Skip to content

Commit 0480522

Browse files
mebezacmebezac
committed
Add pcab
1 parent 04cec44 commit 0480522

File tree

7 files changed

+233
-2
lines changed

7 files changed

+233
-2
lines changed

‎kubernetes/apps/pcab/pcab/ghcr-secret.sops.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: ghcr-secret
5+
namespace: pcab
6+
type: kubernetes.io/dockerconfigjson
7+
stringData:
8+
.dockerconfigjson: ENC[AES256_GCM,data:NeAbtJM8Vo8EA73UzawmLnQDKPTeV5+o/YR+3D8Q93ksvH8wQ1Tgn9uw6nyV00jTMkwQlSoL0ZOKkA5vn2UEveJPcHCFnfFKVPGJtbAbNVved0VqhgBmyfxSZeq2wV8S/pud3G7+uzyfHEFumCx1JP0Xx0tIxNCQNOTQXgmSoFRXh/c/RstLiBRZPCfNLSVyXzFhd5+Yst6eP6vm1tv/hETDXTASQElcU5vmR6C6BuTPSn9VlTCP2AORS1IctJL/C5xliY92F+iTMyy9PPJ4a2lYa5VzFRMu,iv:NNWtlIvFmLdGzJUX5utYasauC/22cx6U3+tzs/uy0cU=,tag:zddO5qzNkyiir/PKLhpoww==,type:str]
9+
sops:
10+
age:
11+
- recipient: age1j7x3jkw82w02taqj8dmqplae07fxcrup2enejnta9z2v82fzsakqd4ka6p
12+
enc: |
13+
-----BEGIN AGE ENCRYPTED FILE-----
14+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjVkJZS1pCVFdlbVJBWlp5
15+
blVROHhXdXNOTHcxNkQ4Rzl6RldVZGVPeFJJCndYd3JoZmJDajdweTBtMklkMzA5
16+
TS9oMnNTYytXL2ozSTVLYjU1ZWZWQWcKLS0tIEJJMWV2cC9JRkhSRWF5dS8vaXlr
17+
a1EyZTN5dHdnalM2N0lyMWlhR0U0ZncKtPqvp/1Mm7NUfoeab8qVdjKO6mOxK3E3
18+
vAYzDocDtMHk2iZTZ3cJIoNgVmE6V2BEpk1vJ5TBLGfr9CPvV32GNw==
19+
-----END AGE ENCRYPTED FILE-----
20+
lastmodified: "2026-02-05T22:38:04Z"
21+
mac: ENC[AES256_GCM,data:CG5kfnnZp09CPCbmjnhBjjFjZSKYsVnjdVGLp+/vPkA6Yg86OzCTLMYIiZyTsU0w/fexV/vgry0+u0lx0imIShW3edsH7dD48+U8yEI7dSU37mericzPYWrt83mMJPoGCU7SQoMLoJkIpaGuh3taQrw5QypC4ERqeRLi/ieeyUU=,iv:I17V/AK9EsfrtKJqszrsgfXk1bRMN3ah1pe3g0m3IvQ=,tag:yk++SuUGzLWCEcW597TlGQ==,type:str]
22+
encrypted_regex: ^(data|stringData)$
23+
mac_only_encrypted: true
24+
version: 3.11.0

‎kubernetes/apps/pcab/pcab/kustomization.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
generators:
4+
- secret-generator.yaml

