Closes #44

This change was made to recover from an update made while attempting to address DevOps/ansible-role-eom#37, which was not solved here.

Reviewed-on: #38

tasks/bridgegate_kitchen.yaml

@@ -0,0 +1,36 @@
+---
+# tasks file for wordpress
+- name: Deploy Wordpress
+  kubernetes.core.helm:
+    name: bridgegate-kitchen
+    chart_ref: bitnami/wordpress
+    release_namespace: bridgegate-kitchen
+    create_namespace: true
+    values:
+      resourcesPreset: small
+      wordpressUsername: wordpress_admin
+      wordpressPassword: "{{ wordpress_admin_password }}"
+      wordpressEmail: wordpress@eom.dev
+      wordpressFirstName: Administrator
+      wordpressLastName: Wordpress
+      wordpressBlogName: Bridgegate Kitchen
+      wordpressScheme: https
+      service:
+        type: ClusterIP
+      ingress:
+        enabled: true
+        ingressClassName: nginx
+        hostname: bridgegate-kitchen.eom.dev
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        tls: true
+      persistence:
+        enabled: true
+        size: 128Gi
+      mariadb:
+        enabled: true
+        auth:
+          password: "{{ wordpress_admin_password }}"
+        primary:
+          persistence:
+            size: 256Gi

tasks/cloud.yaml

@@ -1,191 +0,0 @@
----
-# tasks file for nextcloud
-- name: Create NextCloud namespace
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: cloud
-
-- name: Create PVC for MySQL
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolumeClaim
-      metadata:
-        name: mysql
-        namespace: cloud
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 64Gi
-
-- name: Create Deployment for MySQL
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: mysql
-        namespace: cloud
-        labels:
-          app: mysql
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: mysql
-        template:
-          metadata:
-            labels:
-              app: mysql
-          spec:
-            containers:
-              - name: mysql
-                image: mysql
-                volumeMounts:
-                  - name: data
-                    mountPath: /var/lib/mysql
-                ports:
-                  - containerPort: 3306
-                env:
-                  - name: MYSQL_ROOT_PASSWORD
-                    value: "{{ mysql_root_password }}"
-                  - name: MYSQL_DATABASE
-                    value: nextcloud
-                  - name: MYSQL_USER
-                    value: nextcloud
-                  - name: MYSQL_PASSWORD
-                    value: "{{ nextcloud_mysql_password }}"
-            volumes:
-              - name: data
-                persistentVolumeClaim:
-                  claimName: mysql
-
-- name: Create Service for MySQL
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: mysql
-        namespace: cloud
-      spec:
-        selector:
-          app: mysql
-        ports:
-          - port: 3306
-            name: mysql
-        type: ClusterIP
-
-- name: Create PVC for NextCloud
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolumeClaim
-      metadata:
-        name: nextcloud
-        namespace: cloud
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 128Gi
-
-- name: Create Deployment for NextCloud
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: nextcloud
-        namespace: cloud
-        labels:
-          app: nextcloud
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: nextcloud
-        template:
-          metadata:
-            labels:
-              app: nextcloud
-          spec:
-            containers:
-              - name: nextcloud
-                image: nextcloud
-                volumeMounts:
-                  - name: data
-                    mountPath: /var/www/html
-                ports:
-                  - containerPort: 3000
-                env:
-                  - name: MYSQL_HOST
-                    value: mysql
-                  - name: MYSQL_DATABASE
-                    value: nextcloud
-                  - name: MYSQL_USER
-                    value: nextcloud
-                  - name: MYSQL_PASSWORD
-                    value: "{{ nextcloud_mysql_password }}"
-            volumes:
-              - name: data
-                persistentVolumeClaim:
-                  claimName: nextcloud
-
-- name: Create Service for NextCloud
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: nextcloud
-        namespace: cloud
-      spec:
-        selector:
-          app: nextcloud
-        ports:
-          - port: 80
-            name: http
-        type: ClusterIP
-
-- name: Create Ingress
-  k8s:
-    state: present
-    definition:
-      apiVersion: networking.k8s.io/v1
-      kind: Ingress
-      metadata:
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        name: nextcloud
-        namespace: cloud
-      spec:
-        ingressClassName: nginx
-        rules:
-          - host: cloud.eom.dev
-            http:
-              paths:
-                - pathType: Prefix
-                  path: /
-                  backend:
-                    service:
-                      name: nextcloud
-                      port:
-                        number: 80
-        tls:
-          - hosts:
-            - cloud.eom.dev
-            secretName: nextcloud

tasks/coturn.yaml

@@ -17,28 +17,92 @@
     release_namespace: coturn
     create_namespace: true
     values:
+        global:
+          security:
+            allowInsecureImages: true
+        service:
+          type: LoadBalancer
+          externalTrafficPolicy: Local
         certificate:
           enabled: true
           host: coturn.eom.dev
-          issuer: ca-issuer
+          issuerName: ca-issuer
-        uris:
-          - turns:coturn.eom.dev?transport=udp
-        allowGuests: true
         sharedSecret: "{{ coturn_shared_secret }}"
-        service:
-          type: NodePort
         image:
           tag: latest
           pullPolicy: Always
         externalDatabase:
           enabled: true
+          username: coturn
+          password: "{{ coturn_admin_password }}"
+          database: coturn
         postgresql:
-          enabled: false
+          enabled: true
+          image:
+            repository: bitnamilegacy/postgresql
+            tag: 17.6.0-debian-12-r0
           global:
             postgresql:
               auth:
                 password: "{{ coturn_admin_password }}"
           primary:
+            initdb:
+              scripts:
+                schema.sql: |
+                  CREATE TABLE turnusers_lt (
+                      realm varchar(127) default '',
+                      name varchar(512),
+                      hmackey char(128),
+                      PRIMARY KEY (realm,name)
+                  );
+
+                  CREATE TABLE turn_secret (
+                      realm varchar(127) default '',
+                      value varchar(256),
+                      primary key (realm,value)
+                  );
+
+                  CREATE TABLE allowed_peer_ip (
+                      realm varchar(127) default '',
+                      ip_range varchar(256),
+                      primary key (realm,ip_range)
+                  );
+
+                  CREATE TABLE denied_peer_ip (
+                      realm varchar(127) default '',
+                      ip_range varchar(256),
+                      primary key (realm,ip_range)
+                  );
+
+                  CREATE TABLE turn_origin_to_realm (
+                      origin varchar(127),
+                      realm varchar(127),
+                      primary key (origin)
+                  );
+
+                  CREATE TABLE turn_realm_option (
+                      realm varchar(127) default '',
+                      opt varchar(32),
+                      value varchar(128),
+                      primary key (realm,opt)
+                  );
+
+                  CREATE TABLE oauth_key (
+                      kid varchar(128),
+                      ikm_key varchar(256),
+                      timestamp bigint default 0,
+                      lifetime integer default 0,
+                      as_rs_alg varchar(64) default '',
+                      realm varchar(127),
+                      primary key (kid)
+                  );
+
+                  CREATE TABLE admin_user (
+                      name varchar(32),
+                      realm varchar(127),
+                      password varchar(127),
+                      primary key (name)
+                  );
             persistence:
               size: 256Gi
         coturn:
@@ -46,3 +110,6 @@
           auth:
             username: coturn
             password: "{{ coturn_admin_password }}"
+          extraTurnserverConfiguration: |
+            use-auth-secret
+            static-auth-secret={{ coturn_shared_secret }}

