grav on php74/bullseye

.gitmodules

@@ -10,9 +10,6 @@
 [submodule "kubernetes-ingress"]
 	path = kubernetes-ingress
 	url = https://github.com/haproxytech/kubernetes-ingress.git
-[submodule "ingress-nginx"]
-	path = ingress-nginx
-	url = https://github.com/kubernetes/ingress-nginx.git
 [submodule "pihole-kubernetes"]
 	path = pihole-kubernetes
 	url = https://github.com/MoJo2600/pihole-kubernetes.git
@@ -46,3 +43,6 @@
 [submodule "csi-s3/node-driver-registrar"]
 	path = csi-s3/node-driver-registrar
 	url = https://github.com/kubernetes-csi/node-driver-registrar.git
+[submodule "apps/postgresql/postgres_exporter"]
+	path = apps/postgresql/postgres_exporter
+	url = https://github.com/wrouesnel/postgres_exporter.git

.project

@@ -5,7 +5,13 @@
 	<projects>
 	</projects>
 	<buildSpec>
+		<buildCommand>
+			<name>org.python.pydev.PyDevBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
 	</buildSpec>
 	<natures>
+		<nature>org.python.pydev.pythonNature</nature>
 	</natures>
 </projectDescription>

.pydevproject

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?eclipse-pydev version="1.0"?><pydev_project>
+    <pydev_property name="org.python.pydev.PYTHON_PROJECT_INTERPRETER">Default</pydev_property>
+    <pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python interpreter</pydev_property>
+</pydev_project>

_scripts/get_resources.py

@@ -0,0 +1,73 @@
+#!/usr/bin/python3
+import kubernetes as k8s
+
+from pint        import UnitRegistry
+from collections import defaultdict
+
+__all__ = ["compute_allocated_resources"]
+
+
+def compute_allocated_resources():
+    ureg = UnitRegistry()
+    ureg.load_definitions('kubernetes_units.txt')
+
+    Q_ = ureg.Quantity
+    data = {}
+
+    # doing this computation within a k8s cluster
+    k8s.config.load_kube_config()
+    core_v1 = k8s.client.CoreV1Api()
+    
+#     print("Listing pods with their IPs:")
+#     ret = core_v1.list_pod_for_all_namespaces(watch=False)
+#     for i in ret.items:
+#         print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))
+
+    for node in core_v1.list_node().items:
+        
+        stats = {}
+        node_name = node.metadata.name
+        allocatable = node.status.allocatable
+        max_pods = int(int(allocatable["pods"]) * 1.5)
+#         print("{} ALLOC: {} MAX_PODS: {}".format(node_name,allocatable,max_pods))
+        field_selector = ("status.phase!=Succeeded,status.phase!=Failed," + 
+                          "spec.nodeName=" + node_name)
+
+        stats["cpu_alloc"] = Q_(allocatable["cpu"])
+        stats["mem_alloc"] = Q_(allocatable["memory"])
+
+        pods = core_v1.list_pod_for_all_namespaces(limit=max_pods,
+                                                   field_selector=field_selector).items
+
+        # compute the allocated resources
+        cpureqs, cpulmts, memreqs, memlmts = [], [], [], []
+        for pod in pods:
+            for container in pod.spec.containers:
+                res = container.resources
+                reqs = defaultdict(lambda: 0, res.requests or {})
+                lmts = defaultdict(lambda: 0, res.limits or {})
+                cpureqs.append(Q_(reqs["cpu"]))
+                memreqs.append(Q_(reqs["memory"]))
+                cpulmts.append(Q_(lmts["cpu"]))
+                memlmts.append(Q_(lmts["memory"]))
+
+        stats["cpu_req"] = sum(cpureqs)
+        stats["cpu_lmt"] = sum(cpulmts)
+        stats["cpu_req_per"] = (stats["cpu_req"] / stats["cpu_alloc"] * 100)
+        stats["cpu_lmt_per"] = (stats["cpu_lmt"] / stats["cpu_alloc"] * 100)
+
+        stats["mem_req"] = sum(memreqs)
+        stats["mem_lmt"] = sum(memlmts)
+        stats["mem_req_per"] = (stats["mem_req"] / stats["mem_alloc"] * 100)
+        stats["mem_lmt_per"] = (stats["mem_lmt"] / stats["mem_alloc"] * 100)
+
+        data[node_name] = stats
+
+    return data
+
+if __name__ == "__main__":
+    # execute only if run as a script
+    print(compute_allocated_resources())
+    
+    
+    

_scripts/kubernetes_units.txt

@@ -0,0 +1,20 @@
+# memory units
+
+kmemunits = 1 = [kmemunits]
+Ki = 1024 * kmemunits
+Mi = Ki^2
+Gi = Ki^3
+Ti = Ki^4
+Pi = Ki^5
+Ei = Ki^6
+
+# cpu units
+
+kcpuunits = 1 = [kcpuunits]
+m = 1/1000 * kcpuunits
+k = 1000 * kcpuunits
+M = k^2
+G = k^3
+T = k^4
+P = k^5
+E = k^6

_sys/haproxy-ingress.yaml

@@ -0,0 +1,204 @@
+#https://raw.githubusercontent.com/haproxytech/kubernetes-ingress/master/deploy/haproxy-ingress.yaml
+#https://www.haproxy.com/documentation/kubernetes/latest/installation/community/kubernetes/
+#
+# NOTES: Images are not from haproxytech, no arm64 imgs
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: haproxy-controller
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: haproxy-ingress-service-account
+  namespace: haproxy-controller
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: haproxy-ingress-cluster-role
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - endpoints
+  - nodes
+  - pods
+  - services
+  - namespaces
+  - events
+  - serviceaccounts
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - "extensions"
+  resources:
+  - ingresses
+  - ingresses/status
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - patch
+  - update
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: haproxy-ingress-cluster-role-binding
+  namespace: haproxy-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: haproxy-ingress-cluster-role
+subjects:
+- kind: ServiceAccount
+  name: haproxy-ingress-service-account
+  namespace: haproxy-controller
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: haproxy
+  namespace: haproxy-controller
+data:
+  forwarded-for: "true"
+  load-balance: "leastconn"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: ingress-default-backend
+  name: ingress-default-backend
+  namespace: haproxy-controller
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: ingress-default-backend
+  template:
+    metadata:
+      labels:
+        run: ingress-default-backend
+    spec:
+      containers:
+      - name: ingress-default-backend
+        #image: gcr.io/google_containers/defaultbackend:1.4
+        image: starlingx4arm/defaultbackend:1.5-aarch64
+        ports:
+        - containerPort: 8080
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: ingress-default-backend
+  name: ingress-default-backend
+  namespace: haproxy-controller
+spec:
+  selector:
+    run: ingress-default-backend
+  ports:
+  - name: port-1
+    port: 8080
+    protocol: TCP
+    targetPort: 8080
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: haproxy-ingress
+  name: haproxy-ingress
+  namespace: haproxy-controller
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: haproxy-ingress
+  template:
+    metadata:
+      labels:
+        run: haproxy-ingress
+    spec:
+      serviceAccountName: haproxy-ingress-service-account
+      containers:
+      - name: haproxy-ingress
+        #image: haproxytech/kubernetes-ingress
+        image: bmanojlovic/kubernetes-ingress:latest
+        args:
+          - --configmap=haproxy-controller/haproxy
+          - --default-backend-service=haproxy-controller/ingress-default-backend
+        resources:
+          requests:
+            cpu: "500m"
+            memory: "50Mi"
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 1042
+        ports:
+        - name: http
+          containerPort: 80
+        - name: https
+          containerPort: 443
+        - name: stat
+          containerPort: 1024
+        env:
+        - name: TZ
+          value: "Etc/UTC"
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: haproxy-ingress
+  name: haproxy-ingress
+  namespace: haproxy-controller
+spec:
+  selector:
+    run: haproxy-ingress
+  type: NodePort
+  ports:
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 80
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 443
+  - name: stat
+    port: 1024
+    protocol: TCP
+    targetPort: 1024

