Add ansible files

ansible/files/argocd_svc.template.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - kind: Rule
+      match: Host(`{{ argocd.domain }}`)
+      priority: 10
+      services:
+        - name: argocd-server
+          port: 80
+    - kind: Rule
+      match: Host(`{{ argocd.domain }}`) && Header(`Content-Type`, `application/grpc`)
+      priority: 11
+      services:
+        - name: argocd-server
+          port: 80
+          scheme: h2c
+  tls:
+    certResolver: letsencrypt_dns

ansible/files/etc_modules-load.d_k8s.conf

@@ -0,0 +1,2 @@
+overlay
+br_netfilter

ansible/files/gitea_runner.template.yaml

@@ -0,0 +1,122 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-act-runner
+  namespace: gitea
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-act-runner-config
+  namespace: gitea
+data:
+  config.yaml: |
+    log:
+      level: info
+    cache:
+      enabled: false
+    container:
+      valid_volumes:
+        - /certs
+      options: |
+        --add-host=docker:host-gateway -v /certs:/certs
+        -e "DOCKER_HOST=tcp://docker:2376/"
+        -e "DOCKER_TLS_VERIFY=1"
+        -e "DOCKER_CERT_PATH=/certs/client"
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-docker-daemon-config
+  namespace: gitea
+data:
+  daemon.json: |
+    { "insecure-registries": ["gitea-http.gitea.svc.cluster.local:3000"] }
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gitea-act-runner-dind
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea-act-runner-dind
+  serviceName: gitea-act-runner-dind
+  template:
+    metadata:
+      labels:
+        app: gitea-act-runner-dind
+    spec:
+      containers:
+        - name: runner
+          image: docker.io/gitea/act_runner:nightly
+          env:
+            - name: DOCKER_HOST
+              value: "tcp://127.0.0.1:2376"
+            - name: DOCKER_CERT_PATH
+              value: /certs/client
+            - name: DOCKER_TLS_VERIFY
+              value: "1"
+            - name: ZOMBIE_TASK_TIMEOUT
+              value: "30m"
+            - name: GITEA_RUNNER_REGISTRATION_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-runner-registration-token
+                  key: token
+            - name: CONFIG_FILE
+              value: /config.yaml
+            - name: GITEA_INSTANCE_URL
+              value: http://gitea-http.gitea.svc.cluster.local:3000
+            - name: CONFIG_FILE
+              value: /actrunner/config.yaml
+
+          volumeMounts:
+            - name: gitea-act-runner-data
+              mountPath: /data
+            - name: docker-certs
+              mountPath: /certs/client
+            - name: gitea-act-runner-config
+              mountPath: /actrunner
+
+        - name: daemon
+          image: docker:27.1.2-dind
+          env:
+            - name: DOCKER_TLS_CERTDIR
+              value: /certs
+            - name: DOCKER_HOST
+              value: tcp://127.0.0.1:2376
+            - name: DOCKER_TLS_VERIFY
+              value: "1"
+          securityContext:
+            privileged: true
+          volumeMounts:
+            - name: docker-certs
+              mountPath: /certs/client
+            - name: gitea-docker-daemon-config
+              mountPath: /etc/docker
+
+      volumes:
+        - name: docker-certs
+          emptyDir: {}
+        - name: gitea-act-runner-config
+          configMap:
+            name: gitea-act-runner-config
+        - name: gitea-act-runner-data
+          persistentVolumeClaim:
+            claimName: gitea-act-runner
+        - name: gitea-docker-daemon-config
+          configMap:
+            name: gitea-docker-daemon-config