tasks/dex.yaml

@@ -0,0 +1,97 @@
+---
+# tasks file for dex
+- name: Add Dex repo
+  kubernetes.core.helm_repository:
+    name: dex
+    repo_url: https://charts.dexidp.io
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy PostgreSQL
+  kubernetes.core.helm:
+    name: postgresql
+    chart_ref: bitnami/postgresql
+    release_namespace: dex
+    create_namespace: true
+    values:
+      auth:
+        enablePostgresUser: true
+        postgresPassword: "{{ postgresql_admin_password }}"
+        username: "dex"
+        password: "{{ dex_admin_password }}"
+        database: "dex"
+      primary:
+        name: primary
+        initdb:
+          scripts: {}
+        persistence:
+          enabled: true
+          volumeName: "data"
+          size: 256Gi
+
+- name: Deploy Dex
+  kubernetes.core.helm:
+    name: dex
+    chart_ref: dex/dex
+    release_namespace: dex
+    create_namespace: true
+    values:
+      config:
+        issuer: https://dex.eom.dev/
+        staticClients:
+          - id: "{{ matrix_dex_oidc_client_id }}"
+            name: Matrix Auth Service
+            secret: "{{ matrix_dex_oidc_client_secret }}"
+            redirectURIs:
+              - "https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4"
+        storage:
+          type: postgres
+          config:
+            host: postgresql
+            port: 5432
+            databbase: dex
+            user: dex
+            password: "{{ dex_admin_password }}"
+            ssl:
+              mode: disable
+        connectors:
+          - type: ldap
+            id: ldap
+            name: LDAP
+            config:
+              host: openldap.openldap.svc.cluster.local
+              insecureNoSSL: true
+              bindDN: cn=readonly,dc=eom,dc=dev
+              bindPW: "{{ openldap_readonly_password }}"
+              userSearch:
+                baseDN: dc=eom,dc=dev
+                filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
+                username: uid
+                idAttr: uid
+                emailAttr: mail
+                nameAttr: givenName
+                preferredUsernameAttr: uid
+              groupSearch:
+                baseDN: dc=eom,dc=dev
+                filter: "(objectClass=groupOfUniqueNames)"
+                userMatchers:
+                - userAttr: cn
+                  groupAttr: uniqueMember
+                nameAttr: cn
+      ingress:
+        enabled: true
+        className: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        hosts:
+          - host: dex.eom.dev
+            paths:
+              - path: /
+                pathType: ImplementationSpecific
+        tls:
+          - hosts:
+              - dex.eom.dev
+            secretName: dex

tasks/discourse.yaml

@@ -21,7 +21,11 @@
         user: "discourse"
         password: "{{ discourse_admin_password }}"
       image:
-        debug: true
+        debug: false
+        repository: bitnamilegacy/discourse
+        tag: 3.4.7-debian-12-r0
+      service:
+        externalTrafficPolicy: Local
       discourse:
         skipInstall: false
         plugins:
@@ -30,6 +34,10 @@
           - https://github.com/discourse/discourse-activity-pub
           - https://github.com/discourse/discourse-openid-connect
           - https://github.com/jonmbake/discourse-ldap-auth
+          - https://github.com/discourse/discourse-math
+          - https://github.com/discourse/discourse-post-voting
+          - https://github.com/discourse/discourse-prometheus
+          - https://github.com/discourse/discourse-reactions
         command:
           - /bin/bash
         args:
@@ -53,6 +61,8 @@
         tls: true
       postgresql:
         enabled: true
+        image:
+          repository: bitnamilegacy/postgresql
         auth:
           enablePostgresUser: true
           postgresPassword: "{{ discourse_admin_password }}"
@@ -62,5 +72,7 @@
             size: 2Ti
       redis:
         enabled: true
+        image:
+          repository: bitnamilegacy/redis
         auth:
           password: "{{ discourse_admin_password }}"

tasks/gitea.yaml

@@ -79,9 +79,9 @@
           APP_NAME: "Gitea"
           service:
             DISABLE_REGISTRATION: false
-            SHOW_REGISTRATION_BUTTON: false
+            SHOW_REGISTRATION_BUTTON: true
             DEFAULT_ALLOW_CREATE_ORGANIZATION: false
-            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+            ALLOW_ONLY_EXTERNAL_REGISTRATION: false
           oauth2_client:
             ENABLE_AUTO_REGISTRATION: true
             UPDATE_AVATAR: true

