Initial commit

d4rkfella · Nov 27, 2024 · 2e36c66 · 2e36c66
commit 2e36c66
Show file tree

Hide file tree

Showing 398 changed files with 16,586 additions and 0 deletions.
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -0,0 +1,94 @@
+FROM alpine:edge@sha256:8431297eedca8df8f1e6144803c6d7e057ecff2408aa6861213cb9e507acadf8
+
+ARG USERNAME=vscode
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+# renovate: depName=fluxcd/flux2
+ARG FLUX_VERSION=v2.4.0
+# renovate: depName=getsops/sops
+ARG SOPS_VERSION=v3.9.1
+# renovate: depName=kubernetes/kubernetes
+ARG KUBECTL_VERSION=v1.31.3
+# renovate: depName=helmfile/helmfile
+ARG HELMFILE_VERSION=v0.169.1
+# renovate: depName=helm/helm
+ARG HELM_VERSION=v3.16.3
+# renovate: depName=go-task/task
+ARG TASK_VERSION=v3.40.0
+# renovate: depName=siderolabs/talos
+ARG TALOSCTL_VERSION=v1.8.3
+# renovate: depName=kubevirt/kubevirt
+ARG VIRTCTL_VERSION=v1.4.0
+
+ENV SHELL=/bin/bash
+
+WORKDIR /tmp
+
+RUN echo "**** Installing packages ****" && \ 
+    apk add --no-cache \
+    coreutils \
+    curl \
+    cosign \
+    jq \
+    nano \
+    bash \
+    openssl \
+    ca-certificates \
+    git \
+    github-cli \
+    libstdc++ \
+    direnv \
+    yq \
+    unzip && \
+    echo "**** Creating user and group ****" && \
+    addgroup -g $USER_GID $USERNAME && \
+    adduser -u $USER_UID -G $USERNAME -s /bin/sh -D $USERNAME && \
+    echo "**** Adding direnv hook ****" && \
+    echo 'eval "$(direnv hook bash)"' >> /home/$USERNAME/.bashrc && \
+    echo "**** Installing binaries ****" && \
+    curl -fsSLO "https://dl.k8s.io/release/$KUBECTL_VERSION/bin/linux/amd64/kubectl" && \
+    curl -fsSLO "https://dl.k8s.io/release/$KUBECTL_VERSION/bin/linux/amd64/kubectl.sha256" && \
+    echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check --strict && \
+    chmod +x ./kubectl && \
+    mv ./kubectl /usr/local/bin/kubectl && \
+    curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash -s -- -v $HELM_VERSION && \
+    curl -fsSLO https://github.com/getsops/sops/releases/download/$SOPS_VERSION/sops-$SOPS_VERSION.linux.amd64 && \
+    curl -fsSLO https://github.com/getsops/sops/releases/download/$SOPS_VERSION/sops-$SOPS_VERSION.checksums.txt && \
+    curl -fsSLO https://github.com/getsops/sops/releases/download/$SOPS_VERSION/sops-$SOPS_VERSION.checksums.pem && \
+    curl -fsSLO https://github.com/getsops/sops/releases/download/$SOPS_VERSION/sops-$SOPS_VERSION.checksums.sig && \
+    cosign verify-blob sops-$SOPS_VERSION.checksums.txt \
+      --certificate sops-$SOPS_VERSION.checksums.pem \
+      --signature sops-$SOPS_VERSION.checksums.sig \
+      --certificate-identity-regexp=https://github.com/getsops \
+      --certificate-oidc-issuer=https://token.actions.githubusercontent.com && \
+    grep "sops-$SOPS_VERSION.linux.amd64" sops-$SOPS_VERSION.checksums.txt > checksum-linux-amd64.txt && \
+    echo "$(cat checksum-linux-amd64.txt)" | sha256sum --check --strict && \
+    mv sops-$SOPS_VERSION.linux.amd64 /usr/local/bin/sops && \
+    chmod +x /usr/local/bin/sops && \
+    curl -fsSLO https://github.com/siderolabs/talos/releases/download/$TALOSCTL_VERSION/talosctl-linux-amd64 && \
+    curl -fsSL -o talosctl_sha256sum.txt https://github.com/siderolabs/talos/releases/download/$TALOSCTL_VERSION/sha256sum.txt && \
+    grep "talosctl-linux-amd64" talosctl_sha256sum.txt > talosctl_amd64_sha256sum.txt && \
+    echo "$(cat talosctl_amd64_sha256sum.txt)" | sha256sum --check --strict && \
