Closes #44

tasks/gitea.yaml

@@ -79,9 +79,9 @@
           APP_NAME: "Gitea"
           service:
             DISABLE_REGISTRATION: false
-            SHOW_REGISTRATION_BUTTON: false
+            SHOW_REGISTRATION_BUTTON: true
             DEFAULT_ALLOW_CREATE_ORGANIZATION: false
-            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+            ALLOW_ONLY_EXTERNAL_REGISTRATION: false
           oauth2_client:
             ENABLE_AUTO_REGISTRATION: true
             UPDATE_AVATAR: true

tasks/mail.yaml

@@ -90,6 +90,38 @@
           requests:
             storage: 2Ti
 
+- name: Create a ConfigMap for encryption
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: certs
+        namespace: mail
+      data:
+        privkey.pem: "{{ mail_encryption_privkey }}"
+        pubkey.pem: "{{ mail_encryption_pubkey }}"
+
+- name: Create a ConfigMap for Dovecot
+  k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: ConfigMap
+      metadata:
+        name: dovecot
+        namespace: mail
+      data:
+        10-encryption.conf: |
+          # Enables mail_crypt for all services (pop3, pop3, etc)
+          mail_plugins = $mail_plugins mail_crypt
+          plugin {
+            mail_crypt_global_private_key = </certs/privkey.pem
+            mail_crypt_global_public_key = </certs/pubkey.pem
+            mail_crypt_save_version = 2
+          }
+
 - name: Create a deployment
   k8s:
     definition:
@@ -141,8 +173,13 @@
                   seccompProfile:
                     type: RuntimeDefault
                 volumeMounts:
+                  - name: certs
+                    mountPath: /certs
                   - name: config
                     mountPath: /tmp/docker-mailserver
+                  - name: dovecot
+                    mountPath: /etc/dovecot/conf.d/10-encryption.conf
+                    subPath: 10-encryption.conf
                   - name: ssl
                     mountPath: /etc/letsencrypt
                   - name: mail
@@ -207,6 +244,9 @@
                   - name: SSL_KEY_PATH
                     value: "/etc/letsencrypt/tls.key"
             volumes:
+              - name: certs
+                configMap:
+                  name: certs
               - name: ssl
                 secret:
                   secretName: mail
@@ -219,6 +259,9 @@
               - name: dkim
                 persistentVolumeClaim:
                   claimName: dkim
+              - name: dovecot
+                configMap:
+                  name: dovecot
 
 - name: Expose deployment as a service
   k8s:

tasks/main.yaml

@@ -3,4 +3,4 @@
 - name: Deploy
   include_tasks: "{{ item }}"
   loop:
-    - localai.yaml
+    - gitea.yaml

tasks/minio.yaml

@@ -7,15 +7,19 @@
     release_namespace: minio
     create_namespace: true
     values:
+      image:
+        repository: bitnamilegacy/minio
       metrics:
         enabled: true
-      disableWebUI: true
+      console:
+        enabled: false
       auth:
         rootUser: minio_admin
         rootPassword: "{{ minio_admin_password }}"
       defaultBuckets: default
-      volumePermissions:
+      defaultInitContainers:
-        enabled: true
+        volumePermissions:
+          enabled: true
       mode: standalone
       persistence:
         size: 8Ti
@@ -46,13 +50,10 @@
           value: OpenLDAP
         - name: MINIO_IDENTITY_LDAP_SERVER_INSECURE
           value: "on"
-      apiIngress:
+      ingress:
         enabled: true
         hostname: minio.eom.dev
         ingressClassName: nginx
         annotations:
           cert-manager.io/cluster-issuer: ca-issuer
-        tls:
+        tls: true
-          - hosts:
-            - minio.eom.dev
-            secretName: minio-tls

tasks/prometheus.yaml

@@ -27,7 +27,18 @@
                   instance: grafana
             metrics_path: /metrics
 
-          - job_name: nextcloud
+          - job_name: owncast
+            scrape_interval: 1m
+            metrics_path: /api/admin/prometheus
+            scheme: https
+            basic_auth:
+              username: admin
+              password: "{{ owncast_admin_password }}"
+            static_config:
+              - targets:
+                - owncast.eom.dev
+
+          - job_name: local
             static_configs:
               - targets:
                 - nextcloud-metrics.nextcloud.svc.cluster.local:9205
@@ -113,4 +124,24 @@
                 - 192.168.1.72:9100
                 labels:
                   instance: alpha-worker-12
+              - targets:
+                - 192.168.1.95:9100
+                labels:
+                  instance: alpha-worker-13
+              - targets:
+                - 192.168.1.70:9100
+                labels:
+                  instance: alpha-worker-14
+              - targets:
+                - 192.168.1.46:9100
+                labels:
+                  instance: alpha-worker-15
+              - targets:
+                - 192.168.1.74:9100
+                labels:
+                  instance: alpha-worker-16
+              - targets:
+                - 192.168.1.88:9100
+                labels:
+                  instance: alpha-worker-17
             metrics_path: /metrics