ansible/files/gitea_runner.template.yaml.WORKING

@@ -0,0 +1,100 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: act-runner-data
+  namespace: gitea
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: nfs-csi
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: act-runner-certs
+  namespace: gitea
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: nfs-csi
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: act-runner
+  name: act-runner
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: act-runner
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: act-runner
+    spec:
+      restartPolicy: Always
+      volumes:
+        - name: docker-certs
+          emptyDir: {}
+        - name: runner-data
+          # emptyDir: {}
+          persistentVolumeClaim:
+            claimName: act-runner-data
+      containers:
+        - name: runner
+          image: docker.io/gitea/act_runner:latest-dind
+          # command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- /opt/act/run.sh"]
+          securityContext:
+            privileged: true
+            capabilities:
+              add: ["SYS_ADMIN"]
+          env:
+            - name: DOCKER_HOST
+              value: tcp://127.0.0.1:2376
+              # value: unix:///var/run/docker.sock
+            - name: DOCKER_CERT_PATH
+              value: /certs/client
+            - name: DOCKER_TLS_VERIFY
+              value: "0"
+            - name: GITEA_INSTANCE_URL
+              value: http://gitea-http.gitea.svc.cluster.local:3000
+            # - name: GITEA_RUNNER_LABELS
+            #   value: "ubuntu-latest:docker://docker.io/gitea/runner-images:ubuntu-latest"
+            - name: GITEA_RUNNER_REGISTRATION_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-runner-registration-token
+                  key: token
+          volumeMounts:
+            - name: docker-certs
+              mountPath: /certs
+            - name: runner-data
+              mountPath: /data
+        # - name: daemon
+        #   image: docker:29.0.2-dind
+        #   env:
+        #     - name: DOCKER_TLS_CERTDIR
+        #       value: /certs
+        #     - name: DOCKER_HOST
+        #       value: tcp://127.0.0.1:2376
+        #     - name: DOCKER_TLS_VERIFY
+        #       value: "0"
+        #   securityContext:
+        #     privileged: true
+        #   volumeMounts:
+        #     - name: docker-certs
+        #       mountPath: /certs

ansible/files/gitea_runner_config.yaml

@@ -0,0 +1,110 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+
+# You don't have to copy this file to your instance,
+# just run `./act_runner generate-config > config.yaml` to generate a config file.
+
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: .runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 1
+  # Extra environment variables to run jobs.
+  envs:
+    A_TEST_ENV_NAME_1: a_test_env_value_1
+    A_TEST_ENV_NAME_2: a_test_env_value_2
+  # Extra environment variables to run jobs from a file.
+  # It will be ignored if it's empty or the file doesn't exist.
+  env_file: .env
+  # The timeout for a job to be finished.
+  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 3h
+  # The timeout for the runner to wait for running jobs to finish when shutting down.
+  # Any running jobs that haven't finished after this timeout will be cancelled.
+  shutdown_timeout: 0s
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+  # The github_mirror of a runner is used to specify the mirror address of the github that pulls the action repository.
+  # It works when something like `uses: actions/checkout@v4` is used and DEFAULT_ACTIONS_URL is set to github,
+  # and github_mirror is not empty. In this case,
+  # it replaces https://github.com with the value here, which is useful for some special network environments.
+  github_mirror: ""
+  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+  # Like: "macos-arm64:host" or "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+  # Find more images provided by Gitea at https://gitea.com/docker.gitea.com/runner-images .
+  # If it's empty when registering, it will ask for inputting labels.
+  # If it's empty when execute `daemon`, will use labels in `.runner` file.
+  labels:
+    - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+    - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+    - "ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04"
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: true
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+  # The external cache server URL. Valid only when enable is true.
+  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+  # The URL should generally end with "/".
+  external_server: ""
+
+container:
+  # Specifies the network to which the container will connect.
+  # Could be host, bridge or the name of a custom network.
+  # If it's empty, act_runner will create a network automatically.
+  network: ""
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options:
+  # The parent directory of a job's working directory.
+  # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically.
+  # If the path starts with '/', the '/' will be trimmed.
+  # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
+  # If it's empty, /workspace will be used.
+  workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # valid_volumes:
+  #   - data
+  #   - /src/*.json
+  # If you want to allow any volume, please use the following configuration:
+  # valid_volumes:
+  #   - '**'
+  valid_volumes: []
+  # overrides the docker client host with the specified one.
+  # If it's empty, act_runner will find an available docker host automatically.
+  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+  docker_host: ""
+  # Pull docker image(s) even if already present
+  force_pull: true
+  # Rebuild docker image(s) even if already present
+  force_rebuild: false
+  # Always require a reachable docker daemon, even if not required by act_runner
+  require_docker: false
+  # Timeout to wait for the docker daemon to be reachable, if docker is required by require_docker or act_runner
+  docker_timeout: 0s
+
+host:
+  # The parent directory of a job's working directory.
+  # If it's empty, $HOME/.cache/act/ will be used.
+  workdir_parent:

