Misc

.gitignore

@@ -0,0 +1,4 @@
+.DS_Store
+**/.DS_Store
+._.DS_Store
+**/._.DS_Store

services/calibre-web/calibre-web-deployment.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -19,7 +20,12 @@ spec:
         io.kompose.service: calibre-web
     spec:
       containers:
-        - env:
+        - name: calibre-web
+          image: crocodilestick/calibre-web-automated:latest
+          envFrom:
+            - secretRef:
+                name: calibre-web-secret
+          env:
             - name: PUID
               value: "1000"
             - name: PGID
@@ -30,8 +36,10 @@ spec:
               value: linuxserver/mods:universal-calibre
             - name: NETWORK_SHARE_MODE
               value: "true"
-          image: crocodilestick/calibre-web-automated:latest
-          name: calibre-web
+            - name: OIDC_ENABLE
+              value: "true"
+            - name: OIDC_ISSUER
+              value: https://sso.mynest.love/realms/nest
           ports:
             - containerPort: 8083
               protocol: TCP
@@ -41,8 +49,6 @@ spec:
               name: calibre-web-config
             - mountPath: /calibre-library
               name: calibre-web-library
-            - mountPath: /cwa-book-ingest
-              name: calibre-ingest-folder
       restartPolicy: Always
       volumes:
         - name: calibre-web-config
@@ -53,7 +59,3 @@ spec:
           nfs:
             server: birdfeeder1.home.nest
             path: /yarr/media/books/calibre-library
-        - name: calibre-ingest-folder
-          nfs:
-            server: birdfeeder1.home.nest
-            path: /yarr/media/books/calibre-ingest

services/calibre-web/calibre-web-external-secrets.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: calibre-web-credentials
+  namespace: default
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: calibre-web-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: OIDC_CLIENT_ID
+    remoteRef:
+      key: oauth2-proxy/calibre-web
+      property: client-id
+  - secretKey: OIDC_CLIENT_SECRET
+    remoteRef:
+      key: oauth2-proxy/calibre-web
+      property: client-secret

services/flaresolverr/flaresolverr-deployment.yaml

@@ -32,6 +32,7 @@ spec:
               value: America/New_York
           image: ghcr.io/flaresolverr/flaresolverr:latest
           name: flaresolverr
+          imagePullPolicy: Always
           ports:
             - containerPort: 8191
               protocol: TCP

services/foundryvtt/foundry-vtt-external-secrets.yaml

@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: foundry-vtt-credentials
+  namespace: default
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: foundry-vtt-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: FOUNDRY_ADMIN_KEY
+    remoteRef:
+      key: foundry-vtt/config
+      property: admin_key
+  - secretKey: FOUNDRY_LICENSE_KEY
+    remoteRef:
+      key: foundry-vtt/config
+      property: license_key
+  - secretKey: FOUNDRY_PASSWORD
+    remoteRef:
+      key: foundry-vtt/config
+      property: password
+  - secretKey: FOUNDRY_USERNAME
+    remoteRef:
+      key: foundry-vtt/config
+      property: username

services/jellyfin/jellyfin-ingress.yaml

@@ -34,3 +34,13 @@ spec:
             name: jellyfin
             port:
               name: http-web
+  - host: jellyfin.k3s.home.nest
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: jellyfin
+            port:
+              name: http-web

services/keycloak/keycloak-deployment.yaml

@@ -1,4 +1,4 @@
-apiVersion: k8s.keycloak.org/v2alpha1
+apiVersion: k8s.keycloak.org/v2beta1
 kind: Keycloak
 metadata:
   name: keycloak
@@ -23,18 +23,11 @@ spec:
   hostname:
     hostname: sso.mynest.love
     strict: true
+  bootstrapAdmin:
+    user:
+      secret: keycloak-admin-login
   additionalOptions:
     - name: proxy-headers
       value: xforwarded
-    - name: hostname-strict-https
-      value: "true"
-    - name: bootstrap-admin-username
-      secret:
-        name: keycloak-admin-login
-        key: username
-    - name: bootstrap-admin-password
-      secret:
-        name: keycloak-admin-login
-        key: password
   ingress:
     enabled: false