+    chmod +x ./talosctl-linux-amd64 && mv ./talosctl-linux-amd64 /usr/local/bin/talosctl && \
+    curl -fsSLO https://github.com/helmfile/helmfile/releases/download/$HELMFILE_VERSION/helmfile_$(echo $HELMFILE_VERSION | sed 's/^v//')_checksums.txt && \
+    curl -fsSLO https://github.com/helmfile/helmfile/releases/download/$HELMFILE_VERSION/helmfile_$(echo $HELMFILE_VERSION | sed 's/^v//')_linux_amd64.tar.gz && \
+    grep "helmfile_$(echo $HELMFILE_VERSION | sed 's/^v//')_linux_amd64.tar.gz" helmfile_$(echo $HELMFILE_VERSION | sed 's/^v//')_checksums.txt > checksum-helmfile-linux-amd64.txt && \
+    echo "$(cat checksum-helmfile-linux-amd64.txt)" | sha256sum --check --strict && \
+    tar -xvzf helmfile_$(echo $HELMFILE_VERSION | sed 's/^v//')_linux_amd64.tar.gz && \
+    chmod +x ./helmfile && \
+    mv helmfile /usr/local/bin/helmfile && \
+    curl -fsSL https://taskfile.dev/install.sh | bash -s -- -d $TASK_VERSION -b /usr/local/bin && \
+    curl -fsSL https://fluxcd.io/install.sh | FLUX_VERSION=$(echo $FLUX_VERSION | sed 's/^v//') bash && \
+    curl -fsSLO https://github.com/kubevirt/kubevirt/releases/download/$VIRTCTL_VERSION/virtctl-$VIRTCTL_VERSION-linux-amd64 && \
+    chmod +x ./virtctl-$VIRTCTL_VERSION-linux-amd64 && mv ./virtctl-$VIRTCTL_VERSION-linux-amd64 /usr/local/bin/virtctl && \
+    curl -fsSLO https://releases.pagure.org/virt-viewer/virt-viewer-11.0.tar.xz && \
+    tar -xJf virt-viewer-11.0.tar.xz && \
+    chmod +x ./virt-viewer-11.0 && mv ./virt-viewer-11.0 /usr/local/bin/virt-viewer && \
+    echo "**** Cleaning up ****" && \
+    rm -rf /root/.cache /tmp/*
+
+WORKDIR /project
+
+USER $USERNAME
+
+CMD ["/bin/bash"]
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
@@ -0,0 +1,78 @@
+//devcontainer.json
+{
+    "name": "Kubernetes Management",
+
+    "image": "ghcr.io/darkfella91/devcontainer:v1.0.0@sha256:a14b98f82f1ac17d530156e84b77a53c4e68112ed39016641a0158d418a97986",
+
+    "postStartCommand": "/usr/bin/direnv allow /project/.envrc",
+
+    "workspaceFolder": "/project",
+    "workspaceMount": "source=${localWorkspaceFolder},target=/project,type=bind,consistency=consistent",
+
+    "customizations": {
+      "vscode": {
+        "settings": {
+            "editor.bracketPairColorization.enabled": true,
+            "editor.fontFamily": "FiraCode Nerd Font, monospace",
+            "editor.fontLigatures": true,
+            "editor.guides.bracketPairs": true,
+            "editor.guides.bracketPairsHorizontal": true,
+            "editor.guides.highlightActiveBracketPair": true,
+            "editor.hover.delay": 1500,
+            "editor.rulers": [
+                100
+            ],
+            "editor.stickyScroll.enabled": false,
+            "explorer.autoReveal": false,
+
+            "files.associations": {
+                "**/*.json5": "jsonc"
+            },
+            "files.trimTrailingWhitespace": true,
+
+            "material-icon-theme.files.associations": {
+                "*.secret.sops.env": "lock",
+                "*.secret.sops.yaml": "lock"
+            },
+            "material-icon-theme.activeIconPack": "angular",
+            "material-icon-theme.folders.associations": {
+                ".archive": "archive",
+                ".github/workflows": "robot",
+                "actions-runner-system": "github",
+                "cert-manager": "guard",
+                "digester-system": "hook",
+                "external-secrets": "secure",
+                "flux-system": "pipe",
+                "flux": "pipe",
+                "kube-system": "kubernetes",