‎kubernetes/apps/pcab/pcab/pcab-secret.sops.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: pcab-secret
5+
namespace: pcab
6+
type: Opaque
7+
stringData:
8+
#ENC[AES256_GCM,data:rFbbYomKlow78Ye5XkcHHZWFdwUPm9qYXPCKEA==,iv:fOb9O5N7xzFcqgCRBR9O+E77P5VoxJZwaQc5iZcWJok=,tag:fJfM/5BnVZO9f0vNq+bTrQ==,type:comment]
9+
INIT_POSTGRES_DBNAME: ENC[AES256_GCM,data:ALjHkw==,iv:pCGPbfv5KRAv3ByF104SxxiZ5vbhoaoPxv699S0kdak=,tag:RB6KmHczRJgaE7ukvC7QNg==,type:str]
10+
INIT_POSTGRES_HOST: ENC[AES256_GCM,data:9W7lDl5uF8XelKFyBvudf92l/5+lwINz3PUoMXQltriXqyJzBm94fCvd5Ybnv8nc+w==,iv:VptgGe6DDixl90zlYQ8Enzo2mk6V8LHt56l/srl4vwE=,tag:Qh8PFV6rnCAbh8pqPazPRg==,type:str]
11+
INIT_POSTGRES_USER: ENC[AES256_GCM,data:vRtB7Q==,iv:iYCgyCnIuhO/Az68P/BknJqBLI5mgcdBB3CQ5gospQg=,tag:0sl84AUuOHTlo6P+vhCrtQ==,type:str]
12+
INIT_POSTGRES_PASS: ENC[AES256_GCM,data:4noDjs8LvAnonpcFaFSwv6fj9+J6O6n0zwv8Zg==,iv:WkcvOjx/MpgJeRqL9893dV4qV2Vv1Jm9vjRrJLnSUDw=,tag:A+fY8MQhwULgl9UgOF+ZRw==,type:str]
13+
INIT_POSTGRES_SUPER_PASS: ENC[AES256_GCM,data:EQInfptcIaBhEqEumceY6l4gohLUbZ2GJWA=,iv:RZfRMEhb+cFn0k3Qy8+gQziBIBQdjM5HQbmXKW2JwUo=,tag:P2hC3nAdJrzps2BYQ2qnKA==,type:str]
14+
#ENC[AES256_GCM,data:O+LwA8qT1nZlqxQicftZQWBUomxMwPrlExCj6PKipps0DyC1nqrCY/fZ4Zi7JhRvdGZ9eBGeNgLPSagkWas=,iv:6Fr3W7DWIy+do0hUXjjPMAShjEBcezoPij/bPAukZhM=,tag:ZKw2i/GBDV6sNhA0gZT4tg==,type:comment]
15+
SECRET_KEY_BASE: ENC[AES256_GCM,data:FQwc9ZeKv3NlN9zz4jeBRxwVpJ4o9gNRqTtdd+mdZ5cuRwXEbqVGgV0yCWRFdSCHDzVXicQnu9bDJx49uhZtrg==,iv:VXPhUdPlDgEWAiCDznyd+52y8XGLz86qLEdU45u9NQ8=,tag:OZCn0q9fy+sZOFbYbW6abQ==,type:str]
16+
#ENC[AES256_GCM,data:mpLUgpX/VS2Haj9BwDDJG5HFTlWGZHk=,iv:qub5hs3Y6llj2tSpOu/pyaGt2rEaugzYsbM//ZdtYCQ=,tag:z72/4DBrVs7V6z9fakBnSw==,type:comment]
17+
DATABASE_URL: ENC[AES256_GCM,data:U+L2P0O2wm8ixTKXi0tsE0bnaWmPluAR0LQZGvZ4/51krM4Zc0Kug5PFUS8Sx8Wbn6kJjTZwbMw5pb/AKajukyP64T+WyVp4efdiX3rfOAMpKLUlqQBa0Q4KyWQpsbb1GqaetEtuaaU=,iv:GMCoOW2khOKYCE0wbktoYr40d6cpPGkBDM9bKDHguew=,tag:ZWvUMSs6rJMs+cQmXM3PRA==,type:str]
18+
#ENC[AES256_GCM,data:Tg429cRRseI97Mm5mC7Bkr/DWOt+sPVvmJvS/tyAVlUFLLw=,iv:KQAEhyxdY7QbQ/RkqRSgSnFIEC2FHO/Q9425ENLjzYY=,tag:fa+UkeYZnVIz55o/83Kvjw==,type:comment]
19+
GROQ_API_KEY: ENC[AES256_GCM,data:3FoknPw8LNv9oVx/ecCVubV/prdxaUKXL3I80IL/dpblyOVb2cbTBHpmj68N5Rnr+xjUjTWRXWY=,iv:KRXxjX2ApFSzj5GH6GyG9T0695HWExQBl44Q81yVqNI=,tag:Lc/NfB8xh+rdqh/TndjZvg==,type:str]