tasks/grafana-matrix-forwarder.yaml

@@ -1,5 +1,14 @@
 ---
 # tasks file for grafana-matrix-forwarder
+- name: Create Grafana Matrix Forwarder namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: grafana-matrix-forwarder
+
 - name: Create a Deployment for Grafana Matrix Forwarder
   k8s:
     definition:
@@ -7,7 +16,7 @@
       kind: Deployment
       metadata:
         name: matrix-forwarder
-        namespace: grafana
+        namespace: grafana-matrix-forwarder
       spec:
         replicas: 1
         selector:
@@ -40,7 +49,7 @@
       kind: Service
       metadata:
         name: matrix-forwarder
-        namespace: grafana
+        namespace: grafana-matrix-forwarder
       spec:
         selector:
           app: matrix-forwarder

tasks/lemmy.yaml

@@ -0,0 +1,131 @@
+---
+# tasks file for lemmy
+- name: Create lemmy namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: lemmy
+
+- name: Create a persistent volume claim for lemmy
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: config
+        namespace: lemmy
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Ti
+
+- name: Create a persistent volume claim for lemmy
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: lemmy
+        namespace: lemmy
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Ti
+
+- name: Create a deployment for lemmy
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: lemmy
+        namespace: lemmy
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: lemmy
+        template:
+          metadata:
+            labels:
+              app: lemmy
+          spec:
+            containers:
+              - name: lemmy
+                image: dessalines/lemmy:0.19.11
+                volumeMounts:
+                  - name: config
+                    mountPath: /tmp/docker-lemmyserver
+                  - name: ssl
+                    mountPath: /etc/letsencrypt
+                  - name: lemmy
+                    mountPath: /var/lemmy
+                ports:
+                  - containerPort: 25
+                env:
+                  - name: OVERRIDE_HOSTNAME
+                    value: "postfix.eom.dev"
+            volumes:
+              - name: lemmy
+                persistentVolumeClaim:
+                  claimName: lemmy
+
+- name: Create a deployment for lemmy-ui
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: lemmy-ui
+        namespace: lemmy
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: lemmy-ui
+        template:
+          metadata:
+            labels:
+              app: lemmy-ui
+          spec:
+            containers:
+              - name: lemmy-ui
+                image: dessalines/lemmy-ui:0.19.11
+                volumeMounts:
+                  - name: lemmy
+                    mountPath: /var/lemmy
+                ports:
+                  - containerPort: 25
+                env:
+                  - name: OVERRIDE_HOSTNAME
+                    value: "postfix.eom.dev"
+            volumes:
+              - name: lemmy
+                persistentVolumeClaim:
+                  claimName: lemmy
+
+- name: Expose deployment as a service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: lemmy
+        namespace: lemmy
+      spec:
+        selector:
+          app: lemmy
+        ports:
+          - port: 25
+            name: smtp-a
+        type: LoadBalancer
+        externalTrafficPolicy: Local

tasks/localai.yaml

@@ -0,0 +1,61 @@
+---
+# tasks file for localai
+- name: Add skynet repo
+  kubernetes.core.helm_repository:
+    name: go-skynet
+    repo_url: https://go-skynet.github.io/helm-charts/
+  register: repo_update
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo_update.changed
+
+- name: Deploy LocalAI
+  kubernetes.core.helm:
+    name: localai
+    chart_ref: go-skynet/local-ai
+    release_namespace: localai
+    create_namespace: true
+    values:
+      deployment:
+        image:
+          tag: latest-gpu-nvidia-cuda-12
+        runtimeClassName: nvidia
+        secretEnv:
+          - name: LOCALAI_DISABLE_WEBUI
+            value: "true"
+          - name: LOCALAI_API_KEY
+            value: "{{ localai_api_keys | join(',') }}"
+          - name: LOCALAI_WATCHDOG_IDLE
+            value: "true"
+          - name: LOCALAI_WATCHDOG_IDLE_TIMEOUT
+            value: "5m"
+          - name: LOCALAI_WATCHDOG_BUSY
+            value: "true"
+      resources:
+        limits:
+          nvidia.com/gpu: 1
+      persistence:
+        models:
+          size: 256Gi
+        output:
+          size: 128Gi
+      tolerations:
+        - key: specialResources
+          operator: Equal
+          value: GPU
+          effect: NoSchedule
+      ingress:
+        enabled: true
+        className: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        hosts:
+          - host: localai.eom.dev
+            paths:
+              - path: /
+                pathType: ImplementationSpecific
+        tls:
+          - secretName: localai-tls
+            hosts:
+              - localai.eom.dev

tasks/luanti.yaml

@@ -0,0 +1,20 @@
+---
+# tasks file for luanti
+- name: Deploy Luanti
+  kubernetes.core.helm:
+    name: luanti
+    chart_ref: oci://tccr.io/truecharts/minetest
+    release_namespace: luanti
+    create_namespace: true
+    values:
+      service:
+        main:
+          type: LoadBalancer
+          externalTrafficPolicy: Local
+      workload:
+        main:
+          podSpec:
+            containers:
+              main:
+                env:
+                  CLI_ARGS: --gameid minetest_game

tasks/mail.yaml

@@ -42,6 +42,38 @@
           name: ca-issuer
           kind: ClusterIssuer
 
+- name: Create a persistent volume claim for mail
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: dkim
+        namespace: mail
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 512Mi
+
+- name: Create a persistent volume claim for mail
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: config
+        namespace: mail
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Gi
+
 - name: Create a persistent volume claim for mail
   k8s:
     state: present
@@ -58,6 +90,38 @@
           requests:
             storage: 2Ti
 
