feat(init): 仓库重新初始化

apps/net/certs/certificate-dev-cm.yaml

@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dev-cm-crt
+  namespace: infra-net
+spec:
+  secretName: dev-cm-crt
+  issuerRef:
+    name: dnspod
+    kind: ClusterIssuer
+    group: cert-manager.io
+  dnsNames:
+    - "dev.cm"
+    - "*.dev.cm"
+    - "*.node.dev.cm"

apps/net/certs/certificate-fillcode-com.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fillcode-com-crt
+  namespace: infra-net
+spec:
+  secretName: fillcode-com-crt
+  issuerRef:
+    name: dnspod
+    kind: ClusterIssuer
+    group: cert-manager.io
+  dnsNames:
+    - "fillcode.com"
+    - "*.fillcode.com"

apps/net/namespaces.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-net

apps/net/nginx/helmchart.yaml

@@ -0,0 +1,77 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: ingress-nginx
+  namespace: infra-net
+spec:
+  repo: https://kubernetes.github.io/ingress-nginx
+  chart: ingress-nginx
+  version: 4.10.0
+  targetNamespace: infra-net
+  valuesContent: |-
+    fullnameOverride: ingress-nginx
+    controller:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: svccontroller.k3s.cattle.io/enablelb
+                    operator: In
+                    values:
+                      - "true"
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          operator: "Exists"
+          effect: "NoSchedule"
+      kind: DaemonSet
+      dnsPolicy: None
+      dnsConfig:
+        nameservers:
+          - 169.254.20.10
+          - 10.43.0.10
+      hostNetwork: true
+      hostPort:
+        enabled: true
+      service:
+        enabled: false
+      publishService:
+        enabled: false
+      config:
+        use-forwarded-headers: "true"
+        allow-snippet-annotations: "true"
+        http-snippet: |
+          proxy_cache_path /tmp/nginx-cache levels=1:2 keys_zone=cache:2m max_size=100m inactive=7d use_temp_path=off;
+          proxy_cache_key $scheme$proxy_host$request_uri;
+          proxy_cache_lock on;
+          proxy_cache_use_stale updating;
+        server-snippet : |
+          resolver 169.254.20.10 10.43.0.10 ipv6=off;
+        # crowdsec插件配置
+        plugins: "crowdsec"
+        lua-shared-dicts: "crowdsec_cache: 50m"
+      extraArgs:
+        default-ssl-certificate: "infra-net/dev-cm-crt"
+      # crowdsec插件配置
+      extraVolumes:
+        - name: crowdsec-bouncer-plugin
+          emptyDir: {}
+      extraInitContainers:
+        - name: init-clone-crowdsec-bouncer
+          image: devcm/lua-bouncer-plugin
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: API_URL
+              value: "http://crowdsec-service.infra-monitor.svc.cluster.local:8080"
+            - name: API_KEY
+              value: "lkFoJuR7ZPFeaN97wM04EVTUH+icqiSEgXPBXteaMsE"
+            - name: BOUNCER_CONFIG
+              value: "/crowdsec/crowdsec-bouncer.conf"
+          command: ['sh', '-c', "bash /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -R /crowdsec/* /lua_plugins/crowdsec/"]
+          volumeMounts:
+            - name: crowdsec-bouncer-plugin
+              mountPath: /lua_plugins
+      extraVolumeMounts:
+        - name: crowdsec-bouncer-plugin
+          mountPath: /etc/nginx/lua/plugins/crowdsec
+          subPath: crowdsec

apps/net/proxy/todo.yaml

@@ -0,0 +1,60 @@
+http:
+  routers:
+    router:
+      entryPoints:
+        - websecure
+      rule: "Host(`router.dev.cm`)"
+      service: "router@file"
+      middlewares:
+        - web-base
+    vm:
+      entryPoints:
+        - websecure
+      rule: "Host(`vm.dev.cm`)"
+      service: "vm@file"
+      middlewares:
+        - web-base
+    nas:
+      entryPoints:
+        - websecure
+      rule: "Host(`nas.dev.cm`)"
+      service: "nas@file"
+      middlewares:
+        - web-base
+    download:
+      entryPoints:
+        - websecure
+      rule: "Host(`download.dev.cm`)"
+      service: "download@file"
+      middlewares:
+        - traefik-forward-auth
+        - web-base
+    downloadRpc:
+      entryPoints:
+        - websecure
+      rule: "Host(`download.dev.cm`) && PathPrefix(`/jsonrpc`)"
+      service: "downloadRpc@file"
+      middlewares:
+        - web-base
+
+  services:
+    router:
+      loadBalancer:
+        servers:
+          - url: "https://192.168.21.1/"
+    vm:
+      loadBalancer:
+        servers:
+          - url: "https://192.168.21.2:8006/"
+    nas:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.21.3/"
+    download:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.21.3:6880/"
+    downloadRpc:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.21.3:6800/"