_sys/kube-router-all-service-daemonset.yaml

@@ -17,6 +17,7 @@ data:
              "name":"kubernetes",
              "type":"bridge",
              "bridge":"kube-bridge",
+             "mtu":1420,
              "isDefaultGateway":true,
              "hairpinMode":true,
              "ipam":{
@@ -47,6 +48,7 @@ spec:
       - name: kube-router
         image: docker.io/cloudnativelabs/kube-router
         args:
+          - "--auto-mtu=false"
           - "--run-router=true"
           - "--run-firewall=true"
           - "--run-service-proxy=true"

_sys/traefik-deployment.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik-ingress-controller
+  namespace: kube-system
+---
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: traefik-ingress-controller
+  namespace: kube-system
+  labels:
+    k8s-app: traefik-ingress-lb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: traefik-ingress-lb
+  template:
+    metadata:
+      labels:
+        k8s-app: traefik-ingress-lb
+        name: traefik-ingress-lb
+    spec:
+      serviceAccountName: traefik-ingress-controller
+      terminationGracePeriodSeconds: 60
+      containers:
+      - image: traefik:v1.7
+        name: traefik-ingress-lb
+        ports:
+        - name: http
+          containerPort: 80
+        - name: admin
+          containerPort: 8080
+        args:
+        - --api
+        - --kubernetes
+        - --loglevel=ERROR
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: traefik-ingress-service
+  namespace: kube-system
+  annotations:
+    kuber-router.io/service.hairpin: ""
+spec:
+  selector:
+    k8s-app: traefik-ingress-lb
+  ports:
+    - protocol: TCP
+      port: 80
+      name: web
+    - protocol: TCP
+      port: 8080
+      name: admin
+  type: LoadBalancer
+  loadBalancerIP: 172.23.255.1

apps/codetogether.yaml

@@ -0,0 +1,133 @@
+# ========================================================================
+# Secret: CodeTogether License Values
+# ========================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: codetogether-license
+  namespace: default
+type: Opaque
+stringData:
+  # Configure as needed for your deployment, should match your SSL certificate
+  CT_SERVER_URL: "https://cd.lan"
+  CT_TRUST_ALL_CERTS: "true"
+  # Provided by your Genuitec Sales Representative
+  # *values must match exactly
+  CT_LICENSEE: "Werkstatt"
+  CT_MAXCONNECTIONS: "0"
+  CT_EXPIRATION: "2022/10/01"
+  CT_SIGNATURE: "xXM4cwzG...619bef4"
+---
+# ========================================================================
+# Secret: SSL Key and Certificate for SSL used by Ingress
+# ========================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: codetogether-sslsecret
+  namespace: default
+type: kubernetes.io/tls
+data:
+  # value from "cat ssl.crt | base64 -w 0"
+  tls.crt: "LS0tLS1CRUdJTi...UZJQ0FURS0tLS0tDQo="
+  # value from "cat ssl.key | base64 -w 0"
+  tls.key: "LS0tLS1CRUdJTi...EUgS0VZLS0tLS0NCg=="
+---
+# ========================================================================
+# Ingress: Expose the HTTPS service to the network
+# ========================================================================
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: codetogether
+spec:
+  tls:
+  - hosts:
+      - SERVERFQDN
+    secretName: codetogether-sslsecret
+  rules:
+  - host: SERVERFQDN
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: codetogether
+          servicePort: 80
+---
+# ========================================================================
+# Service: Map the HTTP port from the container
+# ========================================================================
+apiVersion: v1
+kind: Service
+metadata:
+  name: codetogether
+  labels:
+    run: codetogether
+spec:
+  ports:
+  - port: 80
+    name: http
+    targetPort: 1080
+    protocol: TCP
+  selector:
+    run: codetogether
+---
+# ========================================================================
+# Deployment: Configure the Container Deployment
+# ========================================================================
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: codetogether
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      run: codetogether
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        run: codetogether
+    spec:
+      containers:
+      - name: codetogether
+        image: hub.edge.codetogether.com/latest/codetogether:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 1080
+        env:
+        - name: CT_LOCATOR
+          value: "none"
+        - name: CT_SERVER_URL
+          valueFrom:
+              secretKeyRef:
+                name: codetogether-license
+                key: CT_SERVER_URL
+        - name: CT_TRUST_ALL_CERTS
+          valueFrom:
+              secretKeyRef:
+                name: codetogether-license
+                key: CT_TRUST_ALL_CERTS
+        - name: CT_LICENSEE
+          valueFrom:
+              secretKeyRef:
+                name: codetogether-license
+                key: CT_LICENSEE
+        - name: CT_MAXCONNECTIONS
+          valueFrom:
+              secretKeyRef:
+                name: codetogether-license
+                key: CT_MAXCONNECTIONS
+        - name: CT_EXPIRATION
+          valueFrom:
+              secretKeyRef:
+                name: codetogether-license
+                key: CT_EXPIRATION
+        - name: CT_SIGNATURE
+          valueFrom:
+              secretKeyRef:
+                name: codetogether-license
+                key: CT_SIGNATURE
+      imagePullSecrets:
+      - name: ctcreds

apps/docker-registry/README.md

@@ -2,8 +2,6 @@ Docker-ui
 
 Build it for arm64:
 
-docker build --platform linux/arm64 -t joxit/docker-registry-ui:static -f static.dockerfile github.com/Joxit/docker-registry-ui
+docker build --platform linux/arm64 -t docker-registry.lan/docker-registry-ui:arm64 -f static.dockerfile github.com/Joxit/docker-registry-ui
 