20+
#ENC[AES256_GCM,data:xDdL3IwjDMNOyh6iqXf9AkxgcO6Pptov8HMP7Z6PAL3IXtV9mGeZBe/s9TQ=,iv:4rhw6REgolT2Gw80uOpxh7BbBoFyN5SpsC0QMA4KgjA=,tag:pX8mbv8HyfMVxjuBmPcnHQ==,type:comment]
21+
AI_ENDPOINT: ENC[AES256_GCM,data:NM+KNi6LvBx5pQ67ABKbfQPyvPpRmuIOZixEjEZm4DXBoMA=,iv:A1IJmj+Rn3VRhCQTDUuOXBzHKnVAZYddK/gAbkxZ+YI=,tag:NFLe51ttjH/lRkVpvU8g5A==,type:str]
22+
AI_API_KEY: ENC[AES256_GCM,data:/BjAnWNEFpPWRIokisK1LntVkZYBhLi28AAbs1AtmixX22cI,iv:CtJK9cLWebMv1JRGc35TekaE4ZJfSrCCqfzDjHdfL0s=,tag:8b49sAOdNsPpELBFR0+RSA==,type:str]
23+
AI_MODEL: ENC[AES256_GCM,data:XMYhZPxlgtotFc98NYK2WfCGg8dyROLBzQ==,iv:iJL0F3vTXn9OXjJ1NlLM1BBP+fRW/KPGex45D8XISow=,tag:Na0NdywM/a2IwVgrxUl5SQ==,type:str]
24+
PODCAST_INDEX_API_KEY: ENC[AES256_GCM,data:SnBvhqj5TiyJV3gUT5sBjXQO8fM=,iv:6Rx3utog5Y8we+xjGBk5Oo+fTs4QMuVSx2MHfMX6CaM=,tag:YCn6SJJU6rqBMfzWqg0l3A==,type:str]
25+
PODCAST_INDEX_API_SECRET: ENC[AES256_GCM,data:nw8UTnukfgXCzfxJ5PaihfPKEWgWNMKVJwTTrshg5poYeKvQdo6GUw==,iv:RyUtASF5/YkajhMqWvibunxp7r33e+Z2tJxowbUSmko=,tag:9Kn9KmyMOH3L4dXoKjIVOQ==,type:str]
26+
#ENC[AES256_GCM,data:saiNOWqpNvm7cC9NPZkUsdMr,iv:NpH+gxnHcqFjxfoi5kv9FkdWHBuan+pbp6sY4zdBfaU=,tag:K9j9DnCwVCPCmG4zJyZb0Q==,type:comment]
27+
STORAGE_PATH: ENC[AES256_GCM,data:VIYXfpy7Uje44wpymKPzCFE=,iv:ZdusCtqV40qKWmbmlUhSb8TrOp9Y5pR0noSsExRe2ts=,tag:FaEpStB2B6y+CXumxdPDXA==,type:str]
28+
#ENC[AES256_GCM,data:B02G0Xc+vWcmgT5AFb28BJ+ojbwJ4J5DmaPRW4B2,iv:I3NqpBdB5wtDV/1J2ephgddOI+mSRQGiynhSXq5azbw=,tag:0j1tG05HowEWmPIE65nnrw==,type:comment]
29+
OIDC_ENABLED: ENC[AES256_GCM,data:z0FsJg==,iv:9Q/9xd7WyJcWN/Wm2l9FnqoLaJNS9wgV3TN6H63CMBM=,tag:OfGhkNMR0XJNZPcnsqMI9Q==,type:str]
30+
OIDC_ISSUER: ENC[AES256_GCM,data:XsgtHYLXbsKrGpUR4Ys9c5q16j+I1k+1tH4MZbA=,iv:kQ1J9UOF/VmVgx7+RSFc3RRpUTUEeUVyLcE36WPpBLA=,tag:ifUBU76dQRgsCeo1Y7YUVQ==,type:str]
31+
OIDC_CLIENT_ID: ENC[AES256_GCM,data:G4u2qf/XU33C3fo7aVpKGkb/d4YXaMnX+FQnjbW0pKDwYR6p6UeyDeQIeWlvOhgl0bk8Mx543S132c+JX9tN2Z5ruQ0rMHAW,iv:jug8HMFnq+FUVk3npVbTPyFYVXsHTmwi2z6no6bXCSM=,tag:udPavnNdXAUgigTvaOfPqQ==,type:str]
32+
OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:f6N4371yCZ0yH0k/4tBkOhHAVc53/SDQbSyP1ikhf7JM9XbWF2hMklRdDuaUgGB+LHcLzU3DjgtIiv1ZiIrCE5ZjNZxjTYfz,iv:QKvW1YH4/0/yXGz7ZUEjbez7I5pktr4bbzifw+uy2Fs=,tag:vjt/JJc0fQbp4SkgaedMXg==,type:str]
33+
