feat(halo): 增加halo配置 & 优化apps结构

2024-08-14 14:11:36 +08:00
@@ -0,0 +1,20 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: cnpg-cluster-hk
+  namespace: infra-data
+spec:
+  affinity:
+    nodeAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - preference:
+            matchExpressions:
+              - key: topology.kubernetes.io/region
+                operator: In
+                values:
+                  - cn-hk
+          weight: 1
+  instances: 1
+  enableSuperuserAccess: true
+  storage:
+    size: 10Gi
@@ -0,0 +1,20 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: cnpg-cluster-sh
+  namespace: infra-data
+spec:
+  affinity:
+    nodeAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - preference:
+            matchExpressions:
+              - key: topology.kubernetes.io/region
+                operator: In
+                values:
+                  - cn-sh
+          weight: 1
+  instances: 1
+  enableSuperuserAccess: true
+  storage:
+    size: 10Gi
@@ -0,0 +1,24 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cloudnative-pg
+  namespace: infra-data
+spec:
+  repo: https://cloudnative-pg.github.io/charts
+  chart: cloudnative-pg
+  targetNamespace: infra-data
+  version: 0.21.4
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/master
+                  operator: In
+                  values:
+                    - "true"
+    tolerations:
+      - key: "node-role.kubernetes.io/master"
+        operator: "Exists"
+
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: cnpg-cluster-hk-lb
+  namespace: infra-data
+spec:
+  selector:
+    cnpg.io/cluster: cnpg-cluster-hk
+    role: primary
+  ports:
+    - protocol: TCP
+      port: 65432
+      targetPort: 5432
+  type: LoadBalancer
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: cnpg-cluster-sh-lb
+  namespace: infra-data
+spec:
+  selector:
+    cnpg.io/cluster: cnpg-cluster-sh
+    role: primary
+  ports:
+    - protocol: TCP
+      port: 65432
+      targetPort: 5432
+  type: LoadBalancer
@@ -0,0 +1,33 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: milvus
+  namespace: infra-data
+spec:
+  repo: https://zilliztech.github.io/milvus-helm/
+  chart: milvus
+  targetNamespace: infra-data
+  version: 4.2.0
+  valuesContent: |-
+    cluster:
+      enabled: false
+    etcd:
+      enabled: false
+    pulsar:
+      enabled: false
+    minio:
+      enabled: false
+      tls:
+        enabled: false
+    extraConfigFiles:
+      user.yaml: |+
+        etcd:
+          use:
+            embed: true
+          data:
+            dir: /var/lib/milvus/etcd
+        common:
+          storageType: local
+          security:
+            authorizationEnabled: false
+    
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: milvus-lb
+  namespace: infra-data
+spec:
+  selector:
+    app.kubernetes.io/name: milvus
+    app.kubernetes.io/instance: milvus
+    component: standalone
+  ports:
+    - protocol: TCP
+      port: 19530
+      targetPort: 19530
+  type: LoadBalancer
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-data
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgresql-ha-pgpool-script
+  namespace: infra-data
+data:
+  latency_test.sh: |-
+    #!/bin/bash
+    
+    install_packages ping
+    
+    # 读取环境变量
+    nodes=$PGPOOL_BACKEND_NODES
+    
+    echo $nodes
@@ -0,0 +1,85 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: postgresql-ha
+  namespace: infra-data
+spec:
+  chart: oci://registry-1.docker.io/bitnamicharts/postgresql-ha
+  targetNamespace: infra-data
+  version: 14.0.12
+  valuesContent: |-
+    diagnosticMode:
+      enabled: false
+    postgresql:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: postgresql-ha
+                    app.kubernetes.io/component: postgresql
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: postgresql-ha
+                    app.kubernetes.io/component: postgresql
+                topologyKey: topology.kubernetes.io/region
+              weight: 1
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          operator: "Exists"
+          effect: "NoSchedule"
+      image:
+        debug: true
+      username: rohow
+      password: L#GRtTR2QuL@20pm6+c~
+      postgresPassword: L#GRtTR2QuL@20pm6+c~
+      repmgrPassword: yAn0l2eiLw
+    pgpool:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: postgresql-ha
+                    app.kubernetes.io/component: pgpool
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: postgresql-ha
+                    app.kubernetes.io/component: pgpool
+                topologyKey: topology.kubernetes.io/region
+              weight: 1
+        podAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: postgresql-ha
+                    app.kubernetes.io/component: pgpool
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          operator: "Exists"
+          effect: "NoSchedule"
+      replicaCount: 1
+      containerSecurityContext:
+        runAsUser: 0
+        runAsGroup: 0
+        runAsNonRoot: false
+        readOnlyRootFilesystem: false
+        privileged: true
+        allowPrivilegeEscalation: true
+      image:
+        debug: true
+      adminPassword: wc8FVC55JX
+    volumePermissions:
+      enabled: true
+
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgresql-ha-lb