-
-docker tag 1494c11066f5 docker-registry.lan/docker-registry-ui:arm64
 docker push docker-registry.lan/docker-registry-ui:arm64

apps/docker-registry/docker-registry-ui.yaml

@@ -6,7 +6,6 @@ metadata:
   labels:
     app: registry-ui
     release: docker-registry-ui
-    app/version: "1.2.1"
 spec:
   replicas: 1
   selector:
@@ -30,8 +29,8 @@ spec:
               value: "dReg"
             - name: DELETE_IMAGES
               value: "true"
-            - name: REGISTRY_URL
+            #- name: REGISTRY_URL
-              value: "http://docker-registry-ui.lan"
+            #  value: "http://docker-registry.lan"
             - name: PULL_URL
               value: "http://docker-registry.lan"
           ports:
@@ -48,11 +47,11 @@ spec:
               port: http
           resources:
             requests:
-              memory: "24Mi"
+              memory: "20Mi"
-              cpu: "50m"
+              cpu: "10m"
             limits:
-              memory: "64Mi"
+              memory: "32Mi"
-              cpu: "100m"
+              cpu: "50m"
 ---
 apiVersion: v1
 kind: Service
@@ -61,7 +60,6 @@ metadata:
   labels:
     app: registry-ui
     release: docker-registry-ui
-    app/version: "1.2.1"
 spec:
   ports:
     - port: 80

apps/gitea.yaml

@@ -1,3 +1,7 @@
+#we use postgresql:
+#create database gitea;
+#create user gitea with encrypted password 'secret';
+#grant all privileges on database gitea to gitea;
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -46,13 +50,13 @@ spec:
             httpGet:
               path: /
               port: http
-#           resources:
+          resources:
-#             requests:
+            requests:
-#               memory: "256Mi"
+              memory: "256Mi"
-#               cpu: "250m"
+              cpu: "250m"
-#             limits:
+            limits:
-#               memory: "1000Mi"
+              memory: "1000Mi"
-#               cpu: "500m"
+              cpu: "500m"
       volumes:
       - name: gitea
         persistentVolumeClaim:
@@ -78,14 +82,14 @@ metadata:
   name: gitea
   labels:
     app: gitea
-    release: latest
 spec:
+  type: LoadBalancer
   ports:
     - port: 3000
       targetPort: http
       protocol: TCP
       name: http
-    - port: 2222
+    - port: 22
       targetPort: 22
       name: ssh
   selector:
@@ -96,9 +100,11 @@ apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
     name: gitea
+    annotations:
+      ingress.kubernetes.io/whitelist-x-forwarded-for: "true"
 spec:
     rules:
-    - host: git.lan
+    - host: git-ui.lan
       http:
           paths:
           - backend:

apps/mosquitto/deployment.yaml

@@ -148,4 +148,3 @@ data:
     port 1883
     persistence true 
     persistence_location /mosquitto/data/
-

apps/nodered-deployment.yaml

@@ -25,6 +25,13 @@ spec:
           volumeMounts:
             - mountPath: /data
               name: data
+          resources:
+            limits:
+              cpu: "1"
+              memory: "200Mi"
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
       volumes:
         - name: data
           persistentVolumeClaim:
@@ -54,7 +61,7 @@ metadata:
     nginx.ingress.kubernetes.io/rewrite-target: /
 spec:
   rules:
-  - host: node-red.lan
+  - host: nodered.lan
     http:
       paths:
       - path: /

apps/pihole-deployment.yaml

@@ -127,8 +127,6 @@ apiVersion: networking.k8s.io/v1beta1
 kind: Ingress
 metadata:
   name: pihole 
-  annotations:
-      nginx.ingress.kubernetes.io/rewrite-target: /admin/$1
 spec:
   rules:
   - host: pihole.lan
@@ -137,7 +135,6 @@ spec:
         - backend:
             serviceName: pihole-tcp
             servicePort: http
-          path: /(.*)
           pathType: ImplementationSpecific
 ---
 apiVersion: v1

apps/postgresql/postgresql-deploy.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  labels:
+    app: postgres
+    env: live
+spec:
+  selector:
+    matchLabels:
+      app: postgres
+      env: live
+  serviceName: postgres-service
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: postgres
+        env: live
+    spec:
+      containers:
+      - name: postgres
+        image: postgres
+        volumeMounts:
+        - name: postgres-disk
+          mountPath: /var/lib/postgresql/data
+        env:
+        - name: POSTGRES_PASSWORD
+          value: pg2020
+        - name: PGDATA
+          value: /var/lib/postgresql/data/pgdata
+#      - name: prometheus-exporter
+#        image: wrouesnel/postgres_exporter
+#        env:
+#        - name: DATA_SOURCE_NAME
+#          value: postgresql://postgres:pg2020@localhost:5432/postgres?sslmode=disable
+      volumes:
+      - name: postgres-disk
+        persistentVolumeClaim:
+          claimName: postgres
+#  volumeClaimTemplates:
+#  - metadata:
+#      name: postgres-disk
+#    spec:
+#      accessModes:
+#      - ReadWriteOnce
+#      resources:
+#        requests:
+#          storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres
+  labels:
+    app: postgres
+spec:
+  storageClassName: nfs-ssd
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Mi
+# service.yml
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  labels:
+    app: postgres
+    env: live
+spec:
+  selector:
+    env: live
+  type: LoadBalancer
+  ports:
+  - port: 5432
+    targetPort: 5432

apps/rompr/deployment.yaml

@@ -1,81 +0,0 @@
----
-apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
-kind: Deployment
-metadata:
-   name: rompr
-spec:
-   selector:
-      matchLabels:
-         app: rompr
-   strategy:
-      type: Recreate
-   template:
-      metadata:
-         labels:
-            app: rompr
-      spec:
-         containers:
-         -  image: docker-registry.lan/rompr:arm64
-            name: rompr
-            imagePullPolicy: Always
-            ports:
-            -  containerPort: 9000
-               name: php-fpm
-            volumeMounts:
-            -  name: rompr-data
-               mountPath: /rompr
-         -  image: sebp/lighttpd:latest
-            name: lighttpd
-            imagePullPolicy: IfNotPresent
-            ports:
-            -  containerPort: 80
-               name: http
-            volumeMounts:
-            - name: rompr-data
-              mountPath: /rompr
-            - name: rompr-lighttpd-config
-              mountPath: /etc/lighttpd
-         volumes:
-         - name: rompr-data
-           persistentVolumeClaim:
-             claimName: rompr-data
-         - name: rompr-lighttpd-config
-           configMap:
-             name: rompr-lighttpd-config
----
-apiVersion: v1
-kind: Service
-metadata:
-   name: rompr
-spec:
-   ports:
-   - name: http
-     port: 80
-   selector:
-      app: rompr
----
-apiVersion: networking.k8s.io/v1beta1
-kind: Ingress
-metadata:
-   name: rompr
-spec:
-   rules:
-   -  host: musik.lan
-      http:
-         paths:
-         -  backend:
-               serviceName: rompr
-               servicePort: http
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-   name: rompr-data
-spec:
-   storageClassName: nfs-ssd
-   accessModes:
-   - ReadWriteOnce
-   resources:
-      requests:
-         storage: 6Gi
-         

