authelia: Update to 4.38.18

argocd/applications/vaultwarden.yaml

@@ -1,16 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: vaultwarden
-  namespace: argocd
-spec:
-  destination:
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: vaultwarden
-    repoURL: https://git.pyrocufflink.blue/infra/kubernetes.git
-    targetRevision: master
-  syncPolicy:
-    automated:
-      prune: true

home-assistant/configuration.yaml

@@ -39,16 +39,13 @@ recorder:
 
 homeassistant:
   auth_providers:
+  - type: homeassistant
   - type: trusted_networks
     trusted_networks:
     - 172.31.1.81/32
-    - 172.31.1.244/32
     trusted_users:
       172.31.1.81:
       - 03a8b3528f1145ab908e20ed5687d893
-      172.31.1.244:
-      - 03a8b3528f1145ab908e20ed5687d893
-  - type: homeassistant
     allow_bypass_login: true
   whitelist_external_dirs:
   - /config

jenkins/gentoo-storage.yaml

@@ -1,170 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: portage
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: portage
-    app.kubernetes.io/component: gentoo
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 4Gi
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: binpkgs
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: binpkgs
-    app.kubernetes.io/component: gentoo
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi
-
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: gentoo-dist
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: gentoo-dist
-    app.kubernetes.io/component: gentoo
-data:
-  rsyncd.conf: |+
-    [gentoo-portage]
-    path = /var/db/repos/gentoo
-
-    [binpkgs]
-    path = /var/cache/binpkgs
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: gentoo-dist
-  namespace: jenkins-jobs
-spec:
-  selector:
-    app.kubernetes.io/name: gentoo-dist
-    app.kubernetes.io/component: gentoo
-  ports:
-  - name: rsync
-    port: 873
-    targetPort: rsync
-  type: NodePort
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gentoo-dist
-  namespace: jenkins-jobs
-  labels: &labels
-    app.kubernetes.io/name: gentoo-dist
-    app.kubernetes.io/component: gentoo
-spec:
-  selector:
-    matchLabels: *labels
-  template:
-    metadata:
-      labels: *labels
-    spec:
-      containers:
-      - name: rsync
-        image: docker.io/gentoo/stage3
-        command:
-        - /usr/bin/rsync
-        - --daemon
-        - --no-detach
-        - --port=8873
-        - --log-file=/dev/stderr
-        ports:
-        - name: rsync
-          containerPort: 8873
-        securityContext:
-          readOnlyRootFilesystem: true
-          runAsUser: 250
-          runAsGroup: 250
-        volumeMounts:
-        - mountPath: /etc/rsyncd.conf
-          name: config
-          subPath: rsyncd.conf
-        - mountPath: /var/db/repos/gentoo
-          name: portage
-        - mountPath: /var/cache/binpkgs
-          name: binpkgs
-      volumes:
-      - name: binpkgs
-        persistentVolumeClaim:
-          claimName: binpkgs
-      - name: config
-        configMap:
-          name: gentoo-dist
-      - name: portage
-        persistentVolumeClaim:
-          claimName: portage
-
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: emerge-webrsync
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: emerge-webrsync
-    app.kubernetes.io/component: gentoo
-spec:
-  template:
-    spec:
-      containers:
-      - name: sync
-        image: docker.io/gentoo/stage3
-        command:
-        - emerge-webrsync
-        volumeMounts:
-        - mountPath: /var/db/repos/gentoo
-          name: portage
-      restartPolicy: OnFailure
-      volumes:
-      - name: portage
-        persistentVolumeClaim:
-          claimName: portage
-
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: sync-portage
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: sync-portage
-    app.kubernetes.io/component: gentoo
-spec:
-  schedule: 4 19 * * *
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          containers:
-          - name: sync
-            image: docker.io/gentoo/stage3
-            command:
-            - emaint
-            - sync
-            volumeMounts:
-            - mountPath: /var/db/repos/gentoo
-              name: portage
-          restartPolicy: OnFailure
-          volumes:
-          - name: portage
-            persistentVolumeClaim:
-              claimName: portage

jenkins/kustomization.yaml

@@ -9,7 +9,6 @@ resources:
 - jenkins.yaml
 - secrets.yaml
 - iscsi.yaml
-- gentoo-storage.yaml
 
