:
     enabled: false
   env: "prod"

values/forgejo/values/values.yaml

@@ -1,134 +0,0 @@
-replicaCount: 1
-image:
-  registry: code.forgejo.org
-  repository: forgejo/forgejo
-
-resources:
-  requests:
-    cpu: 200m
-    memory: 512Mi
-
-gitea:
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: false
-  config:
-    APP_NAME: 'Forgejo: With a cup of tea.'
-    cache:
-      ENABLED: true
-      ADAPTER: redis
-      HOST: redis://dragonfly-forgejo.forgejo.svc:6379/0
-    session:
-      PROVIDER: redis
-      PROVIDER_CONFIG: redis://dragonfly-forgejo.forgejo.svc:6379/1
-    queue:
-      TYPE: redis
-      CONN_STR: redis://dragonfly-forgejo.forgejo.svc:6379/2
-    storage:
-      STORAGE_TYPE: minio
-      MINIO_ENDPOINT: hel1.your-objectstorage.com
-      MINIO_USE_SSL: true
-      MINIO_LOCATION: hel1
-      MINIO_BUCKET: obx-forgejo
-    security:
-      INSTALL_LOCK: true
-    service:
-      DISABLE_REGISTRATION: false
-    server:
-      APP_DATA_PATH: "/data/gitea"
-      DOMAIN: git.svc.hel1.obx
-      ROOT_URL: https://git.svc.hel1.obx
-      SSH_DOMAIN: git.svc.hel1.obx
-      SSH_PORT: 22
-      SSH_SERVER_USE_PROXY_PROTOCOL: true
-      LANDING_PAGE: "explore"
-    oauth2_client:
-      ENABLE_AUTO_REGISTRATION: true
-      UPDATE_AVATAR: true
-      ACCOUNT_LINKING: auto
-    database:
-      DB_TYPE: postgres
-      MAX_OPEN_CONNS: 90
-    openid:
-      ENABLE_OPENID_SIGNIN: false
-      ENABLE_OPENID_SIGNUP: false
-  oauth:
-    - name: 'Oceanbox'
-      provider: 'openidConnect'
-      existingSecret: forgejo-oauth-oceanbox
-      autoDiscoverUrl: 'https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/.well-known/openid-configuration'
-      scopes: 'openid profile email groups'
-      groupClaimName: 'groups'
-      adminGroup: '/oceanbox/devel'
-      restrictedGroup: ''
-  additionalConfigFromEnvs:
-    - name: FORGEJO__STORAGE__MINIO_ACCESS_KEY_ID
-      valueFrom:
-        secretKeyRef:
-          name: forgejo-s3
-          key: access_key
-    - name: FORGEJO__STORAGE__MINIO_SECRET_ACCESS_KEY
-      valueFrom:
-        secretKeyRef:
-          name: forgejo-s3
-          key: secret_key
-    - name: FORGEJO__DATABASE__PASSWD
-      valueFrom:
-        secretKeyRef:
-          name: forgejo-db-app
-          key: password
-    - name: FORGEJO__DATABASE__NAME
-      valueFrom:
-        secretKeyRef:
-          name: forgejo-db-app
-          key: dbname
-    - name: FORGEJO__DATABASE__USER
-      valueFrom:
-        secretKeyRef:
-          name: forgejo-db-app
-          key: user
-    - name: FORGEJO__DATABASE__HOST
-      valueFrom:
-        secretKeyRef:
-          name: forgejo-db-app
-          key: host
-    - name: FORGEJO__DATABASE__DB_TYPE
-      value: postgres
-
-ingress:
-  enabled: true
-  className: nginx
-  annotations:
-    cert-manager.io/cluster-issuer: ca-issuer
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12
-  hosts:
-    - host: git.svc.hel1.obx
-      paths:
-      - backend:
-          service:
-            name: forgejo-http
-            port:
-              number: 3000
-        path: /
-        pathType: ImplementationSpecific
-  tls:
-    - secretName: forgejo-tls
-      hosts:
-        - git.svc.hel1.obx
-
-# service:
-  # ssh:
-    # type: LoadBalancer
-    # port: 22
-    # annotations:
-      # load-balancer.hetzner.cloud/location: hel1
-      # load-balancer.hetzner.cloud/uses-proxyprotocol: 'false'
-
-persistence:
-  enabled: true
-  size: 1Gi

values/gatus/values/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: twinproduction/gatus
-  tag: v5.32.0
+  tag: v5.34.0
 
 # Does envFrom secret named gatus
 secrets: true
@@ -62,21 +62,21 @@ config:
     <<: *defaults
     conditions:
       - "[STATUS] == 200"
-      - "[RESPONSE_TIME] <= 1000"
+      - "[RESPONSE_TIME] <= 2000"
       - "[CERTIFICATE_EXPIRATION] > 168h" # 7 days
 
   .tls-endpoint: &tls-endpoint
     <<: *defaults
     conditions:
       - "[CONNECTED] == true"
-      - "[RESPONSE_TIME] <= 1000"
+      - "[RESPONSE_TIME] <= 2000"
       - "[CERTIFICATE_EXPIRATION] > 168h" # 7 days
 
   .tcp-endpoint: &tcp-endpoint
     <<: *defaults
     conditions:
       - "[CONNECTED] == true"
-      - "[RESPONSE_TIME] <= 1000"
+      - "[RESPONSE_TIME] <= 2000"
 
   endpoints:
     - name: Atlantis TOS
@@ -93,12 +93,13 @@ config:
       alerts:
         - type: custom
 
-    - name: Sorcerer VTN
+    # NOTE: Ingress is down
-      <<: *https-endpoint
+    # - name: Sorcerer VTN
-      group: "Primary Services"
+    #   <<: *https-endpoint
-      url: https://sorcerer.vtn.oceanbox.io/healthz
+    #   group: "Primary Services"
-      # alerts:
+    #   url: https://sorcerer.vtn.oceanbox.io/healthz
-      # - type: custom
+    # alerts:
+    # - type: custom
 
     - name: Plume TOS
       <<: *https-endpoint

values/gitea/env-hel1.yaml.gotmpl

@@ -1,3 +1,3 @@
-forgejo:
+gitea:
   enabled: true
   backup: true

values/gitea/env.yaml.gotmpl

@@ -1,4 +1,4 @@
-forgejo:
+gitea:
   enabled: false
   backup: false
   autosync: {{ if eq .Environment.Name "prod" }} false {{ else }} true {{ end }}

values/gitea/manifests/backup.yaml

@@ -2,11 +2,11 @@ apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
   name: hel-store
-  namespace: forgejo
+  namespace: gitea
 spec:
   retentionPolicy: "7d"
   configuration:
-    destinationPath: s3://obx-cnpg/hel1/forgejo-db
+    destinationPath: s3://obx-cnpg/hel1/gitea-db
     endpointURL: https://hel1.your-objectstorage.com
     s3Credentials:
       accessKeyId:
@@ -21,13 +21,13 @@ spec:
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
 metadata:
-  name: forgejo-db
+  name: gitea-db
-  namespace: forgejo
+  namespace: gitea
 spec:
   schedule: "0 0 1 * * *"
   backupOwnerReference: self
   cluster:
-    name: forgejo-db
+    name: gitea-db
   method: plugin
   pluginConfiguration:
     name: barman-cloud.cloudnative-pg.io