aly.codes / infra
Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform. cute.haus
ansible terraform nix k8s
1
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

cleanup charts etc into k8s/

Aly Raffauf (May 9, 2026, 9:31 AM EDT) 01c51ce1 255f54b2

+58 -122
+1 -1
.gitignore
··· 7 7 result 8 8 9 9 # Materialized helm subchart deps (regenerated by helmfile) 10 - charts/*/charts/ 10 + k8s/charts/*/charts/
+4 -29
.justfile
··· 89 89 deploy jobs='': 90 90 nynx --operation switch {{ if jobs == "" { "" } else { "--jobs " + jobs } }} 91 91 92 - # Pull latest aly.codes OCI on solaceon. 93 - [group('servers')] 94 - update-alycodes: 95 - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-alycodes.yml 96 - 97 - # Pull latest morsels OCI on eterna. 98 - [group('servers')] 99 - update-morsels: 100 - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-morsels.yml 101 - 102 - # Pull latest myAtmosphere OCI on solaceon. 103 - [group('servers')] 104 - update-myatmosphere: 105 - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-myatmosphere.yml 106 - 107 - # Pull latest atbbs OCI on eterna. 108 - [group('servers')] 109 - update-atbbs: 110 - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-atbbs.yml 111 - 112 - # Pull latest watsup OCI on solaceon. 113 - [group('servers')] 114 - update-watsup: 115 - ansible-playbook -i ansible/inventory.ini ansible/playbooks/restart-watsup.yml 116 - 117 92 # Reboot all servers. 118 93 [group('servers')] 119 94 reboot: ··· 176 151 # 177 152 ############################################################################ 178 153 179 - # Scaffold a new app chart under charts/<name>. After running, edit the 180 - # values.yaml and add a release block to helmfile.yaml. See charts/README.md. 154 + # Scaffold a new app chart under k8s/charts/<name>. After running, edit the 155 + # values.yaml and add a release block to k8s/helmfile.yaml. See k8s/charts/README.md. 181 156 [group('kubes')] 182 157 new-app NAME: 183 158 #!/usr/bin/env bash 184 159 set -euo pipefail 185 - DIR="charts/{{ NAME }}" 160 + DIR="k8s/charts/{{ NAME }}" 186 161 if [[ -e "$DIR" ]]; then 187 162 echo "$DIR already exists; aborting." >&2 188 163 exit 1 ··· 240 215 echo '{{{{- include "common.'"$kind"'" . }}}}' > "$DIR/templates/$kind.yaml" 241 216 done 242 217 helm dependency update "$DIR" >/dev/null 243 - echo "scaffolded $DIR. next: edit values.yaml and add a release to helmfile.yaml." 218 + echo "scaffolded $DIR. next: edit values.yaml and add a release to k8s/helmfile.yaml."
+1 -1
.prettierignore
··· 1 1 .github 2 2 flake.lock 3 - charts/*/templates 3 + k8s/charts/*/templates
+7 -3
README.md
··· 26 26 ```plaintext 27 27 . 28 28 ├── flake.nix # Flake entry point 29 - ├── helmfile.yaml # k3s release graph (helmfile + helm + vals) 30 29 ├── homes/ # home-manager configurations 31 30 ├── hosts/ # NixOS host configurations 32 31 ├── modules/ # NixOS / home-manager / flake modules 33 32 ├── overlays/ # Custom Nixpkgs overlays 34 - ├── charts/ # In-tree helm charts (see charts/README.md) 35 - ├── values/ # Per-chart vals refs into secrets/ (see values/README.md) 33 + ├── k8s/ # k3s: helmfile + in-tree charts + vals overlays 34 + │ ├── helmfile.yaml # release graph (helmfile + helm + vals) 35 + │ ├── charts/ # In-tree helm charts (see k8s/charts/README.md) 36 + │ └── values/ # Per-chart vals refs into ../secrets/ 36 37 ├── secrets/ # SOPS-encrypted yaml (multi-recipient age) 38 + ├── publicKeys/ # Per-host + per-user age recipients 39 + ├── terraform/ # Cloudflare DNS, etc. 40 + ├── ansible/ # Server playbooks (deploy-offline, reboots) 37 41 └── BACKUPS.md # B2 backup + restore runbook (CNPG + Longhorn) 38 42 ``` 39 43