 configMapGenerator:
 - name: ssh-known-hosts

sshca/secrets.yaml

@@ -11,6 +11,7 @@ spec:
     metadata:
       name: sshca-host-key
       namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -24,6 +25,7 @@ spec:
     metadata:
       name: sshca-host-passphrase
       namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -37,6 +39,7 @@ spec:
     metadata:
       name: sshca-libvirt-sshkey
       namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -51,6 +54,7 @@ spec:
       name: imagepull-gitea
       namespace: sshca
     type: kubernetes.io/dockerconfigjson
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -59,7 +63,7 @@ metadata:
   namespace: sshca
 spec:
   encryptedData:
-    machine-ids.json: AgA/rGsQ4sYYCgFyurPMa8GW5NnuekLpB6F4NGuAjEJkmEROFIpgZpPMuSvH+oMW4g4YCrSf03ou4c0jwV6f1/EXWu/qwDe+yJCuT2zknMdGduQEJjrBt+f3zskkHFRqp2inAZCPmObJOPQMwu53JhwN602MC8Tl9VGpg1a/lTmjNELotlkXEwJUmL80Q/pJ/1AK4eUR0BwL8asHKtH5Zt9Nq8X7YV/aL68Tf1u7UvZEX/P0ySBnfqCfQDyW7UjjTiZJlTYzl6Q8+oFd40E8BCNmF2lp8Swp0H/Ac+lNtMIwLdIi0I+E1AtRULnOULmCqmZGjzcMt/ZR9jQUlVRr+osfvUmS+Ed7E83/VIJhvWVTlhh/rEg+DNvpwX5gmg4Pag2SZ//fgAdWwqzIk5H+reSx7apX+eUh+eW9CpkDWNEXlvI8vQ3KneZjwvgTbt0YMSMLpF5jwGeo68Q1i03X65QwlZT2QhUTs6sho3wsO1g+9EMfg3iMwMpb2ui3jJNhK8Eelm5jqmSmvw+lFzSB9DPc9ADnNghUMPoGZIqG9lfjnMWbeION9EqMYjhJsN8Z9r4U/nB/OVLSsSAG4mLA/Rf5n0ih9kFOYcerrrvFWa63ruJpDzctQOoHvH6G9SnWqMppRcS47p6MTuhJL3NNsR3KgHw8Co4/SxJk2wYSAojgLIojICjxFC3EnuYrNNoD1lg+4GvyKyL3sFO8tL2HZ9Nm3q93dLvileL1nfMbvD8j560wfBcjjQ7ewl+9VIcp8KEgq00ofFEeO3MdMGpi/1vYQc5ordzE0+J2ErDlKGZuJv2addjlQ2LY78tw5VVwE85JUosL7KB8nEutJzL+mxGcCPPo/BGTp3GlSCydqNDcmVElvHWzLDjh8LjkydsEIMW1VQWW++OiXJMebadcUrPm9E/lTXAUuExhpnXq72Tt4RMDJZCDq0538DcVeIEKf3LoMM7xGnp/0Zg1MKCKLft8LA7PsBUh7ohIZFqKfHmca9zHEo1C+b9k6QQ3F0qK+0yJS3XIFLASHIxgmeCj3zKlz+bsApgG++OGGjt0Ga6rX/2O7nsGVV16b+cZgDhIDV7IdULtAhiQ0YdGunifNQ6Vo7HFawOfTiGrpHCZSslINLCEDpzAyANxaB65VwuL6pUJoGjRes8vWx3lp5Fimeo9jP9cb/vzrWswOVx0uPIxl8P4UENT1J8yNa9toG5CmGdPeHTNOOWOqWtcJoO8FZ/szRRzPfXCEo9dhh7USNw/bbwYxpBha5LScp3tBw3zHiIvf7n07iZjnzsipC/Fj4/7s3vnxwotgW6HluZho/ZEhl88tRNxmjgTAcQiYVLOc18XB+bKQQGmTstYVkLwAhkBPkArLg4q/HV6XpqByfc3i3Lp2mnS9QRf0lVwXo28RHBYKhy2E1oRDawCtc1K5u3RZuiHtRbifphwA34dZZ6JxUP9Ytorv6LS2BC+ev4b6QCuLWzFaJXZyzfmJ0FJo2wsvGPO/1vJ06Ic5WC2PlLerBI9d20iw0YcQKPJ9pG+LvfQ8X7JUnYj5Uos1MbOfZM9WBZUg6pPTH9bLWrp1fxS6sxqqBDzSHfthskSa/g8zbGUzf8KwSoqRky+EkVZ2loeYbIpIWOv2Q/50R2UwBrFsdfWvcoukSY772+gX04ISGY/ombcbZTC4dWkWWlaRhe/A3XW9LsR0BEZrM08MCkW/FSLkQj0zm2+GOVM/LX87dXl/y12lRIicqcNe1huwfrXyd2DMl5qrTR46P9qiHt222SggiLNN3ZdM9qWffZrFZI20RhkXnM/dWX13BcsKsquAya3pjPht6A4geayenC7riA3XmHGUlSEonH37pwviak=