ansible/files/gitea_svc.template.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-http
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`{{ git.domain }}`)
+      kind: Rule
+      services:
+        - name: gitea-http
+          port: 3000
+  tls:
+    certResolver: letsencrypt_dns
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  entryPoints:
+    - ssh
+  routes:
+    - match: HostSNI(`*`)
+      priority: 10
+      services:
+        - name: gitea-ssh
+          port: 22
+          weight: 10

ansible/files/gitea_values.template.yaml

@@ -0,0 +1,27 @@
+valkey-cluster:
+  enabled: false
+valkey:
+  enabled: true
+postgresql:
+  enabled: true
+postgresql-ha:
+  enabled: false
+
+persistence:
+  enabled: true
+  storageClass: nfs-csi
+
+gitea:
+  config:
+    database:
+      DB_TYPE: postgres
+    indexer:
+      ISSUE_INDEXER_TYPE: bleve
+      REPO_INDEXER_ENABLED: true
+    server:
+      DOMAIN: "{{ git.domain }}"
+      ROOT_URL: "https://{{ git.domain }}"
+  admin:
+    username: "{{ git_admin_username }}"
+    password: "{{ git_admin_password }}"
+    email: "admin@{{ git.domain }}"

ansible/files/gitlab_values.template.yaml

@@ -0,0 +1,29 @@
+nginx-ingress:
+  enabled: false
+
+global:
+  edition: "ce"
+  hosts:
+    domain: "{{ gitlab.domain }}"
+    https: false
+  ingress:
+    configureCertmanager: false
+    tls:
+      enabled: false
+
+gitlab:
+  webservice:
+    ingress:
+      tls:
+        enabled: false
+  registry:
+    ingress:
+      tls:
+        enabled: false
+  minio:
+    ingress:
+      tls:
+        enabled: false
+
+minio:
+  image: docker.io/minio/minio

ansible/files/local-path-storage.yaml

@@ -0,0 +1,128 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: local-path-storage
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: local-path-provisioner-service-account
+  namespace: local-path-storage
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: local-path-provisioner-role
+rules:
+  - apiGroups: [""]
+    resources: ["nodes", "persistentvolumeclaims", "configmaps"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["endpoints", "persistentvolumes", "pods"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses"]
+    verbs: ["get", "list", "watch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: local-path-provisioner-bind
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: local-path-provisioner-role
+subjects:
+  - kind: ServiceAccount
+    name: local-path-provisioner-service-account
+    namespace: local-path-storage
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: local-path-provisioner
+  namespace: local-path-storage
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: local-path-provisioner
+  template:
+    metadata:
+      labels:
+        app: local-path-provisioner
+    spec:
+      serviceAccountName: local-path-provisioner-service-account
+      containers:
+        - name: local-path-provisioner
+          image: docker.io/rancher/local-path-provisioner:v0.0.24
+          imagePullPolicy: IfNotPresent
+          command:
+            - local-path-provisioner
+            - --debug
+            - start
+            - --config
+            - /etc/config/config.json
+          volumeMounts:
+            - name: config-volume
+              mountPath: /etc/config/
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+      volumes:
+        - name: config-volume
+          configMap:
+            name: local-path-config
+
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: local-path
+provisioner: rancher.io/local-path
+volumeBindingMode: WaitForFirstConsumer
+reclaimPolicy: Delete
+
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: local-path-config
+  namespace: local-path-storage
+data:
+  config.json: |-
+    {
+            "nodePathMap":[
+            {
+                    "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
+                    "paths":["/opt/local-path-provisioner"]
+            }
+            ]
+    }
+  setup: |-
+    #!/bin/sh
+    set -eu
+    mkdir -m 0777 -p "$VOL_DIR"
+  teardown: |-
+    #!/bin/sh
+    set -eu
+    rm -rf "$VOL_DIR"
+  helperPod.yaml: |-
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      name: helper-pod
+    spec:
+      containers:
+      - name: helper-pod
+        image: docker.io/busybox
+        imagePullPolicy: IfNotPresent