OIDC_REDIRECT_URI: ENC[AES256_GCM,data:cxQN1/1+zIsVrbMAa1dZVy96A731XfQ9zXM+Pnzuck1Z98vKPuRabpGhrpbgEeM=,iv:kPd1l7AbZ1+0HbZmEooOF3Hjk+T3zn8RirzGc66KnRA=,tag:UQnVor7yzJyLxzoTpTQAgg==,type:str]
34+
OIDC_SCOPES: ENC[AES256_GCM,data:D4eEsj2MNjHPF9S6jdeOXR5JjHE=,iv:pBqKbzL7PIsUgK1kQ7o/SWsfEDtZomtsaWtrettOdPo=,tag:0usAGZrvyO0Uyg5G8RDyRw==,type:str]
35+
OIDC_PKCE: ENC[AES256_GCM,data:RS+8lg==,iv:cr0qOKJVgaGXyzpxREVZLzR4AlkD/eiePqqcQH3ukE0=,tag:74JZ8Lvj4xiBfODIbRFN6Q==,type:str]
36+
OIDC_AUTH_METHOD: ENC[AES256_GCM,data:UnWp+BYT4UMQvMBoQa1cvXVcDg==,iv:B938GzXX7XfOPQ2NlxitDRFiVi7PHLLyDTumUTbyOHg=,tag:g0NXf8Mq+rnz5e2cbCERCg==,type:str]
37+
OIDC_USE_PAR: ENC[AES256_GCM,data:TYv+FVE=,iv:Zcttxe+7eQtxhwirIkif9eBqsfOTyW6d5oxENzZBzns=,tag:KsE+gTR/y94gCrb++p8nmw==,type:str]
38+
#ENC[AES256_GCM,data:UPO4bB57RZcOAECDi2odvYN6F0g9hiYxSCmIhTjluxXO4IwZG4Qgzy8qj5urVTmRoMM=,iv:1Kj3JeutsJ14us5O2O/e9Ue4s5cgqRWDwvP+KM61ECY=,tag:AD9nfi8+HFHmrJQN3R8BTQ==,type:comment]
39+
PHX_HOST: ENC[AES256_GCM,data:kMULVQ69HH1+1BWvebepZEaKZ4Q=,iv:JyhrYQGlElc0/5A3C4N+/lu1soHlUGc3l8et3TtVKVs=,tag:1Die9OIjRw3Qnqa28ZwLIw==,type:str]
40+
PHX_SCHEME: ENC[AES256_GCM,data:6CjpW2M=,iv:lgKoh08mPyYciw0tdtXkGLkMH17NP5Es/uOK0Jqvv5Q=,tag:Mtu7jIvAEOT2NtBpzPiv8Q==,type:str]
41+
PHX_PORT: ENC[AES256_GCM,data:MV+C,iv:CO52sB6bDMTG7RC42eKyIdCwaWIpfR/KIh9s6gyh1Cw=,tag:Irdgu3iGczA6vwp2KpAxMg==,type:str]
42+
sops:
43+
age:
44+
- recipient: age1j7x3jkw82w02taqj8dmqplae07fxcrup2enejnta9z2v82fzsakqd4ka6p
45+
enc: |
46+
-----BEGIN AGE ENCRYPTED FILE-----
47+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxb2U0bmdsOTVhdUk0Sk9C
48+
S2VHWEp6VDZHd2dRN2c1SzJEamlTNFRrZXpjCm03RXgzN3hNOEp3Z0J6T0wyVlho
49+
Z1RQS3FiOHhQZVY4bCtvNVNMRmt4aUkKLS0tIFZXYmx4Zi9yMmZjUnhYcFhlNndB
50+
akNHclFCb08wWVJxVEJjcjhjV0tzUVUKKr3bvMticlrqISqFyzKGWJn6C08l37US
51+
Yf1rBVZxXmNU7cGQXWQjaZeYsSQ2Huhua3qckKB1jJUWdnfcQq42qQ==
52+
-----END AGE ENCRYPTED FILE-----
53+
lastmodified: "2026-02-06T01:00:40Z"
54+
mac: ENC[AES256_GCM,data:7QiXVa/6NtPePw0RVMpP6Y+09isOHqPWLHvUYL/pKsOIw5XpEXA/QzXmTmw7GdkTj4+oCke6SET3gyHyFygEhUgK91CPS5IMDf84VHN3g/QIQlPzS5gBN1ENbuPvml85XnwyBNMfzBZZ5K8mFa2Z/AFSRPeBhhfW/jOq4GF7UoE=,iv:HCkGodmclO7T7jiat9fRBmvo9G2EaaXXzCAm0SwMikM=,tag:ULwaEFhIuVfL4M8K897h8A==,type:str]
55+
encrypted_regex: ^(data|stringData)$
56+
mac_only_encrypted: true
57+
version: 3.11.0

