143 lines
6.7 KiB
Markdown
143 lines
6.7 KiB
Markdown
# Kubernetes Manifests Repository
|
|
|
|
This repository contains Kubernetes manifest files for a comprehensive self-hosted platform running 40+ applications across various categories. This infrastructure was created for the migration from Docker to Kubernetes (K3S).
|
|
|
|
All applications are managed using GitOps principles with ArgoCD and utilize cert-manager for automated TLS certificate management.
|
|
|
|
## Repository Structure
|
|
|
|
The repository is split into three top-level areas. Within each, there is one directory per application/component, and every manifest follows the `<app>-<kind>.yaml` naming convention.
|
|
|
|
```
|
|
├── infra/ # Cluster infrastructure
|
|
│ ├── argocd/ # GitOps continuous deployment
|
|
│ ├── cert-manager/ # TLS certificate management
|
|
│ ├── cloud-native-postgres/ # PostgreSQL operator
|
|
│ ├── envoy-gateway/ # Kubernetes Gateway API configuration
|
|
│ ├── kubevip/ # High availability
|
|
│ ├── longhorn/ # Distributed storage
|
|
│ └── metallb/ # Load balancer
|
|
│
|
|
├── applications/ # Deployed workloads
|
|
│ ├── authentik/ # Identity provider and SSO
|
|
│ ├── azure-ddns-python/ # Dynamic DNS updater
|
|
│ ├── bentopdf/ # PDF conversion
|
|
│ ├── comfyui/ # Stable Diffusion workflow UI
|
|
│ ├── databasus/ # Database management
|
|
│ ├── excalidraw/ # Whiteboard / diagramming
|
|
│ ├── gitea/ # Git service
|
|
│ ├── gotify/ # Push notification server
|
|
│ ├── immich/ # Photo and video management
|
|
│ ├── infisical/ # Secrets management
|
|
│ ├── it-tools/ # IT utilities
|
|
│ ├── jellyfin/ # Media server
|
|
│ ├── minecraft/ # Game servers
|
|
│ ├── minio-aistor/ # S3-compatible object storage
|
|
│ ├── n8n/ # Workflow automation
|
|
│ ├── netbootxyz/ # Network boot service
|
|
│ ├── ollama/ # Local LLM runner
|
|
│ ├── openwebui/ # Web UI for AI models
|
|
│ ├── outline/ # Knowledge base / wiki
|
|
│ ├── passbolt/ # Password manager
|
|
│ ├── pelican/ # Game server management panel
|
|
│ ├── proxmox/ # Virtualization platform
|
|
│ ├── react-resume/ # Resume builder application
|
|
│ ├── searxng/ # Privacy-respecting search engine
|
|
│ ├── technitium/ # DNS server
|
|
│ ├── truenas/ # Storage system
|
|
│ ├── unifi/ # Network controller
|
|
│ ├── uptime-kuma/ # Uptime monitoring
|
|
│ ├── victoria-metrics/ # Metrics and monitoring
|
|
│ ├── wikijs/ # Documentation wiki
|
|
│ └── zipline/ # File sharing
|
|
│
|
|
└── deprecated/ # Deprecated applications
|
|
```
|
|
|
|
## Categories
|
|
|
|
### Core Infrastructure
|
|
- **ArgoCD**: GitOps continuous deployment and application management
|
|
- **cert-manager**: Automated TLS certificate provisioning using Azure DNS
|
|
- **MetalLB**: Bare-metal load balancer (IP pool: 10.8.11.100-10.8.11.150)
|
|
- **KubeVIP**: High-availability control plane
|
|
- **Longhorn**: Distributed block storage
|
|
- **Cloud Native Postgres**: PostgreSQL operator for database management
|
|
- **Envoy Gateway**: Kubernetes Gateway API implementation
|
|
- **Infisical**: Secrets management platform
|
|
- **Authentik**: Identity provider and SSO
|
|
|
|
### Media & Entertainment
|
|
- **Jellyfin**: Media streaming server
|
|