+- name: Create a ConfigMap for encryption
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: certs
+        namespace: mail
+      data:
+        privkey.pem: "{{ mail_encryption_privkey }}"
+        pubkey.pem: "{{ mail_encryption_pubkey }}"
+
+- name: Create a ConfigMap for Dovecot
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: dovecot
+        namespace: mail
+      data:
+        10-encryption.conf: |
+          # Enables mail_crypt for all services (pop3, pop3, etc)
+          mail_plugins = $mail_plugins mail_crypt
+          plugin {
+            mail_crypt_global_private_key = </certs/privkey.pem
+            mail_crypt_global_public_key = </certs/pubkey.pem
+            mail_crypt_save_version = 2
+          }
+
 - name: Create a deployment
   k8s:
     definition:
@@ -79,11 +143,49 @@
             containers:
               - name: mail
                 image: mailserver/docker-mailserver
+                securityContext:
+                  # `allowPrivilegeEscalation: true` is required to support SGID via the `postdrop`
+                  # executable in `/var/mail-state` for Postfix (maildrop + public dirs):
+                  # https://github.com/docker-mailserver/docker-mailserver/pull/3625
+                  allowPrivilegeEscalation: true
+                  readOnlyRootFilesystem: false
+                  runAsUser: 0
+                  runAsGroup: 0
+                  runAsNonRoot: false
+                  privileged: false
+                  capabilities:
+                    add:
+                      # file permission capabilities
+                      - CHOWN
+                      - FOWNER
+                      - MKNOD
+                      - SETGID
+                      - SETUID
+                      - DAC_OVERRIDE
+                      # network capabilities
+                      - NET_ADMIN  # needed for F2B
+                      - NET_RAW    # needed for F2B
+                      - NET_BIND_SERVICE
+                      # miscellaneous  capabilities
+                      - SYS_CHROOT
+                      - KILL
+                    drop: [ALL]
+                  seccompProfile:
+                    type: RuntimeDefault
                 volumeMounts:
+                  - name: certs
+                    mountPath: /certs
+                  - name: config
+                    mountPath: /tmp/docker-mailserver
+                  - name: dovecot
+                    mountPath: /etc/dovecot/conf.d/10-encryption.conf
+                    subPath: 10-encryption.conf
                   - name: ssl
                     mountPath: /etc/letsencrypt
                   - name: mail
                     mountPath: /var/mail
+                  - name: dkim
+                    mountPath: /tmp/docker-mailserver/opendkim
                 ports:
                   - containerPort: 25
                   - containerPort: 465
@@ -142,12 +244,24 @@
                   - name: SSL_KEY_PATH
                     value: "/etc/letsencrypt/tls.key"
             volumes:
+              - name: certs
+                configMap:
+                  name: certs
               - name: ssl
                 secret:
                   secretName: mail
+              - name: config
+                persistentVolumeClaim:
+                  claimName: config
               - name: mail
                 persistentVolumeClaim:
                   claimName: mail
+              - name: dkim
+                persistentVolumeClaim:
+                  claimName: dkim
+              - name: dovecot
+                configMap:
+                  name: dovecot
 
 - name: Expose deployment as a service
   k8s:
@@ -172,3 +286,4 @@
           - port: 995
             name: pop3
         type: LoadBalancer
+        externalTrafficPolicy: Local

tasks/mastodon.yaml

@@ -40,6 +40,15 @@
         LDAP_UID: uid
         LDAP_SEARCH_FILTER: (&(objectClass=posixAccount)(|(%{uid}=%{email})(%{mail}=%{email}))(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))
         LDAP_MAIL: mail
+        OIDC_ENABLED: "true"
+        OIDC_DISPLAY_NAME: Google
+        OIDC_ISSUER: https://accounts.google.com
+        OIDC_DISCOVERY: "true"
+        OIDC_SCOPE: openid,profile,email
+        OIDC_UID_FIELD:
+        OIDC_CLIENT_ID: "{{ mastodon_google_oidc_client_id }}"
+        OIDC_CLIENT_SECRET: "{{ mastodon_google_oidc_client_secret }}"
+        OIDC_REDIRECT_URI: https://mastodon.eom.dev/auth/auth/openid_connect/callback
       localDomain: mastodon.eom.dev
       smtp:
         server: postfix.eom.dev
@@ -54,7 +63,7 @@
         password: "{{ mastodon_admin_password }}"
       persistence:
         enabled: true
-        size: 64Gi
+        size: 2Ti
       redis:
         enabled: true
         auth:
@@ -70,7 +79,7 @@
             enabled: true
             size: 2Ti
       elasticsearch:
-        enabled: true
+        enabled: false
         master:
           persistence:
             size: 64Gi
@@ -79,11 +88,6 @@
             size: 512Gi
       minio:
         enabled: false
-      externalS3:
-        host: minio.eom.dev
-        accessKeyId: mastodon
-        accessKeySecret: "{{ mastodon_admin_password }}"
-        bucket: mastodon
       apache:
         service:
           type: ClusterIP 