-8
ansible/playbooks/restart-alycodes.yml
··· 1 - - hosts: solaceon 2 - remote_user: root 3 - 4 - tasks: 5 - - name: Restart podman-alycodes 6 - ansible.builtin.systemd_service: 7 - name: podman-alycodes 8 - state: restarted
-11
ansible/playbooks/restart-atbbs.yml
··· 1 - - hosts: eterna 2 - remote_user: root 3 - 4 - tasks: 5 - - name: Restart podman-atbbs 6 - ansible.builtin.systemd_service: 7 - name: "{{ item }}" 8 - state: restarted 9 - loop: 10 - - podman-atbbs 11 - - podman-atbbs-telnet
-8
ansible/playbooks/restart-morsels.yml
··· 1 - - hosts: eterna 2 - remote_user: root 3 - 4 - tasks: 5 - - name: Restart podman-morsels 6 - ansible.builtin.systemd_service: 7 - name: podman-morsels 8 - state: restarted
-8
ansible/playbooks/restart-myatmosphere.yml
··· 1 - - hosts: solaceon 2 - remote_user: root 3 - 4 - tasks: 5 - - name: Restart podman-myaymosphere 6 - ansible.builtin.systemd_service: 7 - name: podman-myatmosphere 8 - state: restarted
-8
ansible/playbooks/restart-watsup.yml
··· 1 - - hosts: solaceon 2 - remote_user: root 3 - 4 - tasks: 5 - - name: Restart podman-watsup 6 - ansible.builtin.systemd_service: 7 - name: podman-watsup 8 - state: restarted
+2 -2
charts/README.md k8s/charts/README.md
··· 69 69 ``` 70 70 3. If the app needs secrets: 71 71 - `just sops-edit <name>.yaml` — write the encrypted file 72 - - Create `values/<name>.yaml` with `ref+sops://secrets/<name>.yaml#/...` 73 - refs for each key 72 + - Create `values/<name>.yaml` with `ref+sops://../secrets/<name>.yaml#/...` 73 + refs for each key (path is relative to `k8s/`, where helmfile runs) 74 74 - Add `values: [values/<name>.yaml]` to the helmfile release 75 75 4. `helmfile -l name=<name> apply` 76 76
charts/aly-codes/Chart.lock k8s/charts/aly-codes/Chart.lock
charts/aly-codes/Chart.yaml k8s/charts/aly-codes/Chart.yaml
charts/aly-codes/templates/deployment.yaml k8s/charts/aly-codes/templates/deployment.yaml
charts/aly-codes/templates/ingress.yaml k8s/charts/aly-codes/templates/ingress.yaml
charts/aly-codes/templates/service.yaml k8s/charts/aly-codes/templates/service.yaml
charts/aly-codes/values.yaml k8s/charts/aly-codes/values.yaml
charts/bluesky-pds/Chart.lock k8s/charts/bluesky-pds/Chart.lock
charts/bluesky-pds/Chart.yaml k8s/charts/bluesky-pds/Chart.yaml
charts/bluesky-pds/templates/deployment.yaml k8s/charts/bluesky-pds/templates/deployment.yaml
charts/bluesky-pds/templates/ingress.yaml k8s/charts/bluesky-pds/templates/ingress.yaml
charts/bluesky-pds/templates/pvc.yaml k8s/charts/bluesky-pds/templates/pvc.yaml
charts/bluesky-pds/templates/secret.yaml k8s/charts/bluesky-pds/templates/secret.yaml
charts/bluesky-pds/templates/service.yaml k8s/charts/bluesky-pds/templates/service.yaml
charts/bluesky-pds/values.yaml k8s/charts/bluesky-pds/values.yaml
charts/cluster-tls/Chart.yaml k8s/charts/cluster-tls/Chart.yaml
charts/cluster-tls/templates/secrets.yaml k8s/charts/cluster-tls/templates/secrets.yaml
charts/cluster-tls/values.yaml k8s/charts/cluster-tls/values.yaml
charts/common/Chart.yaml k8s/charts/common/Chart.yaml
charts/common/README.md k8s/charts/common/README.md
charts/common/templates/_deployment.tpl k8s/charts/common/templates/_deployment.tpl
charts/common/templates/_ingress.tpl k8s/charts/common/templates/_ingress.tpl
charts/common/templates/_pvc.tpl k8s/charts/common/templates/_pvc.tpl