+                "network": "connection",
+                "observability": "event",
+                "rook-ceph": "base",
+                "storage": "dump",
+                "system-upgrade": "update",
+                "tools": "tools",
+                "volsync": "aws",
+                "cloudflared": "cloudflare",
+                "talos": "linux"
+            },
+            "sops.defaults.ageKeyFile": "./age.key",
+            "sops.creationEnabled": true,
+            "yaml.schemaStore.enable": true,
+            "yaml.schemas": {
+                "kubernetes": "./kubernetes/**/*.yaml"
+            }
+        },
+        "extensions": [
+            "signageos.signageos-vscode-sops",
+            "BriteSnow.vscode-toggle-quotes",
+            "redhat.vscode-yaml",
+            "mitchdenny.ecdc",
+            "mikestead.dotenv",
+            "fcrespo82.markdown-table-formatter",
+            "albert.TabOut",
+            "PKief.material-icon-theme",
+            "PKief.material-product-icons"
+        ]
+      }
+    }
+}
diff --git a/.devcontainer/version.txt b/.devcontainer/version.txt
@@ -0,0 +1 @@
+v1.0.0
diff --git a/.editorconfig b/.editorconfig
@@ -0,0 +1,23 @@
+; https://editorconfig.org/
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[{Makefile,go.mod,go.sum,*.go,.gitmodules}]
+indent_style = tab
+indent_size = 4
+
+[*.md]
+indent_size = 4
+trim_trailing_whitespace = false
+
+[{Dockerfile,*.bash,*.sh}]
+indent_style = space
+indent_size = 4
diff --git a/.envrc b/.envrc
@@ -0,0 +1,8 @@
+#shellcheck disable=SC2148,SC2155
+# Kubernetes
+export KUBECONFIG="$(expand_path ./kubernetes/main/kubeconfig)"
+export SOPS_AGE_KEY_FILE="$(expand_path ./age.key)"
+export TALOSCONFIG="$(expand_path ./kubernetes/main/talosconfig)"
+# Taskfile
+export TASK_X_ENV_PRECEDENCE=1
+export TASK_X_MAP_VARIABLES=0
diff --git a/.gitattributes b/.gitattributes
@@ -0,0 +1,2 @@
+* text=auto eol=lf
+*.sops.* diff=sopsdiffer
diff --git a/.github/labeler.yaml b/.github/labeler.yaml
@@ -0,0 +1,22 @@
+---
+# Areas
+area/docs:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "docs/**/*"
+          - "README.md"
+area/github:
+  - changed-files:
+      - any-glob-to-any-file: ".github/**/*"
+area/kubernetes:
+  - changed-files:
+      - any-glob-to-any-file: "kubernetes/**/*"
+area/taskfile:
+  - changed-files:
+      - any-glob-to-any-file:
+          - ".taskfiles/**/*"
+          - "Taskfile.yaml"
+# Clusters
+cluster/main:
+  - changed-files:
+      - any-glob-to-any-file: "kubernetes/main/**/*"
diff --git a/.github/labels.yaml b/.github/labels.yaml
@@ -0,0 +1,38 @@
+---
+# Areas
+- name: area/docs
+  color: "0e8a16"
+- name: area/github
+  color: "0e8a16"
+- name: area/kubernetes
+  color: "0e8a16"
+- name: area/taskfile
+  color: "0e8a16"
+# Clusters
+- name: cluster/main
+  color: "ffc300"
+# Renovate Types
+- name: renovate/container
+  color: "027fa0"
+- name: renovate/github-action
+  color: "027fa0"
+- name: renovate/grafana-dashboard
+  color: "027fa0"
+- name: renovate/github-release
+  color: "027fa0"
+- name: renovate/helm
+  color: "027fa0"
+# Semantic Types
+- name: type/digest
+  color: "ffeC19"
+- name: type/patch
+  color: "ffeC19"
+- name: type/minor
+  color: "ff9800"
+- name: type/major
+  color: "f6412d"
+# Uncategorized
+- name: community
+  color: "370fb2"
+- name: hold
+  color: "ee0701"
diff --git a/.github/renovate.json5 b/.github/renovate.json5
@@ -0,0 +1,46 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "docker:enableMajor",