- **Immich**: Self-hosted photo and video management
|
|
- **Minecraft**: Game servers (ATM-10 and Stacia 2 Expert modpacks)
|
|
|
|
### AI & Machine Learning
|
|
- **Ollama**: Local LLM runner
|
|
- **Open WebUI**: Web interface for AI models
|
|
- **ComfyUI**: Stable Diffusion workflow UI
|
|
- **Stable Diffusion**: Image generation service
|
|
|
|
### Self-Hosted Tools
|
|
- **Harbor**: Container image registry
|
|
- **Pelican**: Game server management panel
|
|
|
|
### Development & CI/CD
|
|
- **Gitea**: Self-hosted Git service with container registry
|
|
- **n8n**: Workflow automation platform
|
|
- **MinIO AIStor**: S3-compatible object storage
|
|
|
|
### Productivity & Collaboration
|
|
- **React-Resume**: Resume builder with MinIO and PostgreSQL
|
|
- **Passbolt**: Team password manager
|
|
- **Wiki.js**: Modern documentation platform
|
|
- **Outline**: Team knowledge base and wiki (PostgreSQL, Redis/Valkey, MinIO S3, Authentik SSO)
|
|
- **Zipline**: File sharing and screenshot service
|
|
- **Gotify**: Push notification server with REST API and WebSocket support
|
|
- **BentoPDF**: PDF conversion service
|
|
- **Excalidraw**: Online whiteboard and diagramming tool
|
|
- **SearXNG**: Privacy-respecting metasearch engine
|
|
- **Databasus**: Database management UI
|
|
- **Uptime Kuma**: Uptime and status monitoring
|
|
|
|
### Administration & Monitoring
|
|
- **IT-Tools**: Collection of useful IT utilities
|
|
- **Technitium**: DNS server with web interface
|
|
- **Azure DDNS Python**: Dynamic DNS updater for Azure DNS
|
|
- **NetbootXYZ**: Network boot service for OS installation
|
|
- **VictoriaMetrics**: Metrics collection and monitoring stack
|
|
|
|
### External Service Integration
|
|
- **Proxmox**: Virtualization platform integration
|
|
- **UniFi**: Network controller integration
|
|
- **TrueNAS**: Storage system integration
|
|
|
|
### Deprecated
|
|
- **Nginx Ingress Controller**: Replaced by Envoy Gateway; dropped after upstream support ended in March 2025
|
|
- **Psono**: Self-hosted password manager; replaced by Passbolt
|
|
- **Vaultwarden**: Self-hosted Bitwarden server; no longer in use
|
|
- **AFFiNE**: Collaborative workspace and note-taking platform; no longer in use
|
|
- **Jenkins**: CI/CD automation server; no longer in use
|
|
- **Ntfy**: Push notification service; no longer in use
|
|
|
|
## Infrastructure
|
|
|
|
- **Kubernetes Cluster**: K3S v1.33+
|
|
- **Ingress**: Envoy Gateway (Kubernetes Gateway API)
|
|
- **Load Balancer**: MetalLB (IP pool: 10.8.11.100-10.8.11.150)
|
|
- **Storage**: Longhorn distributed storage, separate PVCs per data type
|
|
- **TLS**: cert-manager with Azure DNS validation, domain *.jsme.be
|
|
- **Secrets**: Infisical secrets management
|
|
- **SSO**: Authentik for centralized authentication
|
|
- **RBAC**: Role-based access control for ArgoCD and service accounts
|
|
|
|
## Deployment
|
|
|
|
ArgoCD monitors this repository and automatically syncs changes to the cluster. Rollbacks are possible through Git history.
|
|
|
|
## Maintenance
|
|
|
|
- **GitOps**: All changes made through Git commits
|
|
- **Certificate Renewal**: Automated via cert-manager
|
|
- **Updates**: Managed through image tag updates in manifests
|