charts/common/templates/_secret.tpl k8s/charts/common/templates/_secret.tpl
charts/common/templates/_service.tpl k8s/charts/common/templates/_service.tpl
charts/external-routes/Chart.yaml k8s/charts/external-routes/Chart.yaml
charts/external-routes/templates/routes.yaml k8s/charts/external-routes/templates/routes.yaml
charts/external-routes/values.yaml k8s/charts/external-routes/values.yaml
charts/forgejo/Chart.lock k8s/charts/forgejo/Chart.lock
charts/forgejo/Chart.yaml k8s/charts/forgejo/Chart.yaml
charts/forgejo/templates/deployment.yaml k8s/charts/forgejo/templates/deployment.yaml
charts/forgejo/templates/ingress.yaml k8s/charts/forgejo/templates/ingress.yaml
charts/forgejo/templates/pvc.yaml k8s/charts/forgejo/templates/pvc.yaml
charts/forgejo/templates/service.yaml k8s/charts/forgejo/templates/service.yaml
charts/forgejo/values.yaml k8s/charts/forgejo/values.yaml
charts/longhorn-creds/Chart.yaml k8s/charts/longhorn-creds/Chart.yaml
charts/longhorn-creds/templates/recurring-job.yaml k8s/charts/longhorn-creds/templates/recurring-job.yaml
charts/longhorn-creds/templates/secret.yaml k8s/charts/longhorn-creds/templates/secret.yaml
charts/longhorn-creds/templates/ui-ingress.yaml k8s/charts/longhorn-creds/templates/ui-ingress.yaml
charts/longhorn-creds/values.yaml k8s/charts/longhorn-creds/values.yaml
charts/morsels/Chart.lock k8s/charts/morsels/Chart.lock
charts/morsels/Chart.yaml k8s/charts/morsels/Chart.yaml
charts/morsels/templates/deployment.yaml k8s/charts/morsels/templates/deployment.yaml
charts/morsels/templates/ingress.yaml k8s/charts/morsels/templates/ingress.yaml
charts/morsels/templates/pvc.yaml k8s/charts/morsels/templates/pvc.yaml
charts/morsels/templates/service.yaml k8s/charts/morsels/templates/service.yaml
charts/morsels/values.yaml k8s/charts/morsels/values.yaml
charts/pg-shared/Chart.yaml k8s/charts/pg-shared/Chart.yaml
charts/pg-shared/templates/b2-creds.yaml k8s/charts/pg-shared/templates/b2-creds.yaml
charts/pg-shared/templates/cluster.yaml k8s/charts/pg-shared/templates/cluster.yaml
charts/pg-shared/templates/scheduled-backup.yaml k8s/charts/pg-shared/templates/scheduled-backup.yaml
charts/pg-shared/templates/storageclass.yaml k8s/charts/pg-shared/templates/storageclass.yaml
charts/pg-shared/values.yaml k8s/charts/pg-shared/values.yaml
charts/uptime-kuma/Chart.lock k8s/charts/uptime-kuma/Chart.lock
charts/uptime-kuma/Chart.yaml k8s/charts/uptime-kuma/Chart.yaml
charts/uptime-kuma/templates/deployment.yaml k8s/charts/uptime-kuma/templates/deployment.yaml
charts/uptime-kuma/templates/ingress.yaml k8s/charts/uptime-kuma/templates/ingress.yaml
charts/uptime-kuma/templates/pvc.yaml k8s/charts/uptime-kuma/templates/pvc.yaml
charts/uptime-kuma/templates/service.yaml k8s/charts/uptime-kuma/templates/service.yaml
charts/uptime-kuma/values.yaml k8s/charts/uptime-kuma/values.yaml
charts/vaultwarden/Chart.lock k8s/charts/vaultwarden/Chart.lock
charts/vaultwarden/Chart.yaml k8s/charts/vaultwarden/Chart.yaml
charts/vaultwarden/templates/deployment.yaml k8s/charts/vaultwarden/templates/deployment.yaml
charts/vaultwarden/templates/ingress.yaml k8s/charts/vaultwarden/templates/ingress.yaml
charts/vaultwarden/templates/pvc.yaml k8s/charts/vaultwarden/templates/pvc.yaml
charts/vaultwarden/templates/secret.yaml k8s/charts/vaultwarden/templates/secret.yaml
charts/vaultwarden/templates/service.yaml k8s/charts/vaultwarden/templates/service.yaml
charts/vaultwarden/values.yaml k8s/charts/vaultwarden/values.yaml
