updates

home/cluster/cert-manager-clusterissuer.yaml

@@ -0,0 +1,29 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: graham@w5isp.com  # Change this to your email
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+    - http01:
+        ingress:
+          class: traefik
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: graham@w5isp.com  # Change this to your email
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+    - http01:
+        ingress:
+          class: traefik

home/cluster/forgejo/configmap.yaml

@@ -13,7 +13,7 @@ data:
     DOMAIN = git.w5isp.com
     ROOT_URL = https://git.w5isp.com/
     HTTP_PORT = 3000
-    SSH_DOMAIN = git.w5isp.com
+    SSH_DOMAIN = 10.0.101.31
     SSH_PORT = 22
     START_SSH_SERVER = true
     SSH_LISTEN_PORT = 22

home/cluster/n8n/deploy.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+
+echo "Deploying n8n to k3s cluster..."
+
+# Create namespace
+kubectl apply -f namespace.yaml
+
+# Deploy PostgreSQL
+kubectl apply -f secret.yaml
+kubectl apply -f postgres-pvc.yaml
+kubectl apply -f postgres-deployment.yaml
+
+# Wait for PostgreSQL to be ready
+echo "Waiting for PostgreSQL to be ready..."
+kubectl wait --for=condition=ready pod -l app=postgres -n n8n --timeout=300s
+
+# Deploy n8n
+kubectl apply -f n8n-pvc.yaml
+kubectl apply -f n8n-deployment.yaml
+
+# Wait for n8n to be ready
+echo "Waiting for n8n to be ready..."
+kubectl wait --for=condition=ready pod -l app=n8n -n n8n --timeout=300s
+
+# Create ingress
+kubectl apply -f ingress.yaml
+
+echo "n8n deployment complete!"
+echo ""
+echo "Access n8n at: https://n8n.w5isp.com"
+echo ""
+echo "To check the deployment status:"
+echo "kubectl get pods -n n8n"
+echo "kubectl get svc -n n8n"
+echo "kubectl get ingress -n n8n"

home/cluster/n8n/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: n8n-ingress
+  namespace: n8n
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  tls:
+  - hosts:
+    - n8n.w5isp.com
+    secretName: n8n-tls
+  rules:
+  - host: n8n.w5isp.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: n8n
+            port:
+              number: 5678

home/cluster/n8n/n8n-deployment.yaml

@@ -0,0 +1,107 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: n8n-config
+  namespace: n8n
+data:
+  N8N_HOST: "n8n.w5isp.com"
+  N8N_PORT: "5678"
+  N8N_PROTOCOL: "https"
+  N8N_EDITOR_BASE_URL: "https://n8n.w5isp.com/"
+  WEBHOOK_URL: "https://n8n.w5isp.com/"
+  N8N_METRICS: "true"
+  N8N_BASIC_AUTH_ACTIVE: "false"
+  DB_TYPE: "postgresdb"
+  DB_POSTGRESDB_HOST: "postgres.n8n.svc.cluster.local"
+  DB_POSTGRESDB_PORT: "5432"
+  DB_POSTGRESDB_DATABASE: "n8n"
+  DB_POSTGRESDB_USER: "n8n"
+  EXECUTIONS_MODE: "regular"
+  N8N_PERSONALIZATION_ENABLED: "false"
+  N8N_VERSION_NOTIFICATIONS_ENABLED: "true"
+  N8N_HIDE_USAGE_PAGE: "true"
+  GENERIC_TIMEZONE: "America/Chicago"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n
+  namespace: n8n
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: n8n
+  template:
+    metadata:
+      labels:
+        app: n8n
+    spec:
+      initContainers:
+      - name: fix-permissions
+        image: busybox
+        command: ['sh', '-c', 'chown -R 1000:1000 /home/node/.n8n']
+        volumeMounts:
+        - name: n8n-data
+          mountPath: /home/node/.n8n
+      containers:
+      - name: n8n
+        image: n8nio/n8n:latest
+        ports:
+        - containerPort: 5678
+        env:
+        - name: DB_POSTGRESDB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: n8n-secret
+              key: DB_POSTGRESDB_PASSWORD
+        - name: N8N_ENCRYPTION_KEY
+          valueFrom:
+            secretKeyRef:
+              name: n8n-secret
+              key: N8N_ENCRYPTION_KEY
+        envFrom:
+        - configMapRef:
+            name: n8n-config
+        volumeMounts:
+        - name: n8n-data
+          mountPath: /home/node/.n8n
+        resources:
+          requests:
+            memory: "512Mi"
+            cpu: "250m"
+          limits:
+            memory: "2048Mi"
+            cpu: "1000m"
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 5678
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 5678
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          timeoutSeconds: 5
+      volumes:
+      - name: n8n-data
+        persistentVolumeClaim:
+          claimName: n8n-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: n8n
+  namespace: n8n
+spec:
+  type: ClusterIP
+  selector:
+    app: n8n
+  ports:
+  - port: 5678
+    targetPort: 5678
+    name: http