tasks/matrix-auth-service.yaml

@@ -0,0 +1,141 @@
+---
+# tasks file for synapse
+- name: Add Small Hack repo
+  kubernetes.core.helm_repository:
+    name: small-hack-matrix-auth-service
+    repo_url: https://small-hack.github.io/matrix-authentication-service-chart
+  register: repo
+
+- name: Update Helm repos
+  command: helm repo update
+  when: repo.changed
+
+- name: Deploy Matrix Auth Service
+  kubernetes.core.helm:
+    name: matrix-auth-service
+    chart_ref: small-hack-matrix-auth-service/matrix-authentication-service
+    release_namespace: matrix-auth-service
+    create_namespace: true
+    values:
+      fullnameOverride: mas
+      image:
+        pullPolicy: IfNotPresent
+        tag: latest
+      http:
+        public_base: https://matrix-auth-service.eom.dev/
+      ingress:
+        className: nginx
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        hosts:
+          - host: matrix-auth-service.eom.dev
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - secretName: mas-tls
+            hosts:
+              - matrix-auth-service.eom.dev
+      postgresql:
+        enabled: true
+        global:
+          auth:
+            password: "{{ matrix_auth_service_admin_password }}"
+      mas:
+        http:
+          public_base: https://matrix-auth-service.eom.dev/
+        policy:
+          client_registration:
+            allow_host_mismatch: false
+            allow_insecure_uris: false
+        clients:
+          - client_id: 0000000000000000000SYNAPSE
+            client_auth_method: client_secret_basic
+            client_secret: 5ZrwKXmKdiQfus2J
+        matrix:
+          homeserver: synapse.eom.dev
+          endpoint: https://synapse.eom.dev
+          secret: SacP5rWpci6GMqb2
+        email:
+          from: Matrix Auth Service <matrix-auth-service@eom.dev>
+          reply_to: Matrix Auth Service <matrix-auth-service@eom.dev>
+          transport: smtp
+          mode: tls
+          hostname: postfix.eom.dev
+          port: 587
+          username: matrix-auth-service
+          password: "{{ matrix_auth_service_admin_password }}"
+        upstream_oauth2:
+          providers:
+            - id: 01JG22H4F0G8PYCZ5HVTQVHBC4
+              issuer: https://google.com/
+              human_name: Google
+              brand_name: google
+              pkce_method: auto
+              client_id: "{{ matrix_google_oidc_client_id }}"
+              client_secret: "{{ matrix_google_oidc_client_secret }}"
+              token_endpoint_auth_method: client_secret_basic
+              scope: "openid email profile"
+              discovery_mode: oidc
+              claims_imports:
+                subject:
+                  template: "{{ '{{ user.sub }}' | quote }}"
+
+                # -- The localpart is the local part of the user's Matrix ID.
+                # For example, on the `example.com` server, if the localpart is `alice`,
+                #  the user's Matrix ID will be `@alice:example.com`.
+                localpart:
+                  action: require
+                  template: "{{ '{{ user.preferred_username }}' | quote }}"
+
+                # -- The display name is the user's display name.
+                displayname:
+                  action: suggest
+                  template: "{{ '{{ user.name }}' | quote }}"
+
+                # -- An email address to import.
+                email:
+                  action: suggest
+                  template: "{{ '{{ user.email }}' | quote }}"
+                  # -- Whether the email address must be marked as verified.
+                  # Possible values are:
+                  #  - `import`: mark the email address as verified if the upstream provider
+                  #     has marked it as verified, using the `email_verified` claim.
+                  #     This is the default.
+                  #   - `always`: mark the email address as verified
+                  #   - `never`: mark the email address as not verified
+                  set_email_verification: import
+#            - id: 01JG2B7DBS6RQRH1TFVZ4BP7H8
+#              issuer: https://github.com/
+#              client_id: "{{ matrix_github_oidc_client_id }}"
+#              client_secret: "{{ matrix_github_oidc_client_secret }}"
+#              token_endpoint_auth_method: client_secret_basic
+#              discovery_mode: oidc
+#              claims_imports:
+#                subject:
+#                  template: "{{ '{{ user.sub }}' | quote }}"
+#
+#                # -- The localpart is the local part of the user's Matrix ID.
+#                # For example, on the `example.com` server, if the localpart is `alice`,
+#                #  the user's Matrix ID will be `@alice:example.com`.
+#                localpart:
+#                  action: require
+#                  template: "{{ '{{ user.preferred_username }}' | quote }}"
+#
+#                # -- The display name is the user's display name.
+#                displayname:
+#                  action: suggest
+#                  template: "{{ '{{ user.name }}' | quote }}"
+#
+#                # -- An email address to import.
+#                email:
+#                  action: suggest
+#                  template: "{{ '{{ user.email }}' | quote }}"
+#                  # -- Whether the email address must be marked as verified.
+#                  # Possible values are:
+#                  #  - `import`: mark the email address as verified if the upstream provider
+#                  #     has marked it as verified, using the `email_verified` claim.
+#                  #     This is the default.
+#                  #   - `always`: mark the email address as verified
+#                  #   - `never`: mark the email address as not verified
+#                  set_email_verification: import

tasks/matrix.yaml

@@ -36,7 +36,7 @@
               enabled: true
             host: eom.dev
         oidc:
-          enabled: false
+          enabled: true
           providers:
             - idp_id: github
               idp_name: Github
@@ -103,12 +103,12 @@
 #          msc3861:
 #            enabled: true
 #            # Synapse will call `{issuer}/.well-known/openid-configuration` to get the OIDC configuration
-#            issuer: http://localhost:8080/
+#            issuer: https://matrix-auth-service.eom.dev/
 #            client_id: 0000000000000000000SYNAPSE
 #            client_auth_method: client_secret_basic
 #            client_secret: 5ZrwKXmKdiQfus2J
 #            admin_token: SacP5rWpci6GMqb2
-#            account_management_url: "https://matrix-auth-service.eom.dev/"
+#            account_management_url: "https://matrix-auth-service.eom.dev/account"
       volumes:
         media:
           capacity: 2Ti
@@ -155,32 +155,88 @@
             cert-manager.io/cluster-issuer: ca-issuer
       coturn:
         enabled: false
+        external: true
+        uris:
+          - turns:coturn.eom.dev?transport=udp
+          - turns:coturn.eom.dev?transport=tcp
+        allowGuests: false
+        sharedSecret: "{{ coturn_shared_secret }}"
+        service:
+          type: LoadBalancer
+          externalTrafficPolicy: Local
         certificate:
           enabled: true
           host: coturn.eom.dev
-          issuer: ca-issuer
+          issuerName: ca-issuer
-        uris:
-          - turn:coturn.eom.dev?transport=udp
-        allowGuests: true
-        service:
-          type: NodePort
         image:
           tag: latest
-          pullPolicy: IfNotPresent
+          pullPolicy: Always
         externalDatabase:
           enabled: true
-          hostname: matrix-postgresql
-          username: matrix
-          password: "{{ matrix_admin_password }}"
-          database: coturn
         postgresql:
-          enabled: false
+          enabled: true
-          nameOverride: matrix-coturn-postgresql
           global:
             postgresql:
               auth:
                 password: "{{ coturn_admin_password }}"
           primary:
+            initdb:
+              scripts:
+                schema.sql: |
+                  CREATE TABLE turnusers_lt (
+                      realm varchar(127) default '',
+                      name varchar(512),
+                      hmackey char(128),
+                      PRIMARY KEY (realm,name)
+                  );
+
+                  CREATE TABLE turn_secret (
+                      realm varchar(127) default '',
+                      value varchar(256),
+                      primary key (realm,value)
+                  );
+
+                  CREATE TABLE allowed_peer_ip (
+                      realm varchar(127) default '',
+                      ip_range varchar(256),
+                      primary key (realm,ip_range)
+                  );
+
+                  CREATE TABLE denied_peer_ip (
+                      realm varchar(127) default '',
+                      ip_range varchar(256),
+                      primary key (realm,ip_range)
+                  );
+
+                  CREATE TABLE turn_origin_to_realm (
+                      origin varchar(127),
+                      realm varchar(127),
+                      primary key (origin)
+                  );
+
+                  CREATE TABLE turn_realm_option (
+                      realm varchar(127) default '',
+                      opt varchar(32),
+                      value varchar(128),
+                      primary key (realm,opt)
+                  );
+
+                  CREATE TABLE oauth_key (
+                      kid varchar(128),
+                      ikm_key varchar(256),
+                      timestamp bigint default 0,
+                      lifetime integer default 0,
+                      as_rs_alg varchar(64) default '',
+                      realm varchar(127),
+                      primary key (kid)
+                  );
+
+                  CREATE TABLE admin_user (
+                      name varchar(32),
+                      realm varchar(127),
+                      password varchar(127),
+                      primary key (name)
+                  );
             persistence:
               size: 256Gi
         coturn:
@@ -215,23 +271,22 @@
             - host: matrix-auth-service.eom.dev
               paths:
                 - path: /
-                  pathType: ImplementationSpecific
+                  pathType: Prefix
           tls:
             - secretName: mas-tls
               hosts:
                 - matrix-auth-service.eom.dev
         postgresql:
-          enabled: false
+          enabled: true
           global:
             auth:
               password: "{{ matrix_auth_service_admin_password }}"
         mas:
-          enabled: false
           http:
             public_base: https://matrix-auth-service.eom.dev/
           policy:
             client_registration:
-              allow_host_mismatch: true
+              allow_host_mismatch: false
               allow_insecure_uris: false
           clients:
             - client_id: 0000000000000000000SYNAPSE
@@ -243,7 +298,7 @@
             secret: SacP5rWpci6GMqb2
           email:
             from: Matrix Auth Service <matrix-auth-service@eom.dev>
-            reply_to: No reply <no-reply@eom.dev>
+            reply_to: Matrix Auth Service <matrix-auth-service@eom.dev>
             transport: smtp
             mode: tls
             hostname: postfix.eom.dev

