Nik Afiq
89524d45e3
Move manifests/multus/reserved/browser-vpn-proxy.yaml into the active multus tree (sync-wave 3) now that qBittorrent and JDownloader have both independently passed their canary, validation, and soak gates - the precondition this file's own header already called for. Add EXPECTED_VLAN50_IP/NET_RAW to its guard init container, matching the fix qBittorrent/JDownloader/canary all needed for the arping-based checks to run. Deliberately no auth (REQUIRE_AUTH=false) and no ALLOWED_IPS, after discussion: access restriction relies on the home network's own firewall (Trusted/Lab -> Lab NodePort ALLOW, other VLANs DENY except Technitium DNS), not an app-level control. Along the way, found and avoided shipping a real bug in the original draft - go-socks5-proxy's ALLOWED_IPS parses values with net.ParseIP (not CIDR-aware) and matches with exact net.IP.Equal(), so the drafted "10.10.40.0/24" value would have produced a nil whitelist entry that matches no real client, rejecting every connection. This library has no way to express a subnet allowlist at all - removed rather than left silently broken. Also drops the now-unneeded browser-vpn-proxy-credentials Secret and its companion script/README references. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Kubernetes Manifests
This directory contains raw Kubernetes resources grouped by service area. Most
subdirectories are consumed by Argo CD Applications in argocd/apps.
Directories
| Directory | Contents |
|---|---|
argocd/ |
App-of-apps, Argo CD ingress, Argo CD OIDC sealed secret |
authentik/ |
Authentik ingress, public ingress, proxy outpost, middleware, secret scripts |
cert-manager/ |
Internal and Let's Encrypt ClusterIssuers, Porkbun secret script |
core/ |
Dashy, Glances, CoreDNS custom config, CA installer |
gitea/ |
Gitea storage, backup, public ingress, runner and OIDC/admin secrets |
home-services/ |
HA gateway, AI gateway, Discord bot, service TLS, registry secret |
homeassistant/ |
Home Assistant external service and ingress |
media/ |
Jellyfin, qBittorrent, JDownloader (sending links) |
monitoring/ |
Monitoring PVs, Grafana datasource, Grafana/Auth OIDC secrets |
multus/ |
Multus CNI, VLAN 50 NetworkAttachmentDefinition, canary (details) — manual-sync Application, see argocd/apps/multus.yaml |
network/ |
Pi-hole secrets, DDNS, Traefik dashboard, external host ingresses |
portfolio/ |
Portfolio deployment, ingress, registry pull secret |
Secrets
There are two patterns:
*-sealed.yamlfiles are safe to commit and are reconciled by Sealed Secrets.*.shscripts create runtime Secrets from.envdirectly in the cluster.
Use .env.example as the template for local secret names. kubeseal must point
at the in-cluster controller named sealed-secrets-controller in kube-system.
Regenerate committed sealed secrets with the matching script, then commit the resulting YAML. Runtime secret scripts should be run against the target cluster and should not produce committed plaintext.
Certificates
Internal services generally use internal-ca-issuer and home.arpa hostnames.
Public services use Let's Encrypt issuers and nik4nao.com hostnames.
The CA installer lives in core/ca-installer. Its ca-sync CronJob keeps the
served ca.crt and Apple mobileconfig in sync with the cert-manager CA secret.
DNS
Internal DNS records are configured in values/pihole.yaml and
values/pihole-debian.yaml. Add a new hostname to both files when adding a
home.arpa service.
Dashy
core/dashy.yaml defines the deployment and a placeholder ConfigMap. The real
dashboard config comes from config/dashy/conf.yaml:
bash manifests/core/apply-dashy-config.sh