home/cluster/n8n/n8n-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-data
+  namespace: n8n
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi

home/cluster/n8n/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: n8n

home/cluster/n8n/postgres-deployment.yaml

@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  namespace: n8n
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+      - name: postgres
+        image: postgres:16-alpine
+        ports:
+        - containerPort: 5432
+        env:
+        - name: POSTGRES_USER
+          value: "n8n"
+        - name: POSTGRES_DB
+          value: "n8n"
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: n8n-secret
+              key: POSTGRES_PASSWORD
+        - name: PGDATA
+          value: /var/lib/postgresql/data/pgdata
+        volumeMounts:
+        - name: postgres-data
+          mountPath: /var/lib/postgresql/data
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+        livenessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - pg_isready -U n8n
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - pg_isready -U n8n
+          initialDelaySeconds: 5
+          periodSeconds: 5
+      volumes:
+      - name: postgres-data
+        persistentVolumeClaim:
+          claimName: postgres-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: n8n
+spec:
+  selector:
+    app: postgres
+  ports:
+  - port: 5432
+    targetPort: 5432

home/cluster/n8n/postgres-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-data
+  namespace: n8n
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi

home/cluster/n8n/secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: n8n-secret
+  namespace: n8n
+type: Opaque
+stringData:
+  N8N_ENCRYPTION_KEY: "ExpDR3+Wmq1Q8Z9jDkDbt774/Rip4dZ7bor4z3lTquk="
+  DB_POSTGRESDB_PASSWORD: "Nk+L6lf1x0BlQa3xIy9yDA8oHPGlcPyJyLLxSkALLWg="
+  POSTGRES_PASSWORD: "Nk+L6lf1x0BlQa3xIy9yDA8oHPGlcPyJyLLxSkALLWg="

home/cluster/nodered/AUTH.md

@@ -0,0 +1,53 @@
+# Node-RED Authentication
+
+## Current Configuration
+
+Node-RED is configured with authentication enabled:
+
+- **Username**: `admin`
+- **Password**: `changeme`
+
+## Changing the Password
+
+1. Edit the `generate-password.yaml` file and change the PASSWORD value
+2. Run the password generator:
+   ```bash
+   kubectl delete job nodered-password-generator -n nodered
+   kubectl apply -f generate-password.yaml
+   kubectl logs job/nodered-password-generator -n nodered
+   ```
+3. Copy the generated hash
+4. Edit `settings-configmap.yaml` and replace the password hash
+5. Apply the changes:
+   ```bash
+   kubectl apply -f settings-configmap.yaml
+   kubectl rollout restart deployment/nodered -n nodered
+   ```
+
+## Adding More Users
+
+Edit the `settings-configmap.yaml` file and add more users to the `users` array:
+
+```javascript
+users: [{
+    username: "admin",
+    password: "$2b$08$...", 
+    permissions: "*"
+}, {
+    username: "viewer",
+    password: "$2b$08$...", 
+    permissions: "read"
+}]
+```
+
+Permissions can be:
+- `*` - Full access
+- `read` - Read-only access
+
+## Securing HTTP Nodes (Optional)
+
+To also secure HTTP endpoints created in Node-RED flows, uncomment the `httpNodeAuth` line in `settings-configmap.yaml`.
+
+## Disabling Authentication
+
+To disable authentication, remove or comment out the `adminAuth` section in `settings-configmap.yaml`.

home/cluster/nodered/deploy.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+echo "Deploying Node-RED to k3s cluster..."
+
+# Create namespace
+kubectl apply -f namespace.yaml
+
+# Create PVC
+kubectl apply -f pvc.yaml
+
+# Deploy Node-RED
+kubectl apply -f deployment.yaml
+
+# Wait for Node-RED to be ready
+echo "Waiting for Node-RED to be ready..."
+kubectl wait --for=condition=ready pod -l app=nodered -n nodered --timeout=300s
+
+# Create service
+kubectl apply -f service.yaml
+
+# Create ingress
+kubectl apply -f ingress.yaml
+
+echo "Node-RED deployment complete!"
+echo ""
+echo "Access Node-RED at: https://nodered.w5isp.com"
+echo ""
+echo "To check the deployment status:"
+echo "kubectl get pods -n nodered"
+echo "kubectl get svc -n nodered"
+echo "kubectl get ingress -n nodered"