tasks/minio.yaml

@@ -7,15 +7,19 @@
     release_namespace: minio
     create_namespace: true
     values:
+      image:
+        repository: bitnamilegacy/minio
       metrics:
         enabled: true
-      disableWebUI: true
+      console:
+        enabled: false
       auth:
         rootUser: minio_admin
         rootPassword: "{{ minio_admin_password }}"
       defaultBuckets: default
-      volumePermissions:
+      defaultInitContainers:
-        enabled: true
+        volumePermissions:
+          enabled: true
       mode: standalone
       persistence:
         size: 8Ti
@@ -46,13 +50,10 @@
           value: OpenLDAP
         - name: MINIO_IDENTITY_LDAP_SERVER_INSECURE
           value: "on"
-      apiIngress:
+      ingress:
         enabled: true
         hostname: minio.eom.dev
         ingressClassName: nginx
         annotations:
           cert-manager.io/cluster-issuer: ca-issuer
-        tls:
+        tls: true
-          - hosts:
-            - minio.eom.dev
-            secretName: minio-tls

tasks/misskey.yaml

@@ -0,0 +1,16 @@
+---
+# tasks file for misskey
+- name: Deploy Misskey
+  kubernetes.core.helm:
+    name: misskey
+    chart_ref: oci://tccr.io/truecharts/misskey
+    release_namespace: misskey
+    create_namespace: true
+    values:
+      service:
+        main:
+          ports:
+            main:
+              port: 3003
+      misskey:
+        url: "https://misskey.eom.dev/"

tasks/nextcloud.yaml

@@ -19,7 +19,10 @@
     values:
       image:
         pullPolicy: IfNotPresent
-        tag: latest
+      livenessProbe:
+        initialDelaySeconds: 300
+      readinessProbe:
+        initialDelaySeconds: 300
       nextcloud:
         host: nextcloud.eom.dev
         username: nextcloud_admin
@@ -54,6 +57,8 @@
       cronjob:
         enabled: true
       redis:
+        #global:
+            #defaultStorageClass: r720-nfs-client
         enabled: true
         auth:
           password: "{{ redis_auth_password }}"
@@ -106,6 +111,8 @@
         database: nextcloud
       postgresql:
         enabled: true
+        image:
+          tag: 16.6.0-debian-12-r2
         global:
           postgresql:
             auth:

tasks/obs-web.yaml

@@ -0,0 +1,51 @@
+---
+# tasks file for obs-web
+- name: Create namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: obs-web
+
+- name: Create a Deployment
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: obs-web
+        namespace: obs-web
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: obs-web
+        template:
+          metadata:
+            labels:
+              app: obs-web
+          spec:
+            containers:
+              - name: obs-web
+                image: ghcr.io/niek/obs-web
+                ports:
+                  - containerPort: 5000
+
+- name: Expose OBS-Web Deployment as a Service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: obs-web
+        namespace: obs-web
+      spec:
+        selector:
+          app: obs-web
+        ports:
+          - port: 80
+            targetPort: 5000
+            name: http
+        type: LoadBalancer

