+5 -1

README.md

Reviewed

··· 1 1 # Infrastructure 2 2 3 3 - Scaffoldable Kubernetes platform on Hetzner with a terraform/terragrunt iac setup + applications argocd layer. 3 3 + IaC repo for my personal Infrastructure. 4 4 + 5 5 + Uses both Hetzner Cloud and Proxmox VMs to provision a Talos k8s Cluster with ArgoCD. 6 6 + 7 7 + Additionally includes applications for ArgoCD to deploy.

applications/_generators/blueprints-aggregator.sh

Reviewed

+3 -3

applications/storage/rook/_parked/README.md

Reviewed

··· 15 15 16 16 ## What's here 17 17 18 18 - - `saml.yaml` — Authentik SAML provider + `ceph` application blueprint (valid; 18 18 + - `saml.yaml`: Authentik SAML provider + `ceph` application blueprint (valid, 19 19 all `!Find` names verified against live Authentik, `sign_assertion: true`). 20 20 - - `dashboard-sso.yaml` — Job (+ RBAC) that execs the toolbox to run 20 20 + - `dashboard-sso.yaml`: Job (+ RBAC) that execs the toolbox to run 21 21 `ceph dashboard sso setup saml2` / `enable` and pre-create the admin user. 22 22 23 23 ## To resume (end-to-end TLS, re-encrypt) ··· 37 37 `../`, re-add it to `../kustomization.yaml`. 38 38 39 39 Alternative if e2e-TLS isn't worth the cert maintenance: front the dashboard with 40 40 - oauth2-proxy (Authentik OIDC) again — robust, but a second Ceph login. 40 40 + oauth2-proxy (Authentik OIDC) again, which is robust but means a second Ceph login.

setup/upload-talos-image.sh

Reviewed

terragrunt/cluster/scripts/apply-cilium-lb-pool.sh

Reviewed

terragrunt/cluster/scripts/wait-and-untaint.sh

Reviewed

terragrunt/cluster/scripts/wait-for-cluster.sh

Reviewed

terragrunt/cluster/scripts/wait-for-maintenance.sh

Reviewed