apps/smarthome/Dockerfile

@@ -0,0 +1,50 @@
+FROM node:current-buster
+
+# Set the commit of Zwave2Mqtt to checkout when cloning the repo
+ENV Z2M_VERSION=9cc3740740b57f1e896139b5ffdb25be7576ad58
+ENV DEBIAN_FRONTEND noninteractive
+
+#setup local apt cache
+RUN sed -i 's@http://@http://apt-cache.lan/@g' /etc/apt/sources.list
+#/apt-cache
+
+# Install required dependencies
+RUN apt update -y
+RUN apt full-upgrade -y
+
+# Packages we need
+RUN apt install -y \
+	socat libopenzwave1.5 npm git
+
+# Clone Zwave2Mqtt build pkg files and move them to /dist/pkg
+RUN npm config set unsafe-perm true && npm install -g pkg
+RUN cd /root \
+	&& git clone https://github.com/OpenZWave/Zwave2Mqtt.git  \
+	&& cd Zwave2Mqtt \
+	&& git checkout ${Z2M_VERSION} \
+	&& npm install \
+	&& npm run build
+
+# Clean up
+RUN apt autoremove -y
+RUN apt clean -y
+RUN rm -rf /root/*
+RUN	apt-get clean -y
+RUN	rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+COPY --from=build /dist/lib/ /lib/
+COPY --from=build /dist/pkg /usr/src/app
+
+# supervisor base configuration 
+ADD supervisor.conf /etc/supervisor.conf
+
+LABEL maintainer="zoide"
+
+# Set enviroment
+ENV LD_LIBRARY_PATH /lib
+
+EXPOSE 8091
+
+CMD ["supervisord", "-c", "/etc/supervisor.conf"]
+#CMD ["/usr/src/app/zwave2mqtt"]
+

apps/smarthome/home-assistant.yaml

@@ -21,9 +21,12 @@ spec:
       - name: hassio
         image: "homeassistant/home-assistant:latest"
         imagePullPolicy: Always
+        env:
+        - name: TZ
+          value: Europe/Berlin
         volumeMounts:
         - name: hassio-storage
-              mountPath: /.storage
+          mountPath: /config
         ports:
         - name: http
           containerPort: 8123
@@ -32,11 +35,11 @@ spec:
           httpGet:
             path: /
             port: http
+#           resources:
         readinessProbe:
           httpGet:
             path: /
             port: http
-#           resources:
 #             requests:
 #               memory: "256Mi"
 #               cpu: "250m"
@@ -91,4 +94,3 @@ spec:
       - backend:
           serviceName: hassio
           servicePort: http
-            path: / 

apps/smarthome/socat/Dockerfile

@@ -0,0 +1,8 @@
+FROM alpine:latest
+
+ARG VERSION=1.7.3.2
+
+RUN apk --no-cache add socat
+#=${VERSION}
+
+ENTRYPOINT ["socat"]

apps/smarthome/supervisor.conf

@@ -0,0 +1,13 @@
+[supervisord]
+nodaemon=true
+
+[program:socat]
+command=/usr/bin/socat -d -d -d pty,link=/dev/ttySER2NET0,raw,user=root,group=root,mode=660 tcp:auto:3333
+killasgroup=true
+stopasgroup=true
+redirect_stderr=true
+
+[program:zwave2mqtt]
+directory=/usr/src/app
+command=/usr/src/app/zwave2mqtt
+redirect_stderr=true

apps/smarthome/zwave2mqtt.yaml

@@ -0,0 +1,120 @@
+## FROM: https://github.com/OpenZWave/Zwave2Mqtt
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: zwave2mqtt
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      name: zwave2mqtt
+  template:
+    metadata:
+      labels:
+        name: zwave2mqtt
+    spec:
+      containers:
+      - name: zwave2mqtt
+        image: docker-registry.lan/zwave2mqtt:arm64
+        livenessProbe:
+          failureThreshold: 12
+          httpGet:
+            httpHeaders:
+            - name: Accept
+              value: text/plain
+            path: /
+            port: http
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 2
+        ports:
+        - containerPort: 8091
+          name: http
+          protocol: TCP
+        resources:
+          limits:
+            cpu: '1'
+            memory: 512Mi
+          requests:
+            cpu: '1'
+            memory: 200Mi
+        securityContext:
+          allowPrivilegeEscalation: true
+          privileged: true
+        volumeMounts:
+        - mountPath: /usr/src/app/store
+          name: data
+# - mountPath: /usr/local/etc/openzwave
+#   name: ozwdatabase
+# - mountPath: /usr/src/app/store/settings.json <-- if putting your settings.json in a secret
+#   name: config
+#   readOnly: true
+#   subPath: settings.json
+# nodeSelector:
+#   kubernetes.io/hostname: stick1 #<--- the name of your cluster node that the zwave usb stick in
+#      - name: socat
+#        image: docker-registry.lan/socat:arm64
+#        args:
+#         - pty,link=/dev/ttySER2NET0,raw,user=root,group=root,mode=660
+#         - tcp:auto:3333
+#        securityContext:
+#          allowPrivilegeEscalation: true
+#          privileged: true
+      volumes:
+# - name: config <-- if putting your settings.json in a secret
+#   secret:
+#     defaultMode: 420
+#     secretName: zwave2mqtt
+      #- name: zwavestick
+      #  hostPath:
+      #    path: /dev/ttyACM0
+      #    type: File
+      - name: data
+        persistentVolumeClaim:
+          claimName: zwave2mqtt-storage
+# - name: ozwdatabase
+#   hostPath:
+#     path: /zwave2mqtt/database
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: zwave2mqtt-storage
+  labels:
+    app: zwave2mqtt
+spec:
+  storageClassName: nfs-ssd
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Mi
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: zwave2mqtt
+spec:
+  rules:
+  - host: zwave.lan
+    http:
+      paths:
+      - backend:
+          serviceName: zwave2mqtt
+          servicePort: http
+          
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: zwave2mqtt
+spec:
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+  selector:
+    name: zwave2mqtt

apps/web/grav/Dockerfile

@@ -0,0 +1,34 @@
+FROM debian:bullseye-slim
+ENV DEBIAN_FRONTEND noninteractive
+ARG GRAV_VERSION=1.6.28
+
+ARG DEV_PKGS="zlib1g-dev libpng-dev libjpeg-dev libfreetype6-dev \
+	libcurl4-gnutls-dev libxml2-dev libonig-dev"
+	
+RUN apt-get update && \
+	apt-get install -y git bash procps wget unzip supervisor \
+					php-fpm php-gd php-json php-curl php-dom php-xml php-yaml php-apcu \
+					php-opcache php-simplexml php-zip php-mbstring cron \ 
+	&& mkdir /var/www \
+	&& chown www-data:www-data /var/www \
+	&& cd /var/www
+
+# CLeanup	
+RUN	apt-get remove -y --purge ${DEV_PKGS} exim4* && \
+	apt-get autoremove --purge -y && \
+	apt-get clean -y && \ 
+	rm -rf /var/lib/apt/lists/* && \
+	rm -rf /var/cache/apt/* /tmp/* /var/tmp/* /var/log/*
+
+RUN mkdir /run/php && \
+	chown www-data:www-data /var/log /run/php && \
+	mkdir -p /etc/php/7.4/fpm/pool.d
+ADD docker-entrypoint.sh /
+ADD supervisor.conf /etc/supervisor.conf
+
+ENTRYPOINT ["/docker-entrypoint.sh"]	
+
+#USER www-data
+RUN (crontab -l; echo "* * * * * cd /var/www/grav;/usr/bin/php bin/grav scheduler 1>> /dev/null 2>&1") | crontab -u www-data -
+#CMD ["dumb-init", "/usr/sbin/php-fpm7.3", "--nodaemonize", "--force-stderr"]
+CMD ["supervisord", "-c", "/etc/supervisor.conf"]