tasks/openldap.yaml

@@ -41,6 +41,36 @@
           requests:
             storage: 32Gi
 
+- name: Request a certificate for OpenLDAP
+  k8s:
+    state: present
+    definition:
+      apiVersion: cert-manager.io/v1
+      kind: Certificate
+      metadata:
+        name: openldap
+        namespace: openldap
+      spec:
+        secretName: openldap
+        privateKey:
+          algorithm: RSA
+          encoding: PKCS1
+          size: 2048
+        duration: 2160h # 90d
+        renewBefore: 360h # 15d
+        isCA: false
+        usages:
+          - server auth
+          - client auth
+        subject:
+          organizations:
+            - EOM
+        dnsNames:
+          - openldap.eom.dev
+        issuerRef:
+          name: ca-issuer
+          kind: ClusterIssuer
+
 - name: Create Deployment for OpenLDAP
   k8s:
     definition:
@@ -75,6 +105,10 @@
                     value: "{{ openldap_readonly_password }}"
                   - name: LDAP_TLS_VERIFY_CLIENT
                     value: never
+                  - name: LDAP_TLS_CRT_FILENAME
+                    value: tls.crt
+                  - name: LDAP_TLS_KEY_FILENAME
+                    value: tls.key
                 volumeMounts:
                   - name: config
                     mountPath: /etc/ldap/slapd.d

tasks/owncast.yaml

@@ -49,6 +49,9 @@
             containers:
               - name: owncast
                 image: owncast/owncast:0.2.0
+                resources:
+                  requests:
+                    cpu: 1.5
                 volumeMounts:
                   - name: data
                     mountPath: /app/data
@@ -78,6 +81,7 @@
             name: rtmp
           - port: 8080
             name: http
+        externalTrafficPolicy: Local
         type: LoadBalancer
 
 - name: Create Ingress

tasks/pleroma.yaml

@@ -0,0 +1,223 @@
+---
+# tasks file for pleroma
+- name: Create NextCloud namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: pleroma
+
+- name: Create PVC for PostgreSQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: postgresql
+        namespace: pleroma
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 2Ti
+
+- name: Create Deployment for PostgreSQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: postgresql
+        namespace: pleroma
+        labels:
+          app: postgresql
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: postgresql
+        template:
+          metadata:
+            labels:
+              app: postgresql
+          spec:
+            containers:
+              - name: postgresql
+                image: postgresql
+                volumeMounts:
+                  - name: data
+                    mountPath: /var/lib/postgresql/data
+                ports:
+                  - containerPort: 5432
+                env:
+                  - name: MYSQL_ROOT_PASSWORD
+                    value: "{{ mysql_root_password }}"
+                  - name: MYSQL_DATABASE
+                    value: nextcloud
+                  - name: MYSQL_USER
+                    value: nextcloud
+                  - name: MYSQL_PASSWORD
+                    value: "{{ nextcloud_mysql_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: postgresql
+
+- name: Create Service for PostgreSQL
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: postgresql
+        namespace: cloud
+      spec:
+        selector:
+          app: postgresql
+        ports:
+          - port: 3306
+            name: mysql
+        type: ClusterIP
+
+- name: Create PVC for Pleroma
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: pleroma
+        namespace: pleroma
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 128Gi
+
+- name: Create Deployment for Pleroma
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: pleroma
+        namespace: pleroma
+        labels:
+          app: pleroma
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: pleroma
+        template:
+          metadata:
+            labels:
+              app: pleroma
+          spec:
+            containers:
+              - name: pleroma
+                image: pleroma
+                volumeMounts:
+                  - name: data
+                    mountPath: /data/uploads
+                ports:
+                  - containerPort: 4000
+                env:
+                  - name: POSTGRES_PASSWORD
+                    value: "{{ pleroma_admin_password }}"
+                  - name: POSTGRES_USER
+                    value: pleroma
+                  - name: POSTGRES_DB
+                    value: pleroma
+                  - name: ADMIN_EMAIL
+                    value: pleroma@eom.dev
+                  - name: ADMIN_PASSWORD
+                    value: "{{ pleroma_admin_password }}"
+                  - name: DB_HOST
+                    value: postgresql
+                  - name: DB_PORT
+                    value: 5432
+                  - name: DB_USER
+                    value: pleroma
+                  - name: DB_PASS
+                    value: "{{ pleroma_admin_password }}"
+                  - name: DB_NAME
+                    value: pleroma
+                  - name: INSTANCE_NAME
+                    value: Pleroma
+                  - name: DOMAIN
+                    value: pleroma.eom.dev
+                  - name: LDAP_ENABLED
+                    value: true
+                  - name: LDAP_HOST
+                    value: openldap.openldap.svc.cluster.local
+                  - name: LDAP_PORT
+                    value: 389
+                  - name: LDAP_SSL
+                    value: false
+                  - name: LDAP_TLS
+                    value: false
+                  - name: LDAP_BASE
+                    value: dc=eom,dc=dev
+                  - name: LDAP_UID
+                    value: uid
+                  - name: LDAP_MAIL
+                    value: mail
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: pleroma
+
+- name: Create Service for Pleroma
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: pleroma
+        namespace: pleroma
+      spec:
+        selector:
+          app: pleroma
+        ports:
+          - port: 80
+            name: http
+        type: ClusterIP
+
+- name: Create Ingress
+  k8s:
+    state: present
+    definition:
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        annotations:
+          cert-manager.io/cluster-issuer: ca-issuer
+        name: pleroma
+        namespace: pleroma
+      spec:
+        ingressClassName: nginx
+        rules:
+          - host: pleroma.eom.dev
+            http:
+              paths:
+                - pathType: Prefix
+                  path: /
+                  backend:
+                    service:
+                      name: pleroma
+                      port:
+                        number: 4000
+        tls:
+          - hosts:
+            - pleroma.eom.dev
+            secretName: pleroma