charts/watsup/Chart.lock k8s/charts/watsup/Chart.lock
charts/watsup/Chart.yaml k8s/charts/watsup/Chart.yaml
charts/watsup/templates/deployment.yaml k8s/charts/watsup/templates/deployment.yaml
charts/watsup/templates/ingress.yaml k8s/charts/watsup/templates/ingress.yaml
charts/watsup/templates/service.yaml k8s/charts/watsup/templates/service.yaml
charts/watsup/values.yaml k8s/charts/watsup/values.yaml
helmfile.yaml k8s/helmfile.yaml
+6
k8s/values/secrets/bluesky-pds.yaml
··· 1 + secret: 2 + PDS_ADMIN_PASSWORD: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_ADMIN_PASSWORD 3 + PDS_EMAIL_FROM_ADDRESS: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_EMAIL_FROM_ADDRESS 4 + PDS_EMAIL_SMTP_URL: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_EMAIL_SMTP_URL 5 + PDS_JWT_SECRET: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_JWT_SECRET 6 + PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ref+sops://../secrets/bluesky-pds.yaml#/secret/PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
+13
k8s/values/secrets/cluster-tls.yaml
··· 1 + secret: 2 + aly-codes: 3 + crt: ref+sops://../secrets/cluster-tls.yaml#/secret/aly-codes/crt 4 + key: ref+sops://../secrets/cluster-tls.yaml#/secret/aly-codes/key 5 + aly-social: 6 + crt: ref+sops://../secrets/cluster-tls.yaml#/secret/aly-social/crt 7 + key: ref+sops://../secrets/cluster-tls.yaml#/secret/aly-social/key 8 + cute-haus: 9 + crt: ref+sops://../secrets/cluster-tls.yaml#/secret/cute-haus/crt 10 + key: ref+sops://../secrets/cluster-tls.yaml#/secret/cute-haus/key 11 + morsels-blue: 12 + crt: ref+sops://../secrets/cluster-tls.yaml#/secret/morsels-blue/crt 13 + key: ref+sops://../secrets/cluster-tls.yaml#/secret/morsels-blue/key
+3
k8s/values/secrets/longhorn-creds.yaml
··· 1 + secret: 2 + keyId: ref+sops://../secrets/b2.yaml#/B2_KEY_ID 3 + appKey: ref+sops://../secrets/b2.yaml#/B2_APP_KEY
+5
k8s/values/secrets/pg-shared.yaml
··· 1 + backup: 2 + enabled: true 3 + b2: 4 + keyId: ref+sops://../secrets/b2.yaml#/B2_KEY_ID 5 + appKey: ref+sops://../secrets/b2.yaml#/B2_APP_KEY
+7
k8s/values/secrets/tailscale-operator.yaml
··· 1 + oauth: 2 + clientId: ref+sops://../secrets/tailscale-operator.yaml#/secret/CLIENT_ID 3 + clientSecret: ref+sops://../secrets/tailscale-operator.yaml#/secret/CLIENT_SECRET 4 + 5 + operatorConfig: 6 + defaultTags: 7 + - tag:k8s
+7
k8s/values/secrets/vaultwarden.yaml
··· 1 + secret: 2 + ADMIN_TOKEN: ref+sops://../secrets/vaultwarden.yaml#/secret/ADMIN_TOKEN 3 + SMTP_FROM: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_FROM 4 + SMTP_HOST: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_HOST 5 + SMTP_PASSWORD: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_PASSWORD 6 + SMTP_PORT: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_PORT 7 + SMTP_USERNAME: ref+sops://../secrets/vaultwarden.yaml#/secret/SMTP_USERNAME
+2 -2
values/README.md k8s/values/README.md
··· 4 4 5 5 ``` 6 6 values/ 7 - └── secrets/ # vals refs (ref+sops://) into ../secrets/ 7 + └── secrets/ # vals refs (ref+sops://) into ../../secrets/ 8 8 ``` 9 9 10 10 Each file under `secrets/` is plain yaml containing only `vals` refs that 11 - point into [`../secrets/`](../secrets/) for the actual encrypted values. 11 + point into [`../../secrets/`](../../secrets/) for the actual encrypted values. 12 12 helmfile passes these as `values:` to a release; `vals` resolves the refs 13 13 at render time (SOPS-decrypts → splices into the values stream → helm 14 14 renders).