apps/web/grav/README.md

@@ -0,0 +1,3 @@
+lighttpd is configured in etc_lighttpd
+generate a configmap with:
+	kubectl create configmap grav-lighttpd-config --from-file etc_lighthttpd/

apps/web/grav/deployment.yaml

@@ -0,0 +1,104 @@
+---
+apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
+kind: Deployment
+metadata:
+  name: grav
+spec:
+  selector:
+    matchLabels:
+      app: grav
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: grav
+    spec:
+      containers:
+      - image: docker-registry.lan/grav:arm64
+        name: grav
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 9000
+          name: php-fpm
+        volumeMounts:
+        - name: grav-pages
+          mountPath: /var/www/grav
+        - name: grav-etc-php-fpm-www-conf
+          mountPath: /etc/php/7.4/fpm/pool.d
+      - image: nginx:alpine
+        name: nginx
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 80
+          name: http
+        volumeMounts:
+        - name: grav-nginx-proxy-config
+          mountPath: /etc/nginx/nginx.conf
+          subPath: nginx.conf
+        - name: grav-pages
+          mountPath: /var/www/grav
+      initContainers:
+      - name: grav-install
+        image: busybox
+        command: ["/bin/sh"]
+        args:
+         - -c
+         - >-
+           wget -O /grav.zip "https://getgrav.org/download/core/grav-admin/latest" &&
+           unzip -q /grav.zip &&
+           rm -rf grav-admin/user/pages/* &&
+           cp -ru grav-admin/* /workdir/ &&
+           rm -rf /grav.zip &&
+           rm -rf /grav-admin &&
+           chown -R 33:33 /workdir/*
+        volumeMounts:
+        - name: grav-pages
+          mountPath: /workdir
+      volumes:
+      - name: grav-pages
+        persistentVolumeClaim:
+          claimName: grav-pages
+      - name: grav-nginx-proxy-config
+        configMap:
+          name: grav-nginx-proxy-config
+      - name: grav-etc-php-fpm-www-conf
+        configMap:
+          name: grav-etc-php-fpm-www-conf
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: grav
+spec:
+  ports:
+  - name: http
+    port: 80
+  selector:
+    app: grav
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: grav
+spec:
+  rules:
+  - host: grav.lan
+    http:
+      paths:
+      - backend:
+          serviceName: grav
+          servicePort: http
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: grav-pages
+spec:
+  storageClassName: nfs-ssd
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 6Gi
+      

apps/web/grav/docker-entrypoint.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+exec "$@"