home/cluster/nodered/deployment.yaml

@@ -13,6 +13,19 @@ spec:
       labels:
         app: nodered
     spec:
+      initContainers:
+      - name: fix-permissions
+        image: busybox
+        command: ['sh', '-c']
+        args:
+          - |
+            chown -R 1000:1000 /data
+            chmod 755 /data
+        volumeMounts:
+        - name: node-red-data
+          mountPath: /data
+        securityContext:
+          runAsUser: 0
       containers:
       - name: nodered
         image: nodered/node-red:latest
@@ -20,10 +33,13 @@ spec:
         - containerPort: 1880
         env:
         - name: TZ
-          value: "UTC"
+          value: "America/Chicago"
         volumeMounts:
         - name: node-red-data
           mountPath: /data
+        - name: node-red-settings
+          mountPath: /data/settings.js
+          subPath: settings.js
         resources:
           requests:
             memory: "256Mi"
@@ -34,4 +50,7 @@ spec:
       volumes:
       - name: node-red-data
         persistentVolumeClaim:
-          claimName: nodered-data
+          claimName: nodered-data
+      - name: node-red-settings
+        configMap:
+          name: nodered-settings

home/cluster/nodered/generate-password.yaml

@@ -0,0 +1,17 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: nodered-password-generator
+  namespace: nodered
+spec:
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: generate-hash
+        image: nodered/node-red:latest
+        command: ["node"]
+        args: ["-e", "console.log(require('bcryptjs').hashSync(process.env.PASSWORD || 'changeme', 8));"]
+        env:
+        - name: PASSWORD
+          value: "changeme"  # Change this to your desired password

home/cluster/nodered/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nodered-ingress
+  namespace: nodered
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  tls:
+  - hosts:
+    - nodered.w5isp.com
+    secretName: nodered-tls
+  rules:
+  - host: nodered.w5isp.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: nodered
+            port:
+              number: 80

home/cluster/nodered/pvc.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   accessModes:
     - ReadWriteOnce
-  storageClassName: ceph-rbd
+  storageClassName: longhorn
   resources:
     requests:
       storage: 5Gi

home/cluster/nodered/service.yaml

@@ -4,7 +4,7 @@ metadata:
   name: nodered
   namespace: nodered
 spec:
-  type: LoadBalancer
+  type: ClusterIP
   selector:
     app: nodered
   ports:

home/cluster/nodered/settings-configmap.yaml

@@ -0,0 +1,65 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nodered-settings
+  namespace: nodered
+data:
+  settings.js: |
+    module.exports = {
+        // The file containing the flows.
+        flowFile: 'flows.json',
+        
+        // Node-RED editor theme
+        editorTheme: {
+            page: {
+                title: "Node-RED - W5ISP"
+            },
+            header: {
+                title: "Node-RED",
+                image: null
+            }
+        },
+        
+        // Securing the Node-RED editor
+        adminAuth: {
+            type: "credentials",
+            users: [{
+                username: "admin",
+                password: "$2b$08$eqrvB6AnIA68TG8yIJGDfumTlW0tSgUAcrnSxs.sy3mdNYUFZca/a", // changeme
+                permissions: "*"
+            }]
+        },
+        
+        // Securing Node-RED API (optional, uncomment to enable)
+        // httpNodeAuth: {user:"user",pass:"$2b$08$eqrvB6AnIA68TG8yIJGDfumTlW0tSgUAcrnSxs.sy3mdNYUFZca/a"},
+        
+        // Enable HTTPS (handled by Kubernetes Ingress)
+        requireHttps: false,
+        
+        // The maximum size of HTTP request body in bytes
+        apiMaxLength: '5mb',
+        
+        // Context Storage
+        contextStorage: {
+            default: {
+                module: "memory"
+            }
+        },
+        
+        // Configure the logging
+        logging: {
+            console: {
+                level: "info",
+                metrics: false,
+                audit: false
+            }
+        },
+        
+        // Disable the editor UI entirely
+        disableEditor: false,
+        
+        // Configure node settings
+        functionGlobalContext: {
+            // Add any global context variables here
+        }
+    }