tasks/prometheus.yaml

@@ -13,6 +13,10 @@
         extraScrapeConfigs:
           - job_name: apps
             static_configs:
+              - targets:
+                - discourse.eom.dev
+                labels:
+                  instance: discourse
               - targets:
                 - gitea.eom.dev
                 labels:
@@ -21,19 +25,31 @@
                 - grafana.eom.dev
                 labels:
                   instance: grafana
+            metrics_path: /metrics
+
+          - job_name: owncast
+            scrape_interval: 1m
+            metrics_path: /api/admin/prometheus
+            scheme: https
+            basic_auth:
+              username: admin
+              password: "{{ owncast_admin_password }}"
+            static_config:
               - targets:
-                - jupyterhub.eom.dev
+                - owncast.eom.dev
-                labels:
+
-                  instance: jupyterhub
+          - job_name: local
+            static_configs:
               - targets:
-                - mastodon.eom.dev
+                - nextcloud-metrics.nextcloud.svc.cluster.local:9205
-                labels:
-                  instance: mastodon
-              - targets:
-                - nextcloud-metrics.nextcloud.svc.cluster.local
                 labels:
                   instance: nextcloud
-            metrics_path: /metrics
+              - targets:
+                - matrix-synapse.matrix.svc.cluster.local:9092
+                labels:
+                  instance: matrix
+            metrics_path: /
+
           - job_name: libvirt_exporter
             static_configs:
               - targets:
@@ -41,6 +57,7 @@
                 labels:
                   instance: poweredge-t640
             metrics_path: /metrics
+
           - job_name: node_exporter
             static_configs:
               - targets:
@@ -60,7 +77,7 @@
                 labels:
                   instance: alpha-worker-0
               - targets:
-                - 192.168.1.71:9100
+                - 192.168.1.70:9100
                 labels:
                   instance: alpha-worker-1
               - targets:
@@ -72,7 +89,7 @@
                 labels:
                   instance: alpha-worker-3
               - targets:
-                - 192.168.1.60:9100
+                - 192.168.1.61:9100
                 labels:
                   instance: alpha-worker-4
               - targets:
@@ -100,11 +117,31 @@
                 labels:
                   instance: alpha-worker-10
               - targets:
-                - 192.168.1.68:9100
+                - 192.168.1.65:9100
                 labels:
                   instance: alpha-worker-11
               - targets:
                 - 192.168.1.72:9100
                 labels:
                   instance: alpha-worker-12
+              - targets:
+                - 192.168.1.95:9100
+                labels:
+                  instance: alpha-worker-13
+              - targets:
+                - 192.168.1.70:9100
+                labels:
+                  instance: alpha-worker-14
+              - targets:
+                - 192.168.1.46:9100
+                labels:
+                  instance: alpha-worker-15
+              - targets:
+                - 192.168.1.74:9100
+                labels:
+                  instance: alpha-worker-16
+              - targets:
+                - 192.168.1.88:9100
+                labels:
+                  instance: alpha-worker-17
             metrics_path: /metrics

tasks/sogo.yaml

@@ -1,82 +0,0 @@
----
-# tasks file for SOGo
-- name: Create SOGo namespace
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: Namespace
-      metadata:
-        name: sogo
-
-- name: Create a deployment
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: sogo
-        namespace: sogo
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: sogo
-        template:
-          metadata:
-            labels:
-              app: sogo
-          spec:
-            containers:
-              - name: sogo
-                image: mailcow/sogo
-                volumeMounts:
-                  - name: mail
-                    mountPath: /var/mail
-                ports:
-                  - containerPort: 80
-                env:
-                  - name: OVERRIDE_HOSTNAME
-                    value: "postfix.eom.dev"
-                  - name: POSTMASTER_ADDRESS
-                    value: "postfix@eom.dev"
-                  - name: ACCOUNT_PROVISIONER
-                    value: "LDAP"
-                  - name: LDAP_SERVER_HOST
-                    value: "ldap://openldap.openldap.svc.cluster.local/"
-                  - name: LDAP_SEARCH_BASE
-                    value: "dc=eom,dc=dev"
-                  - name: LDAP_BIND_DN
-                    value: "cn=readonly,dc=eom,dc=dev"
-                  - name: LDAP_BIND_PW
-                    value: "{{ openldap_readonly_password }}"
-                  - name: LDAP_QUERY_FILTER_DOMAIN
-                    value: "(mail=*@%s)"
-                  - name: LDAP_QUERY_FILTER_USER
-                    value: "(&(mail=%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
-                  - name: LDAP_QUERY_FILTER_ALIAS
-                    value: "(&(objectClass=posixAccount)(mailAlias=%s))"
-                  - name: LDAP_QUERY_FILTER_GROUP
-                    value: "(&(objectClass=posixAccount)(mailGroupMember=%s))"
-                  - name: LDAP_QUERY_FILTER_SENDERS
-                    value: "(&(objectClass=posixAccount)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))"
-            volumes:
-              - name: mail
-                persistentVolumeClaim:
-                  claimName: mail
-
-- name: Expose deployment as a service
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: sogo 
-        namespace: sogo
-      spec:
-        selector:
-          app: sogo
-        ports:
-          - port: 80
-            name: http
-        type: LoadBalancer

tasks/tes3mp.yaml

@@ -0,0 +1,81 @@
+---
+# tasks file for mail
+- name: Create tes3mp namespace
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Namespace
+      metadata:
+        name: tes3mp
+
+- name: Create a persistent volume claim
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: config
+        namespace: tes3mp
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 16Gi
+
+- name: Create a deployment
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Deployment
+      metadata:
+        name: tes3mp
+        namespace: tes3mp
+      spec:
+        replicas: 1
+        selector:
+          matchLabels:
+            app: tes3mp
+        template:
+          metadata:
+            labels:
+              app: tes3mp
+          spec:
+            containers:
+              - name: tes3mp
+                image: tes3mp/server
+                volumeMounts:
+                  - name: data
+                    mountPath: /server/data
+                ports:
+                  - containerPort: 25565
+                env:
+                  - name: TES3MP_SERVER_GENERAL_HOSTNAME
+                    value: tes3.eom.dev
+                  - name: TES3MP_SERVER_GENERAL_PASSWORD
+                    value: "{{ tes3mp_password }}"
+            volumes:
+              - name: data
+                persistentVolumeClaim:
+                  claimName: data
+
+- name: Expose deployment as a service
+  k8s:
+    definition:
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: tes3mp
+        namespace: tes3mp
+      spec:
+        selector:
+          app: tes3mp
+        ports:
+          - port: 25566
+            targetPort: 25565
+            name: tes3mp
+            protocol: UDP
+        type: LoadBalancer
+        externalTrafficPolicy: Local