-6
values/secrets/bluesky-pds.yaml
··· 1 - secret: 2 - PDS_ADMIN_PASSWORD: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_ADMIN_PASSWORD 3 - PDS_EMAIL_FROM_ADDRESS: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_EMAIL_FROM_ADDRESS 4 - PDS_EMAIL_SMTP_URL: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_EMAIL_SMTP_URL 5 - PDS_JWT_SECRET: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_JWT_SECRET 6 - PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ref+sops://secrets/bluesky-pds.yaml#/secret/PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
-13
values/secrets/cluster-tls.yaml
··· 1 - secret: 2 - aly-codes: 3 - crt: ref+sops://secrets/cluster-tls.yaml#/secret/aly-codes/crt 4 - key: ref+sops://secrets/cluster-tls.yaml#/secret/aly-codes/key 5 - aly-social: 6 - crt: ref+sops://secrets/cluster-tls.yaml#/secret/aly-social/crt 7 - key: ref+sops://secrets/cluster-tls.yaml#/secret/aly-social/key 8 - cute-haus: 9 - crt: ref+sops://secrets/cluster-tls.yaml#/secret/cute-haus/crt 10 - key: ref+sops://secrets/cluster-tls.yaml#/secret/cute-haus/key 11 - morsels-blue: 12 - crt: ref+sops://secrets/cluster-tls.yaml#/secret/morsels-blue/crt 13 - key: ref+sops://secrets/cluster-tls.yaml#/secret/morsels-blue/key
-3
values/secrets/longhorn-creds.yaml
··· 1 - secret: 2 - keyId: ref+sops://secrets/b2.yaml#/B2_KEY_ID 3 - appKey: ref+sops://secrets/b2.yaml#/B2_APP_KEY
-5
values/secrets/pg-shared.yaml
··· 1 - backup: 2 - enabled: true 3 - b2: 4 - keyId: ref+sops://secrets/b2.yaml#/B2_KEY_ID 5 - appKey: ref+sops://secrets/b2.yaml#/B2_APP_KEY
-7
values/secrets/tailscale-operator.yaml
··· 1 - oauth: 2 - clientId: ref+sops://secrets/tailscale-operator.yaml#/secret/CLIENT_ID 3 - clientSecret: ref+sops://secrets/tailscale-operator.yaml#/secret/CLIENT_SECRET 4 - 5 - operatorConfig: 6 - defaultTags: 7 - - tag:k8s
-7
values/secrets/vaultwarden.yaml
··· 1 - secret: 2 - ADMIN_TOKEN: ref+sops://secrets/vaultwarden.yaml#/secret/ADMIN_TOKEN 3 - SMTP_FROM: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_FROM 4 - SMTP_HOST: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_HOST 5 - SMTP_PASSWORD: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_PASSWORD 6 - SMTP_PORT: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_PORT 7 - SMTP_USERNAME: ref+sops://secrets/vaultwarden.yaml#/secret/SMTP_USERNAME