+    "replacements:k8s-registry-move",
+    ":automergeBranch",
+    ":disableRateLimiting",
+    ":dependencyDashboard",
+    ":semanticCommits",
+    ":skipStatusChecks",
+    ":timezone(Europe/Sofia)",
+    "github>Darkfella91/home-ops//.github/renovate/allowedVersions.json5",
+    "github>Darkfella91/home-ops//.github/renovate/autoMerge.json5",
+    "github>Darkfella91/home-ops//.github/renovate/clusters.json5",
+    "github>Darkfella91/home-ops//.github/renovate/commitMessage.json5",
+    "github>Darkfella91/home-ops//.github/renovate/customManagers.json5",
+    "github>Darkfella91/home-ops//.github/renovate/grafanaDashboards.json5",
+    "github>Darkfella91/home-ops//.github/renovate/groups.json5",
+    "github>Darkfella91/home-ops//.github/renovate/labels.json5",
+    "github>Darkfella91/home-ops//.github/renovate/packageRules.json5",
+    "github>Darkfella91/home-ops//.github/renovate/semanticCommits.json5",
+    "github>Darkfella91/home-ops//.github/renovate/devcontainer.json5"
+  ],
+  "dependencyDashboardTitle": "Renovate Dashboard 🤖",
+  "suppressNotifications": ["prEditedNotification", "prIgnoreNotification"],
+  "onboarding": false,
+  "requireConfig": "ignored",
+  "ignorePaths": ["**/*.sops.*", "**/.archive/**", "**/resources/**"],
+  "flux": {
+    "fileMatch": [
+      "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"
+    ]
+  },
+  "helm-values": {
+    "fileMatch": [
+      "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"
+    ]
+  },
+  "kubernetes": {
+    "fileMatch": [
+      "(^|/)\\.taskfiles/.+\\.ya?ml(?:\\.j2)?$",
+      "(^|/)kubernetes/.+\\.ya?ml(?:\\.j2)?$"
+    ]
+  }
+}
diff --git a/.github/renovate/allowedVersions.json5 b/.github/renovate/allowedVersions.json5
@@ -0,0 +1,10 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "packageRules": [
+    {
+      "matchDatasources": ["docker"],
+      "matchPackagePatterns": ["postgresql"],
+      "allowedVersions": "<18"
+    }
+  ]
+}
diff --git a/.github/renovate/autoMerge.json5 b/.github/renovate/autoMerge.json5
@@ -0,0 +1,21 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "packageRules": [
+    {
+      "description": ["Auto-merge container digests updates for trusted containers"],
+      "matchDatasources": ["docker"],
+      "automerge": true,
+      "automergeType": "branch",
+      "matchUpdateTypes": ["digest"],
+      "matchPackagePatterns": ["ghcr.io/bjw-s", "ghcr.io/onedr0p"]
+    },
+    {
+      "description": ["Auto-merge GitHub Actions for minor and patch"],
+      "matchManagers": ["github-actions"],
+      "matchDatasources": ["github-tags"],
+      "automerge": true,
+      "automergeType": "branch",
+      "matchUpdateTypes": ["minor", "patch"]
+    }
+  ]
+}
diff --git a/.github/renovate/clusters.json5 b/.github/renovate/clusters.json5
@@ -0,0 +1,10 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "packageRules": [
+    {
+      "description": ["Separate PRs for main cluster"],
+      "matchFileNames": ["**/kubernetes/main/**"],
+      "additionalBranchPrefix": "main-"
+    }
+  ]
+}
diff --git a/.github/renovate/commitMessage.json5 b/.github/renovate/commitMessage.json5
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "commitMessageTopic": "{{depName}}",
+  "commitMessageExtra": "to {{newVersion}}",
+  "commitMessageSuffix": "",
+  "packageRules": [
+    {
+      "matchDatasources": ["helm"],
+      "commitMessageTopic": "chart {{depName}}"
+    },
+    {
+      "matchDatasources": ["docker"],
+      "commitMessageTopic": "image {{depName}}"
+    }
+  ]
+}