apps/web/grav/etc_php-fpm/www.conf

@@ -0,0 +1,440 @@
+; Start a new pool named 'www'.
+; the variable $pool can be used in any directive and will be replaced by the
+; pool name ('www' here)
+[www]
+
+; Per pool prefix
+; It only applies on the following directives:
+; - 'access.log'
+; - 'slowlog'
+; - 'listen' (unixsocket)
+; - 'chroot'
+; - 'chdir'
+; - 'php_values'
+; - 'php_admin_values'
+; When not set, the global prefix (or /usr) applies instead.
+; Note: This directive can also be relative to the global prefix.
+; Default Value: none
+;prefix = /path/to/pools/$pool
+
+; Unix user/group of processes
+; Note: The user is mandatory. If the group is not set, the default user's group
+;       will be used.
+user = www-data
+group = www-data
+
+; The address on which to accept FastCGI requests.
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Note: This value is mandatory.
+; listen = /run/php/php7.4-fpm.sock
+listen = 127.0.0.1:9000
+
+; Set listen(2) backlog.
+; Default Value: 511 (-1 on FreeBSD and OpenBSD)
+;listen.backlog = 511
+
+; Set permissions for unix socket, if one is used. In Linux, read/write
+; permissions must be set in order to allow connections from a web server. Many
+; BSD-derived systems allow connections regardless of permissions. The owner
+; and group can be specified either by name or by their numeric IDs.
+; Default Values: user and group are set as the running user
+;                 mode is set to 0660
+listen.owner = www-data
+listen.group = www-data
+;listen.mode = 0660
+; When POSIX Access Control Lists are supported you can set them using
+; these options, value is a comma separated list of user/group names.
+; When set, listen.owner and listen.group are ignored
+;listen.acl_users =
+;listen.acl_groups =
+
+; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
+; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
+; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
+; must be separated by a comma. If this value is left blank, connections will be
+; accepted from any ip address.
+; Default Value: any
+;listen.allowed_clients = 127.0.0.1
+
+; Specify the nice(2) priority to apply to the pool processes (only if set)
+; The value can vary from -19 (highest priority) to 20 (lower priority)
+; Note: - It will only work if the FPM master process is launched as root
+;       - The pool processes will inherit the master process priority
+;         unless it specified otherwise
+; Default Value: no set
+; process.priority = -19
+
+; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
+; or group is differrent than the master process user. It allows to create process
+; core dump and ptrace the process for the pool user.
+; Default Value: no
+; process.dumpable = yes
+
+; Choose how the process manager will control the number of child processes.
+; Possible Values:
+;   static  - a fixed number (pm.max_children) of child processes;
+;   dynamic - the number of child processes are set dynamically based on the
+;             following directives. With this process management, there will be
+;             always at least 1 children.
+;             pm.max_children      - the maximum number of children that can
+;                                    be alive at the same time.
+;             pm.start_servers     - the number of children created on startup.
+;             pm.min_spare_servers - the minimum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is less than this
+;                                    number then some children will be created.
+;             pm.max_spare_servers - the maximum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is greater than this
+;                                    number then some children will be killed.
+;  ondemand - no children are created at startup. Children will be forked when
+;             new requests will connect. The following parameter are used:
+;             pm.max_children           - the maximum number of children that
+;                                         can be alive at the same time.
+;             pm.process_idle_timeout   - The number of seconds after which
+;                                         an idle process will be killed.
+; Note: This value is mandatory.
+pm = dynamic
+
+; The number of child processes to be created when pm is set to 'static' and the
+; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
+; This value sets the limit on the number of simultaneous requests that will be
+; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
+; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
+; CGI. The below defaults are based on a server without much resources. Don't
+; forget to tweak pm.* to fit your needs.
+; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
+; Note: This value is mandatory.
+pm.max_children = 5
+
+; The number of child processes created on startup.
+; Note: Used only when pm is set to 'dynamic'
+; Default Value: (min_spare_servers + max_spare_servers) / 2
+pm.start_servers = 2
+
+; The desired minimum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.min_spare_servers = 1
+
+; The desired maximum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.max_spare_servers = 3
+
+; The number of seconds after which an idle process will be killed.
+; Note: Used only when pm is set to 'ondemand'
+; Default Value: 10s
+;pm.process_idle_timeout = 10s;
+
+; The number of requests each child process should execute before respawning.
+; This can be useful to work around memory leaks in 3rd party libraries. For
+; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
+; Default Value: 0
+;pm.max_requests = 500
+
+; The URI to view the FPM status page. If this value is not set, no URI will be
+; recognized as a status page. It shows the following informations:
+;   pool                 - the name of the pool;
+;   process manager      - static, dynamic or ondemand;
+;   start time           - the date and time FPM has started;
+;   start since          - number of seconds since FPM has started;
+;   accepted conn        - the number of request accepted by the pool;
+;   listen queue         - the number of request in the queue of pending
+;                          connections (see backlog in listen(2));
+;   max listen queue     - the maximum number of requests in the queue
+;                          of pending connections since FPM has started;
+;   listen queue len     - the size of the socket queue of pending connections;
+;   idle processes       - the number of idle processes;
+;   active processes     - the number of active processes;
+;   total processes      - the number of idle + active processes;
+;   max active processes - the maximum number of active processes since FPM
+;                          has started;
+;   max children reached - number of times, the process limit has been reached,
+;                          when pm tries to start more children (works only for
+;                          pm 'dynamic' and 'ondemand');
+; Value are updated in real time.
+; Example output:
+;   pool:                 www
+;   process manager:      static
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          62636
+;   accepted conn:        190460
+;   listen queue:         0
+;   max listen queue:     1
+;   listen queue len:     42
+;   idle processes:       4
+;   active processes:     11
+;   total processes:      15
+;   max active processes: 12
+;   max children reached: 0
+;
+; By default the status page output is formatted as text/plain. Passing either
+; 'html', 'xml' or 'json' in the query string will return the corresponding
+; output syntax. Example:
+;   http://www.foo.bar/status
+;   http://www.foo.bar/status?json
+;   http://www.foo.bar/status?html
+;   http://www.foo.bar/status?xml
+;
+; By default the status page only outputs short status. Passing 'full' in the
+; query string will also return status for each pool process.
+; Example:
+;   http://www.foo.bar/status?full
+;   http://www.foo.bar/status?json&full
+;   http://www.foo.bar/status?html&full
+;   http://www.foo.bar/status?xml&full
+; The Full status returns for each process:
+;   pid                  - the PID of the process;
+;   state                - the state of the process (Idle, Running, ...);
+;   start time           - the date and time the process has started;
+;   start since          - the number of seconds since the process has started;
+;   requests             - the number of requests the process has served;
+;   request duration     - the duration in µs of the requests;
+;   request method       - the request method (GET, POST, ...);
+;   request URI          - the request URI with the query string;
+;   content length       - the content length of the request (only with POST);
+;   user                 - the user (PHP_AUTH_USER) (or '-' if not set);
+;   script               - the main script called (or '-' if not set);
+;   last request cpu     - the %cpu the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because CPU calculation is done when the request
+;                          processing has terminated;
+;   last request memory  - the max amount of memory the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because memory calculation is done when the request
+;                          processing has terminated;
+; If the process is in Idle state, then informations are related to the
+; last request the process has served. Otherwise informations are related to
+; the current request being served.
+; Example output:
+;   ************************
+;   pid:                  31330
+;   state:                Running
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          63087
+;   requests:             12808
+;   request duration:     1250261
+;   request method:       GET
+;   request URI:          /test_mem.php?N=10000
+;   content length:       0
+;   user:                 -
+;   script:               /home/fat/web/docs/php/test_mem.php
+;   last request cpu:     0.00
+;   last request memory:  0
+;
+; Note: There is a real-time FPM status monitoring sample web page available
+;       It's available in: /usr/share/php/7.4/fpm/status.html
+;
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;pm.status_path = /status
+
+; The ping URI to call the monitoring page of FPM. If this value is not set, no
+; URI will be recognized as a ping page. This could be used to test from outside
+; that FPM is alive and responding, or to
+; - create a graph of FPM availability (rrd or such);
+; - remove a server from a group if it is not responding (load balancing);
+; - trigger alerts for the operating team (24/7).
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;ping.path = /ping
+
+; This directive may be used to customize the response of a ping request. The
+; response is formatted as text/plain with a 200 response code.
+; Default Value: pong
+;ping.response = pong
+
+; The access log file
+; Default: not set
+;access.log = log/$pool.access.log
+
+; The access log format.
+; The following syntax is allowed
+;  %%: the '%' character
+;  %C: %CPU used by the request
+;      it can accept the following format:
+;      - %{user}C for user CPU only
+;      - %{system}C for system CPU only
+;      - %{total}C  for user + system CPU (default)
+;  %d: time taken to serve the request
+;      it can accept the following format:
+;      - %{seconds}d (default)
+;      - %{miliseconds}d
+;      - %{mili}d
+;      - %{microseconds}d
+;      - %{micro}d
+;  %e: an environment variable (same as $_ENV or $_SERVER)
+;      it must be associated with embraces to specify the name of the env
+;      variable. Some exemples:
+;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
+;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
+;  %f: script filename
+;  %l: content-length of the request (for POST request only)
+;  %m: request method
+;  %M: peak of memory allocated by PHP
+;      it can accept the following format:
+;      - %{bytes}M (default)
+;      - %{kilobytes}M
+;      - %{kilo}M
+;      - %{megabytes}M
+;      - %{mega}M
+;  %n: pool name
+;  %o: output header
+;      it must be associated with embraces to specify the name of the header:
+;      - %{Content-Type}o
+;      - %{X-Powered-By}o
+;      - %{Transfert-Encoding}o
+;      - ....
+;  %p: PID of the child that serviced the request
+;  %P: PID of the parent of the child that serviced the request
+;  %q: the query string
+;  %Q: the '?' character if query string exists
+;  %r: the request URI (without the query string, see %q and %Q)
+;  %R: remote IP address
+;  %s: status (response code)
+;  %t: server time the request was received
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
+;  %T: time the log has been written (the request has finished)
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
+;  %u: remote user
+;
+; Default: "%R - %u %t \"%m %r\" %s"
+;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
+
+; The log file for slow requests
+; Default Value: not set
+; Note: slowlog is mandatory if request_slowlog_timeout is set
+;slowlog = log/$pool.log.slow
+
+; The timeout for serving a single request after which a PHP backtrace will be
+; dumped to the 'slowlog' file. A value of '0s' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_slowlog_timeout = 0
+
+; Depth of slow log stack trace.
+; Default Value: 20
+;request_slowlog_trace_depth = 20
+
+; The timeout for serving a single request after which the worker process will
+; be killed. This option should be used when the 'max_execution_time' ini option
+; does not stop script execution for some reason. A value of '0' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_terminate_timeout = 0
+
+; The timeout set by 'request_terminate_timeout' ini option is not engaged after
+; application calls 'fastcgi_finish_request' or when application has finished and
+; shutdown functions are being called (registered via register_shutdown_function).
+; This option will enable timeout limit to be applied unconditionally
+; even in such cases.
+; Default Value: no
+;request_terminate_timeout_track_finished = no
+
+; Set open file descriptor rlimit.
+; Default Value: system defined value
+;rlimit_files = 1024
+
+; Set max core size rlimit.
+; Possible Values: 'unlimited' or an integer greater or equal to 0
+; Default Value: system defined value
+;rlimit_core = 0
+
+; Chroot to this directory at the start. This value must be defined as an
+; absolute path. When this value is not set, chroot is not used.
+; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
+; of its subdirectories. If the pool prefix is not set, the global prefix
+; will be used instead.
+; Note: chrooting is a great security feature and should be used whenever
+;       possible. However, all PHP paths will be relative to the chroot
+;       (error_log, sessions.save_path, ...).
+; Default Value: not set
+;chroot =
+
+; Chdir to this directory at the start.
+; Note: relative path can be used.
+; Default Value: current directory or / when chroot
+;chdir = /var/www
+
+; Redirect worker stdout and stderr into main error log. If not set, stdout and
+; stderr will be redirected to /dev/null according to FastCGI specs.
+; Note: on highloaded environement, this can cause some delay in the page
+; process time (several ms).
+; Default Value: no
+;catch_workers_output = yes
+
+; Decorate worker output with prefix and suffix containing information about
+; the child that writes to the log and if stdout or stderr is used as well as
+; log level and time. This options is used only if catch_workers_output is yes.
+; Settings to "no" will output data as written to the stdout or stderr.
+; Default value: yes
+;decorate_workers_output = no
+
+; Clear environment in FPM workers
+; Prevents arbitrary environment variables from reaching FPM worker processes
+; by clearing the environment in workers before env vars specified in this
+; pool configuration are added.
+; Setting to "no" will make all environment variables available to PHP code
+; via getenv(), $_ENV and $_SERVER.
+; Default Value: yes
+;clear_env = no
+
+; Limits the extensions of the main script FPM will allow to parse. This can
+; prevent configuration mistakes on the web server side. You should only limit
+; FPM to .php extensions to prevent malicious users to use other extensions to
+; execute php code.
+; Note: set an empty value to allow all extensions.
+; Default Value: .php
+;security.limit_extensions = .php .php3 .php4 .php5 .php7
+
+; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
+; the current environment.
+; Default Value: clean env
+;env[HOSTNAME] = $HOSTNAME
+;env[PATH] = /usr/local/bin:/usr/bin:/bin
+;env[TMP] = /tmp
+;env[TMPDIR] = /tmp
+;env[TEMP] = /tmp
+
+; Additional php.ini defines, specific to this pool of workers. These settings
+; overwrite the values previously defined in the php.ini. The directives are the
+; same as the PHP SAPI:
+;   php_value/php_flag             - you can set classic ini defines which can
+;                                    be overwritten from PHP call 'ini_set'.
+;   php_admin_value/php_admin_flag - these directives won't be overwritten by
+;                                     PHP call 'ini_set'
+; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
+
+; Defining 'extension' will load the corresponding shared extension from
+; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
+; overwrite previously defined php.ini values, but will append the new value
+; instead.
+
+; Note: path INI options can be relative and will be expanded with the prefix
+; (pool, global or /usr)
+
+; Default Value: nothing is defined by default except the values in php.ini and
+;                specified at startup with the -d argument
+;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
+;php_flag[display_errors] = off
+;php_admin_value[error_log] = /var/log/fpm-php.www.log
+;php_admin_flag[log_errors] = on
+;php_admin_value[memory_limit] = 32M