home/cluster/wavelog/wavelog-config-job.yaml

@@ -0,0 +1,56 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: wavelog-configure
+  namespace: wavelog
+spec:
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: configure
+        image: ghcr.io/wavelog/wavelog:latest
+        command: ["/bin/bash", "-c"]
+        args:
+        - |
+          set -e
+          echo "Creating Wavelog configuration files..."
+          
+          # Create database.php
+          cat > /config/database.php <<'EOF'
+          <?php
+          defined('BASEPATH') OR exit('No direct script access allowed');
+          $active_group = 'default';
+          $query_builder = TRUE;
+          $db['default'] = array(
+            'dsn'	=> '',
+            'hostname' => 'mariadb.data.svc.cluster.local',
+            'username' => 'wavelog',
+            'password' => 's7hDEobNpX08UQxewlSLyrMGjbdnIcuw',
+            'database' => 'wavelog',
+            'dbdriver' => 'mysqli',
+            'dbprefix' => '',
+            'pconnect' => FALSE,
+            'db_debug' => FALSE,
+            'cache_on' => FALSE,
+            'cachedir' => '',
+            'char_set' => 'utf8mb4',
+            'dbcollat' => 'utf8mb4_general_ci',
+            'swap_pre' => '',
+            'encrypt' => FALSE,
+            'compress' => FALSE,
+            'stricton' => FALSE,
+            'failover' => array(),
+            'save_queries' => TRUE
+          );
+          EOF
+          
+          echo "Configuration complete!"
+        volumeMounts:
+        - name: wavelog-data
+          mountPath: /config
+          subPath: config
+      volumes:
+      - name: wavelog-data
+        persistentVolumeClaim:
+          claimName: wavelog-data

home/cluster/wavelog/wavelog-deployment.yaml

@@ -113,7 +113,7 @@ spec:
         - containerPort: 80
         env:
         - name: MYSQL_HOST
-          value: "mariadb"
+          value: "mariadb.data.svc.cluster.local"
         - name: MYSQL_PORT
           value: "3306"
         - name: MYSQL_DATABASE
@@ -123,8 +123,8 @@ spec:
         - name: MYSQL_PASSWORD
           valueFrom:
             secretKeyRef:
-              name: mariadb-secret
-              key: MYSQL_PASSWORD
+              name: wavelog-secret
+              key: database-password
         volumeMounts:
         - name: wavelog-data
           mountPath: /var/www/html/application/config

home/cluster/wavelog/wavelog-ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wavelog-ingress
+  namespace: wavelog
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - log.w5isp.com
+    secretName: wavelog-tls
+  rules:
+  - host: log.w5isp.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: wavelog
+            port:
+              number: 80

home/cluster/wavelog/wavelog-secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: wavelog-secret
+  namespace: wavelog
+type: Opaque
+stringData:
+  database-host: "mariadb.data.svc.cluster.local"
+  database-name: "wavelog"
+  database-user: "wavelog"
+  database-password: "s7hDEobNpX08UQxewlSLyrMGjbdnIcuw"

home/terraform/dns_w5isp.tf

@@ -25,7 +25,7 @@ resource "dnsimple_zone_record" "w5isp_gmc" {
 resource "dnsimple_zone_record" "w5isp_git" {
   zone_name = "w5isp.com"
   name      = "git"
-  value     = "204.110.191.2"  # Home k3s cluster
+  value     = "204.110.191.2" # Home k3s cluster
   type      = "A"
   ttl       = 3600
 }
@@ -42,7 +42,7 @@ resource "dnsimple_zone_record" "w5isp_home" {
 resource "dnsimple_zone_record" "w5isp_photos" {
   zone_name = "w5isp.com"
   name      = "photos"
-  value     = "204.110.191.212"  # Points to Caddy proxy server
+  value     = "204.110.191.212" # Points to Caddy proxy server
   type      = "A"
   ttl       = 3600
 }
@@ -201,7 +201,7 @@ resource "dnsimple_zone_record" "w5isp_sync" {
 resource "dnsimple_zone_record" "w5isp_log" {
   zone_name = "w5isp.com"
   name      = "log"
-  value     = "204.110.191.3"  # Traefik ingress on k3s cluster
+  value     = "204.110.191.8" # skippy.w5isp.com
   type      = "A"
   ttl       = 3600
 }
@@ -234,6 +234,24 @@ resource "dnsimple_zone_record" "w5isp_autoconfig" {
   ttl       = 3600
 }
 
+# n8n workflow automation
+resource "dnsimple_zone_record" "w5isp_n8n" {
+  zone_name = "w5isp.com"
+  name      = "n8n"
+  value     = "204.110.191.2" # Traefik ingress on k3s cluster
+  type      = "A"
+  ttl       = 3600
+}
+
+# Node-RED flow-based programming
+resource "dnsimple_zone_record" "w5isp_nodered" {
+  zone_name = "w5isp.com"
+  name      = "nodered"
+  value     = "204.110.191.2" # Traefik ingress on k3s cluster
+  type      = "A"
+  ttl       = 3600
+}
+
 # TLSA record for SMTP on port 25 - DNSimple doesn't support TLSA records
 # You'll need to add this manually through a different DNS provider if needed:
 # _25._tcp.mail.w5isp.com TLSA 3 1 1 885717a52f0e26cdde481d2d44110c3374ff3b7977626afe2f952b655358308a