+    machine-ids.json: AgCb7/mfYysqkr5Lcu0xJQ15U2LKOuMTyej3IcIS1ZT/8iFbCStY3T/nc+RBtb6yzBzskikk1KXa95I4rOolh4PPgDP+toO77zjJDFPHMWUHSDlKcK2/k68cPenM/euo45tW9fBD2CbZZvZAlrEcknvYSE48Bkl4cNa1vn9tcjIA2PStn9UGTgbT8R3uJJEPJYaZ2QGCl2uFzI/laaQ7X/quXdxOd/E7c74VOsCx+uRwUdERqMSjFPCT9oI1CxzstR88SoaTqjywTw+j91qKrBJrNKdhhCZ9b7zciZO4TmWi36eq+qZS2rvgQG8HV93LiA7vl9H9U2GpA8P5pczlIm/lCvSDt/vLrTXNWKAuae9CaxYvUp38ilszbCnuA2cCa+nbNKcrIhVlWyRaObK9U7cmZLmx/VtuWF4MLXFU4I3getePVb3M86PWgbkYEZtUPRWzfEksggsWkedmEFagOuFKUnmlj69uXDxV+seBF9EFAQbJBjgEQ15ba/HafWsMF8z/5UznCBD7rOc2Wr6VZuTu3+Tr2AU6DhEcEaXqrMW8eqNEhNxYyoCnVSil6uW12AJdK6+4yJuDfbH0qh/TqWOoVxkpIqz6LLz7RIxxAHmeMascGLDwD5msMx6uz7vEKJPBvBk+FNScJ3w/bOUiDNIDeSEAKN30OnXVrgO+9KKpLsXAPHg+wu6f/F8CNKQ0DuRFIZgq13JC93G4kY4TRZ7vHc32fxLjfmo3A7MFiOWyyNLeKuvgjEgSptlw1jQZd0qaeYoniN+nvSKITGNKrc5VH/2sRoZ9GYwPq0ONx3DmOzJGe+sohwIXzDmK3GmLZ+syLo5GuimNiPfh2I/+JwHfBLwWBmCk9Xg1li2R7Eq3g1Rm+w+z4kwB2Mwt91jkgTD4Ug3hjj3ThX4uenYPAYYI7gktwYZUlmWAPjcS/SjW+FLegN9chya4/boIXxrXUMJ0zVj9gPhDB+p+n/8C2i2rgcOcliWHPcbfuQgcgLBxyrr0ymxsGXuJJraV/VjdjJMXhfOCtV6vvC27EgUIef1MzcHA7ZVyeNHo7XMKOA6Z0EshRCXnYzbqIKXHG2/ABuOEGwM6u/ttGlvRvpvt73hXSy4UlXyx3j5HFDVLi55xtLuO+2AM2pE+CdcgGUHx3LVhjKfZKbSxED8PcSHL6v+kV6RZSgxKI2VcBCtxeeSZsPRh67SEMzr6QVwoqQvwqeKqkCwwrbkyidWw1+dUjIVNCLYpA27u9yes6R2A5J8P0DgQn0Byp2Hu08Lve//gHRS4DPZMwnOLRndVmkTdpXoeykLKDXVLNP8A45hTi3ax4p9LNcs9TAIM8LtL5Ts1oj1WvoxxzEOz2GleDQck452VQYMHTkqg4TAQE8ER/MXY7tH+AL56KHRtNNSsZCbanxVaV2f68WeMZaRFBSNEOilSFhq0IVyMwcLTxgZb9pJXBCc36pT3xQOFYC0479Sm4doXYtvct85n8Ni8HXqgdjDKm7uzDziUJaLN5/Ok8eyuUVveyN/HPyT9bxmRUUECRGnzkA+LXZfsqiHG9f85OlHjxsHG1mfjylSOG7FSabkmTUs5IvT8L2eq6VfOfivOTAhmLuroqMkt6VVnjh0K+BV2wBB8tDByBEk3sZ3OprhWtZfZlKbb1H46DbAujaSCbOXiLiI6nybkzhNIoD1+H0fwhXq7I1pn2QEdqJDKKW2q3fwjufJMu01F1M+9Zi5oZXJchpbmRNd0TZpF
   template:
     metadata:
       name: sshca-data
@@ -77,6 +81,7 @@ spec:
     metadata:
       name: sshca-user-passphrase
       namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret

updatebot/config.yml

@@ -96,13 +96,3 @@ projects:
       kind: github
       organization: authelia
       repo: authelia
-
-- name: vaultwarden
-  kind: kustomize
-  images:
-  - name: authelia
-    image: ghcr.io/dani-garcia/vaultwarden
-    source:
-      kind: github
-      organization: dani-garcia
-      repo: vaultwarden

vaultwarden/README.md

@@ -1,15 +0,0 @@
-# Vaultwarden (Bitwarden-rs)
-
-## Migration
-
-```sh
-kubectl scale statefulset -n vaultwarden vaultwarden --replicas 0
-kubectl create -f vaultwarden/migrate.yaml
-kubectl exec -n vaultwarden vaultwarden-migration -- find /data -mindepth 1 -delete
-ssh bw0 sudo systemctl stop vaultwarden
-ssh bw0 sudo tar -C /var/lib/vaultwarden/data -c . \
-    | pv \
-    | kubectl exec -n vaultwarden -i vaultwarden-migration -- tar -C /data -x
-kubectl delete pod -n vaultwarden vaultwarden-migration
-kubectl scale statefulset -n vaultwarden vaultwarden --replicas 1
-```

vaultwarden/ingress.yaml

@@ -1,20 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: vaultwarden
-  labels:
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: vaultwarden
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: bitwarden.pyrocufflink.net
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: vaultwarden
-            port:
-              name: http

vaultwarden/kustomization.yaml

@@ -1,30 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: vaultwarden
-
-labels:
-- pairs:
-    app.kubernetes.io/instance: vaultwarden
-  includeSelectors: true
-- pairs:
-    app.kubernetes.io/part-of: vaultwarden
-  includeTemplates: true
-
-resources:
-- namespace.yaml
-- vaultwarden.yaml
-- ingress.yaml
-
-configMapGenerator:
-- name: vaultwarden
-  envs:
-  - vaultwarden.env
-  options:
-    labels:
-      app.kubernetes.io/name: vaultwarden
-      app.kubernetes.io/component: vaultwarden
-
-images:
-- name: ghcr.io/dani-garcia/vaultwarden
-  newTag: 1.32.7-alpine

vaultwarden/migrate.yaml

@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: vaultwarden-migration
-  namespace: vaultwarden
-  labels: &labels
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: migration
-spec:
-  containers:
-  - name: migration
-    image: busybox
-    command:
-    - sh
-    - -c
-    - |
-      trap 'kill $!' TERM
-      sleep 99999 &
-      wait
-    securityContext:
-      readOnlyRootFilesystem: true
-    volumeMounts:
-    - mountPath: /data
-      name: data
-      subPath: data
-  securityContext:
-    runAsUser: 266
-    runAsGroup: 266
-    fsGroup: 266
-    fsGroupChangePolicy: OnRootMismatch
-  volumes:
-  - name: data
-    persistentVolumeClaim:
-      claimName: vaultwarden

vaultwarden/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: vaultwarden

vaultwarden/vaultwarden.env

@@ -1 +0,0 @@
-DOMAIN=https://bitwarden.pyrocufflink.net

vaultwarden/vaultwarden.yaml

@@ -1,95 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vaultwarden
-  labels:
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: vaultwarden
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 4Gi
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: vaultwarden
-  labels: &labels
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: vaultwarden
-spec:
-  selector: *labels
-  ports:
-  - port: 8080
-    targetPort: http
-    name: http
-
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: vaultwarden
-  labels: &labels
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: vaultwarden
-spec:
-  serviceName: vaultwarden
-  selector:
-    matchLabels: *labels
-  template:
-    metadata:
-      labels: *labels
-    spec:
-      containers:
-      - name: vaultwarden
-        image: ghcr.io/dani-garcia/vaultwarden
-        env:
-        - name: ROCKET_PORT
-          value: '8080'
-        envFrom:
-        - configMapRef:
-            name: vaultwarden
-            optional: true
-        - secretRef:
-            name: vaultwarden
-            optional: true
-        ports:
-        - name: http
-          containerPort: 8080
-        readinessProbe: &probe
-          httpGet:
-            port: http
-            path: /alive
-          failureThreshold: 1
-          periodSeconds: 60
-          timeoutSeconds: 5
-        startupProbe:
-          <<: *probe
-          failureThreshold: 60
-          initialDelaySeconds: 2
-          periodSeconds: 1
-          timeoutSeconds: 1
-        securityContext:
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - mountPath: /data
-          name: data
-          subPath: data
-        - mountPath: /tmp
-          name: tmp
-          subPath: tmp
-      securityContext:
-        runAsUser: 266
-        runAsGroup: 266
-        fsGroup: 266
-        fsGroupChangePolicy: OnRootMismatch
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: vaultwarden
-      - name: tmp
-        emptyDir:
-          medium: Memory