‎kubernetes/apps/pcab/pcab/secret-generator.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: viaduct.ai/v1
2+
kind: ksops
3+
metadata:
4+
name: pcab-secret-generator
5+
annotations:
6+
config.kubernetes.io/function: |
7+
exec:
8+
path: ksops
9+
files:
10+
- ./pcab-secret.sops.yaml
11+
- ./ghcr-secret.sops.yaml

‎kubernetes/apps/pcab/pcab/values.yaml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
defaultPodOptions:
2+
securityContext:
3+
runAsNonRoot: true
4+
runAsUser: 3000
5+
runAsGroup: 3000
6+
fsGroup: 3000
7+
fsGroupChangePolicy: OnRootMismatch
8+
seccompProfile: { type: RuntimeDefault }
9+
imagePullSecrets:
10+
- name: ghcr-secret
11+
12+
controllers:
13+
pcab:
14+
annotations:
15+
reloader.stakater.com/auto: "true"
16+
initContainers:
17+
init-db:
18+
image:
19+
repository: ghcr.io/home-operations/postgres-init
20+
tag: 18.1
21+
envFrom: &envFrom
22+
- secretRef:
23+
name: pcab-secret
24+
containers:
25+
app:
26+
image:
27+
repository: ghcr.io/mebezac/pcab
28+
tag: v1.0.4
29+
env:
30+
TZ: America/New_York
31+
PORT: "4000"
32+
envFrom: *envFrom
33+
probes:
34+
startup:
35+
enabled: true
36+
spec:
37+
httpGet:
38+
path: /health
39+
port: 4000
40+
initialDelaySeconds: 30
41+
periodSeconds: 10
42+
timeoutSeconds: 5
43+
failureThreshold: 30
44+
liveness:
45+
enabled: true
46+
spec:
47+
httpGet:
48+
path: /health
49+
port: 4000
50+
initialDelaySeconds: 0
51+
periodSeconds: 30
52+
timeoutSeconds: 10
53+
failureThreshold: 3
54+
readiness:
55+
enabled: true
56+
spec:
57+
httpGet:
58+
path: /health
59+
port: 4000
60+
initialDelaySeconds: 0
61+
periodSeconds: 10
62+
timeoutSeconds: 5
63+
failureThreshold: 3
64+
resources:
65+
requests:
66+
cpu: 100m
67+
memory: 256Mi
68+
limits:
69+
memory: 4Gi
70+
71+
service:
72+
app:
73+
controller: pcab
74+
ports:
75+
http:
76+
port: 4000
77+
78+
ingress:
79+
app:
80+
enabled: true
81+
className: external
82+
annotations:
83+
external-dns.alpha.kubernetes.io/target: external.laboratory.casa
84+
hosts:
85+
- host: pcab.laboratory.casa
86+
paths:
87+
- path: /
88+
service:
89+
identifier: app
90+
port: http
91+
92+
persistence:
93+
storage:
94+
type: persistentVolumeClaim
95+
storageClass: longhorn
96+
accessMode: ReadWriteOnce
97+
size: 10Gi
98+
suffix: storage
99+
globalMounts:
100+
- path: /app/priv/storage
101+
tmp:
102+
type: emptyDir
103+
globalMounts:
104+
- path: /tmp