ansible/files/loki_values.yaml

@@ -0,0 +1,54 @@
+loki:
+  commonConfig:
+    replication_factor: 1
+  schemaConfig:
+    configs:
+      - from: "2024-04-01"
+        store: tsdb
+        object_store: s3
+        schema: v13
+        index:
+          prefix: loki_index_
+          period: 24h
+  pattern_ingester:
+    enabled: true
+  limits_config:
+    allow_structured_metadata: true
+    volume_enabled: true
+  ruler:
+    enable_api: true
+
+minio:
+  enabled: true
+
+deploymentMode: SingleBinary
+
+singleBinary:
+  replicas: 1
+
+# Zero out replica counts of other deployment modes
+backend:
+  replicas: 0
+read:
+  replicas: 0
+write:
+  replicas: 0
+
+ingester:
+  replicas: 0
+querier:
+  replicas: 0
+queryFrontend:
+  replicas: 0
+queryScheduler:
+  replicas: 0
+distributor:
+  replicas: 0
+compactor:
+  replicas: 0
+indexGateway:
+  replicas: 0
+bloomCompactor:
+  replicas: 0
+bloomGateway:
+  replicas: 0

ansible/files/onedev_svc.template.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: onedev-http
+  namespace: onedev
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`{{ git.domain }}`)
+      kind: Rule
+      services:
+        - name: onedev
+          port: 80
+  tls:
+    certResolver: letsencrypt_dns
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: onedev-ssh
+  namespace: onedev
+spec:
+  entryPoints:
+    - ssh
+  routes:
+    - match: HostSNI(`*`)
+      priority: 10
+      services:
+        - name: onedev
+          port: 22
+          weight: 10

ansible/files/traefik_ovh_secret.template.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ovh-api-credentials
+  namespace: traefik
+type: Opaque
+data:
+  OVH_ENDPOINT: "{{ ovh_creds.ovh_endpoint | b64encode }}"
+  OVH_APPLICATION_KEY: "{{ ovh_creds.ovh_application_key | b64encode }}"
+  OVH_APPLICATION_SECRET: "{{ ovh_creds.ovh_application_secret | b64encode }}"
+  OVH_CONSUMER_KEY: "{{ ovh_creds.ovh_consumer_key | b64encode }}"

ansible/files/traefik_values.template.yaml

@@ -0,0 +1,86 @@
+---
+persistence:
+  enabled: true
+  size: 1G
+
+ports:
+  web:
+    exposedPort: 80
+    nodePort: 30080
+  websecure:
+    exposedPort: 443
+    nodePort: 30443
+    tls:
+      enabled: true
+  ssh:
+    port: 2222
+    expose:
+      default: true
+    exposedPort: 2222
+    nodePort: 30022
+    protocol: TCP
+
+service:
+  type: NodePort
+
+ingressRoute:
+  dashboard:
+    enabled: true
+    matchRule: Host(`traefik.kube-main.lab`)
+    entryPoints:
+      - web
+
+providers:
+  kubernetesCRD:
+    allowExternalNameServices: true
+  kubernetesGateway:
+    enabled: true
+
+gateway:
+  listeners:
+    web:
+      namespacePolicy:
+        from: All
+
+certificatesResolvers:
+  letsencrypt_dns_stag:
+    acme:
+      email: "{{ email }}"
+      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
+      storage: "/data/acme_dns_stag.json"
+      dnsChallenge:
+        provider: ovh
+        delayBeforeCheck: 0
+  letsencrypt_dns:
+    acme:
+      email: "{{ email }}"
+      storage: "/data/acme_dns.json"
+      dnsChallenge:
+        provider: ovh
+        delayBeforeCheck: 0
+
+env:
+  - name: OVH_ENDPOINT
+    valueFrom:
+      secretKeyRef:
+        name: ovh-api-credentials
+        key: OVH_ENDPOINT
+  - name: OVH_APPLICATION_KEY
+    valueFrom:
+      secretKeyRef:
+        name: ovh-api-credentials
+        key: OVH_APPLICATION_KEY
+  - name: OVH_APPLICATION_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: ovh-api-credentials
+        key: OVH_APPLICATION_SECRET
+  - name: OVH_CONSUMER_KEY
+    valueFrom:
+      secretKeyRef:
+        name: ovh-api-credentials
+        key: OVH_CONSUMER_KEY
+
+logs:
+  general:
+    level: INFO