apps/web/grav/nginx.conf.yaml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grav-nginx-proxy-config
+data:
+  nginx.conf: |-
+    user  nginx;
+    worker_processes  1;
+
+    error_log  /var/log/nginx/error.log warn;
+    pid        /var/run/nginx.pid;
+
+    events {
+        worker_connections  64;
+    }
+
+    http {
+        include       /etc/nginx/mime.types;
+        default_type  application/octet-stream;
+
+        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+                          '$status $body_bytes_sent "$http_referer" '
+                          '"$http_user_agent" "$http_x_forwarded_for"';
+
+        access_log  off; 
+        #access_log /var/log/nginx/access.log  main;
+
+        sendfile        on;
+        keepalive_timeout  65;
+
+        server {
+            listen 80;
+            server_name _;
+            index index.html index.php;
+            root /var/www/grav;
+            ## Begin - Index
+            # for subfolders, simply adjust:
+            # `location /subfolder {`
+            # and the rewrite to use `/subfolder/index.php`
+            location / {
+                try_files $uri $uri/ /index.php?$query_string;
+            }
+            ## End - Index
+        
+            ## Begin - Security
+            # deny all direct access for these folders
+            location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
+            # deny running scripts inside core system folders
+            location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
+            # deny running scripts inside user folder
+            location ~* /user/.*\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
+            # deny access to specific files in the root folder
+            location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
+            ## End - Security
+        
+            ## Begin - PHP
+            location ~ \.php$ {
+                # Choose either a socket or TCP/IP address
+                fastcgi_pass 127.0.0.1:9000;
+        
+                fastcgi_split_path_info ^(.+\.php)(/.+)$;
+                fastcgi_index index.php;
+                include fastcgi_params;
+                fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
+            }
+            ## End - PHP
+        }
+    }

apps/web/grav/supervisor.conf

@@ -0,0 +1,14 @@
+[supervisord]
+nodaemon=true
+
+[program:cron]
+command=/usr/sbin/cron
+killasgroup=true
+stopasgroup=true
+redirect_stderr=true
+user=root
+
+
+[program:php-fpm]
+command=/usr/sbin/php-fpm7.4 --nodaemonize --force-stderr
+user=www-data

apps/web/nginx-test-deployment.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: nginx-deployment
+  template:
+    metadata:
+      labels:
+        run: nginx-deployment
+    spec:
+      containers:
+      - image: nginx
+        name: nginx-webserver
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx-service
+spec:
+  type: NodePort
+  selector:
+    run: nginx-deployment
+  ports:
+    - port: 80
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: nginx-test
+spec:
+  rules:
+  - host: nginx-test.lan
+    http:
+      paths:
+      - backend:
+          serviceName: nginx-service
+          servicePort: 80