‎kubernetes/apps/security/authelia/authelia-config.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -218,9 +218,9 @@ identity_providers:
218218
access_token_signed_response_alg: "none"
219219
userinfo_signed_response_alg: "none"
220220
# pcab
221-
- client_id: "gl6Z~vkcZLeoTh0TiMf8xV0PpcGumStzrLNbcSj_AhUKEIt2CgXi.-NR0U8Cs1_pQJHqCr1e"
221+
- client_id: "vhgmgEbo_H_j27QSNDnQG7YuwihZvr1qnZ_dS2moZa0eDMPLwulMdjb5wgDf92l.Giek9zCI"
222222
client_name: "pcab"
223-
client_secret: "$pbkdf2-sha512$310000$iK0beMwNqrrNbU4yxZCDwQ$IWRqhyE.RCrKHyY8WVWXxZJnEzq91sdYGyKTGcleeaAQkxNp9EgUEXhlzBABm32lxzgyHUCmlAik1yPUpvvnOA"
223+
client_secret: "$pbkdf2-sha512$310000$v08Ww/VwiK1pLHZ/r91rxg$LqAuMlDuVS84r.ktO3bM/ErGqYCc5vJ/WbGqN0D9CdiymAhstgoUkgfYdpxjwhQwkj4f.3h8xwomF2jR4/FFgg"
224224
public: false
225225
authorization_policy: "one_factor"
226226
require_pkce: true

‎kubernetes/argo/apps/pcab/pcab.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: argoproj.io/v1alpha1
2+
kind: Application
3+
metadata:
4+
name: pcab
5+
namespace: argo-system
6+
annotations:
7+
argocd.argoproj.io/sync-wave: "0"
8+
spec:
9+
project: kubernetes
10+
sources:
11+
- repoURL: https://github.com/mebezac/home-cluster.git
12+
path: kubernetes/apps/pcab/pcab
13+
targetRevision: main
14+
ref: pcab-repo
15+
- repoURL: ghcr.io/bjw-s-labs/helm
16+
chart: app-template
17+
targetRevision: 4.6.2
18+
helm:
19+
releaseName: pcab
20+
valueFiles:
21+
- $pcab-repo/kubernetes/apps/pcab/pcab/values.yaml
22+
destination:
23+
name: in-cluster
24+
namespace: pcab
25+
syncPolicy:
26+
automated:
27+
allowEmpty: true
28+
prune: true
29+
selfHeal: true
30+
syncOptions:
31+
- CreateNamespace=true

0 commit comments

Comments
 (0)