apps/web/rompr/deployment.yaml

@@ -0,0 +1,81 @@
+---
+apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
+kind: Deployment
+metadata:
+  name: rompr
+spec:
+  selector:
+    matchLabels:
+      app: rompr
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: rompr
+    spec:
+      containers:
+      - image: docker-registry.lan/rompr:arm64
+        name: rompr
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 9000
+          name: php-fpm
+        volumeMounts:
+        - name: rompr-data
+          mountPath: /rompr
+      - image: sebp/lighttpd:latest
+        name: lighttpd
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 80
+          name: http
+        volumeMounts:
+        - name: rompr-data
+          mountPath: /rompr
+        - name: rompr-lighttpd-config
+          mountPath: /etc/lighttpd
+      volumes:
+      - name: rompr-data
+        persistentVolumeClaim:
+          claimName: rompr-data
+      - name: rompr-lighttpd-config
+        configMap:
+          name: rompr-lighttpd-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: rompr
+spec:
+  ports:
+  - name: http
+    port: 80
+  selector:
+    app: rompr
+---
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: rompr
+spec:
+  rules:
+  - host: musik.lan
+    http:
+      paths:
+      - backend:
+          serviceName: rompr
+          servicePort: http
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: rompr-data
+spec:
+  storageClassName: nfs-ssd
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 6Gi
+      

prometheus/additional-scrape-configs.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 data:
-  prometheus-additional.yaml: LSBqb2JfbmFtZTogbXlzcWxkCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBtYXJpYWRiLmxhbjo5MTA0Ci0gam9iX25hbWU6IG1xdHQubW9zcXVpdHRvCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBtcXR0Lmxhbjo5MjM0Ci0gam9iX25hbWU6IGhhcHJveHkKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGRydWNraS5jaGFvczo5MTAxCiAgICAtIHJpb3QwMS5jaGFvczo5MTAxCiAgICAtIGF1dG86OTEwMQotIGpvYl9uYW1lOiBrbGlwcGVyCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBkcnVja2kuY2hhb3M6MzkwMwotIGpvYl9uYW1lOiBvY3RvcHJpbnQKICBtZXRyaWNzX3BhdGg6IC9wbHVnaW4vcHJvbWV0aGV1c19leHBvcnRlci9tZXRyaWNzCiAgcGFyYW1zOgogICAgYXBpa2V5OgogICAgLSAzMEU4QjAxQkZENjc0RTVCQkQ0NDZEMDhDNDczMERGNAogIHN0YXRpY19jb25maWdzOgogIC0gdGFyZ2V0czoKICAgIC0gZHJ1Y2tpLmNoYW9zOjgwCi0gam9iX25hbWU6IG9wZW5oYWIyCiAgbWV0cmljc19wYXRoOiAvCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBhdXRvLmNoYW9zOjk5OTkKLSBqb2JfbmFtZTogbm9kZQogIHN0YXRpY19jb25maWdzOgogIC0gdGFyZ2V0czoKICAgIC0gZHVtb250LmNoYW9zOjkxMDAKICAgIC0gYXV0bzAxOjkxMDAKICAgIC0gZHJ1Y2tpLmNoYW9zOjkxMDAKICAgIC0gZWJpbjAxLmNoYW9zOjkxMDAKICAgIC0gZWJpbjAyLmNoYW9zOjkxMDAKICAgIC0gbGVubnkuY2hhb3M6OTEwMAogICAgLSByaW90MDEuY2hhb3M6OTEwMAogICAgLSB0cnVoZTo5MTAwCiAgICAtIHR1bW9yLmNoYW9zOjkxMDAKICAgIC0gd29obno6OTEwMAogICAgLSB5b3JpLmNoYW9zOjkxMDAK
+  prometheus-additional.yaml: LSBqb2JfbmFtZTogZ2l0ZWEKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGdpdC11aS5sYW4KLSBqb2JfbmFtZTogbmdpbngKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGF1dG8uY2hhb3M6OTExMwotIGpvYl9uYW1lOiBteXNxbGQKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIG1hcmlhZGIubGFuOjkxMDQKLSBqb2JfbmFtZTogbXF0dC5tb3NxdWl0dG8KICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIG1xdHQubGFuOjkyMzQKLSBqb2JfbmFtZTogaGFwcm94eQogIHN0YXRpY19jb25maWdzOgogIC0gdGFyZ2V0czoKICAgIC0gZHJ1Y2tpLndrczo5MTAxCi0gam9iX25hbWU6IGtsaXBwZXIKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGRydWNraS53a3M6MzkwMwotIGpvYl9uYW1lOiBvY3RvcHJpbnQKICBtZXRyaWNzX3BhdGg6IC9wbHVnaW4vcHJvbWV0aGV1c19leHBvcnRlci9tZXRyaWNzCiAgcGFyYW1zOgogICAgYXBpa2V5OgogICAgLSAzMEU4QjAxQkZENjc0RTVCQkQ0NDZEMDhDNDczMERGNAogIHN0YXRpY19jb25maWdzOgogIC0gdGFyZ2V0czoKICAgIC0gZHJ1Y2tpLndrczo4MAotIGpvYl9uYW1lOiBvcGVuaGFiMgogIG1ldHJpY3NfcGF0aDogLwogIHN0YXRpY19jb25maWdzOgogIC0gdGFyZ2V0czoKICAgIC0gYXV0by5jaGFvczo5OTk5Ci0gam9iX25hbWU6IG5vZGUKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGR1bW9udC5jaGFvczo5MTAwCiAgICAtIGR1bW9udC53a3M6OTEwMAogICAgLSBhdXRvMDE6OTEwMAogICAgLSBkcnVja2kud2tzOjkxMDAKICAgIC0gZWJpbjAxLmNoYW9zOjkxMDAKICAgIC0gZWJpbjAyLmNoYW9zOjkxMDAKICAgIC0gcmlvdDAxLmNoYW9zOjkxMDAKICAgIC0gdHJ1aGU6OTEwMAogICAgLSB0dW1vci5jaGFvczo5MTAwCiAgICAtIHdvaG56OjkxMDAKICAgIC0geW9yaS5jaGFvczo5MTAwCg==
 kind: Secret
 metadata:
   creationTimestamp: null

prometheus/prometheus-additional.yaml

@@ -1,3 +1,11 @@
+- job_name: gitea
+  static_configs:
+  - targets:
+    - git-ui.lan
+- job_name: nginx
+  static_configs:
+  - targets:
+    - auto.chaos:9113
 - job_name: mysqld
   static_configs:
   - targets:
@@ -9,13 +17,11 @@
 - job_name: haproxy
   static_configs:
   - targets:
-    - drucki.chaos:9101
+    - drucki.wks:9101
-    - riot01.chaos:9101
-    - auto:9101
 - job_name: klipper
   static_configs:
   - targets:
-    - drucki.chaos:3903
+    - drucki.wks:3903
 - job_name: octoprint
   metrics_path: /plugin/prometheus_exporter/metrics
   params:
@@ -23,7 +29,7 @@
     - 30E8B01BFD674E5BBD446D08C4730DF4
   static_configs:
   - targets:
-    - drucki.chaos:80
+    - drucki.wks:80
 - job_name: openhab2
   metrics_path: /
   static_configs:
@@ -33,11 +39,11 @@
   static_configs:
   - targets:
     - dumont.chaos:9100
+    - dumont.wks:9100
     - auto01:9100
-    - drucki.chaos:9100
+    - drucki.wks:9100
     - ebin01.chaos:9100
     - ebin02.chaos:9100
-    - lenny.chaos:9100
     - riot01.chaos:9100
     - truhe:9100
     - tumor.chaos:9100