+  namespace: infra-data
+spec:
+  selector:
+    app.kubernetes.io/instance: postgresql-ha
+    app.kubernetes.io/name: postgresql-ha
+    app.kubernetes.io/component: pgpool
+  ports:
+    - protocol: TCP
+      port: 65432
+      targetPort: 5432
+  type: LoadBalancer
@@ -0,0 +1,17 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: redis-cluster-sh
+  namespace: infra-data
+spec:
+  chart: oci://registry-1.docker.io/bitnamicharts/redis
+  targetNamespace: infra-data
+  version: 19.1.0
+  valuesContent: |-
+    global:
+      redis:
+        password: ribiPwYQNU6GWxCYR0Nj
+    replica:
+      replicaCount: 0
+
+
@@ -0,0 +1,35 @@
+# 安装后需要将clusterIssuer的cnameStrategy策略设置为Follow
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager-webhook-dnspod
+  namespace: infra-devops
+spec:
+  chart: oci://registry-1.docker.io/imroc/cert-manager-webhook-dnspod
+  targetNamespace: infra-devops
+  version: 1.4.5
+  valuesContent: |-
+    namespace: infra-devops
+    certManager:
+      namespace: infra-devops
+    groupName: cert.dev.cm
+    clusterIssuer:
+      # 此处需在部署后修改clusterIssuer 添加在dns01下
+      # cnameStrategy: Follow
+      staging: false
+      email: [email protected]
+      secretId: AKIDzmKdvDSfonogKip55pIVR6h7ScjaBWcg
+      secretKey: zudDdtytkPr8HI9oKeniSxIRPCmCe0CD
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/master
+                  operator: In
+                  values:
+                    - "true"
+    tolerations:
+      - key: "node-role.kubernetes.io/master"
+        operator: "Exists"
+        effect: "NoSchedule"
@@ -0,0 +1,60 @@
+# 需要提前安装crds
+# kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.crds.yaml
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: cert-manager
+  namespace: infra-devops
+spec:
+  repo: https://charts.jetstack.io
+  chart: cert-manager
+  targetNamespace: infra-devops
+  version: v1.14.4
+  valuesContent: |-
+    affinity:
+      nodeAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          nodeSelectorTerms:
+            - matchExpressions:
+                - key: node-role.kubernetes.io/master
+                  operator: In
+                  values:
+                    - "true"
+    tolerations:
+      - key: "node-role.kubernetes.io/master"
+        operator: "Exists"
+        effect: "NoSchedule"
+    prometheus:
+      enabled: true
+      servicemonitor:
+        enabled: true
+        interval: 300s
+        prometheusInstance: kube-prometheus
+    webhook:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/master
+                    operator: In
+                    values:
+                      - "true"
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          operator: "Exists"
+          effect: "NoSchedule"
+    cainjector:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/master
+                    operator: In
+                    values:
+                      - "true"
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          operator: "Exists"
+          effect: "NoSchedule"
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-custom-templates
+  namespace: infra-devops
+data:
+  home.tmpl: |-
+    {{template "base/head" .}}
+    <div class="page-content home">
+            <div class="ui stackable middle very relaxed page grid">
+                    <div class="sixteen wide center aligned centered column">
+                            <div>
+                                    <img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
+                            </div>
+                            <div class="hero">
+                                    <h1 class="ui icon header title">
+                                            {{AppName}}
+                                    </h1>
+                                    <h2><a href="https://git.dev.cm">dev.cm</a> - Git 仓库</h2>
+                            </div>
+                    </div>
+            </div>
+    </div>
+    {{template "base/footer" .}}
+
+  extra_links.tmpl: |-
+    <a class="item" href="https://ci.dev.cm" target="_blank">CI</a>
@@ -0,0 +1,102 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: gitea
+  namespace: infra-devops
+spec:
+  repo: https://dl.gitea.com/charts
+  chart: gitea
+  targetNamespace: infra-devops
+  version: 10.1.4
+  valuesContent: |-
+    affinity:
+      podAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            podAffinityTerm:
+              labelSelector:
+                matchLabels:
+                  cnpg.io/cluster: cnpg-cluster-sh
+                  role: primary
+                  app.kubernetes.io/name: redis
+                  app.kubernetes.io/component: master
+              topologyKey: kubernetes.io/hostname
+              namespaceSelector: {}
+      nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 1
+            preference:
+              matchExpressions:
+                - key: kubernetes.io/hostname
+                  operator: In
+                  values:
+                    - homea   
+    redis-cluster:
+      enabled: false
+    postgresql-ha:
+      enabled: false
+    image:
+      tag: 1.22.0
+    ingress:
+      enabled: true
+      className: nginx
+      annotations:
+        nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+      hosts:
+        - host: git.dev.cm
+          paths:
+            - path: /
+              pathType: Prefix
+    gitea:
+      config:
+        APP_NAME: Git.dev.cm
+        RUN_MODE: prod
+        server:
+          DOMAIN: git.dev.cm
+          ROOT_URL: https://git.dev.cm/
+        database:
+          DB_TYPE: postgres
+          HOST: cnpg-cluster-sh-rw.infra-data:5432
+          NAME: gitea
+          USER: app
+          PASSWD: 6UeWq0EEQaP47eMjAt3hmmquGY3e6bqDanCeSKWDmLtLCuMe1TH0UGTKuaw2LfIO
+          SSL_MODE: disable
+        session:
+          PROVIDER: redis
+          PROVIDER_CONFIG: redis://:[email protected]:6379/0
+        cache:
+          ADAPTER: redis
+          HOST: redis://:[email protected]:6379/0?pool_size=100&idle_timeout=180s
+        queue:
+          TYPE: redis
+          CONN_STR: redis://:[email protected]:6379/0
+        repository:
+          DEFAULT_REPO_UNITS: repo.code,repo.releases,repo.issues,repo.pulls
+        service:
+          DISABLE_REGISTRATION: true
+          NO_REPLY_ADDRESS: noreply.dev.cm
+        picture:
+          GRAVATAR_SOURCE: https://cravatar.cn/avatar/
+        i18n:
+          LANGS: zh-CN,en-US
+          NAMES: 简体中文,English
+        other:
+          SHOW_FOOTER_VERSION: false
+        log:
+          LEVEL: Info
+    extraVolumes:
+      - name: gitea-custom-templates-volume
+        configMap:
+          name: gitea-custom-templates
+          items:
+            - key: home.tmpl
+              path: home.tmpl
+            - key: extra_links.tmpl
+              path: custom/extra_links.tmpl
+    extraContainerVolumeMounts:
+      - name: gitea-custom-templates-volume
+        readOnly: true
+        mountPath: /data/gitea/templates
+
+
+
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-static
+  namespace: infra-devops
+  annotations:
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/proxy-buffering: "on"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_cache cache;
+      proxy_cache_valid 200 302 7d;
+      proxy_cache_valid 404 10m;
+      proxy_cache_valid any 1h;
+      proxy_cache_use_stale error timeout updating http_404 http_500 http_502 http_503 http_504;
+      proxy_cache_bypass $http_x_purge;
+      proxy_ignore_headers Cache-Control;
+      add_header X-Cache-Status $upstream_cache_status;
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: git.dev.cm
+      http:
+        paths:
+          - path: /(.*\.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff|woff2|ttf|eot)|avatars/[^/]+)$
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: gitea-http
+                port:
+                  number: 3000
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-ssh-lb
+  namespace: infra-devops
+spec:
+  selector:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: gitea
+  ports:
+    - protocol: TCP
+      port: 22
+      targetPort: 2222
+  type: LoadBalancer
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-devops
@@ -0,0 +1,60 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: crowdsec
+  namespace: infra-monitor
+spec:
+  repo: https://crowdsecurity.github.io/helm-charts
+  chart: crowdsec
+  targetNamespace: infra-monitor
+  version: 0.11.0
+  valuesContent: |-
+    container_runtime: containerd
+    image:
+      tag: v1.6.1-2
+    config:
+      config.yaml.local: |
+        db_config:
+          type: postgresql
+          host: cnpg-cluster-hk-rw.infra-data
+          port: 5432
+          db_name: crowdsec
+          user: app
+          password: nyrHzh9WWlDZzvVw7bDFo74gKb9zsls0Sy7OwRTDWiRTNPQQQkW85taUFAoX2AIC
+          sslmode: require
+    agent:
+      nodeSelector:
+        svccontroller.k3s.cattle.io/enablelb: "true"
+        # 由于使用了loki搜集日志 此处不再需要 所以使用此标签 禁用所有的agent
+        crowdsec/enabled: "true"
+      acquisition:
+        - namespace: infra-net
+          podName: ingress-nginx-controller-*
+          program: nginx
+          poll_without_inotify: true
+      env:
+        - name: COLLECTIONS
+          value: "crowdsecurity/nginx"
+    lapi:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - preference:
+                matchExpressions:
+                  - key: topology.kubernetes.io/region
+                    operator: In
+                    values:
+                      - cn-hk
+              weight: 1
+      resources:
+        limits:
+          memory: 200Mi
+        requests:
+          cpu: 150m
+          memory: 100Mi
+      persistentVolume:
+        config:
+          enabled: false
+        data:
+          enabled: false
+
@@ -0,0 +1,54 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: loki
+  namespace: infra-monitor
+spec:
+  repo: https://grafana.github.io/helm-charts
+  chart: loki
+  targetNamespace: infra-monitor
+  version: 6.7.1
+  valuesContent: |-
+    deploymentMode: SingleBinary
+    gateway:
+      enabled: false
+    lokiCanary:
+      nodeSelector:
+        svccontroller.k3s.cattle.io/enablelb: "true"
+      extraArgs:
+        # 降低测试日志生成条数
+        - -interval=30s
+    resultsCache:
+      nodeSelector:
+        kubernetes.io/hostname: alihka
+      allocatedMemory: 1024
+    chunksCache:
+      nodeSelector:
+        kubernetes.io/hostname: alihka
+      allocatedMemory: 1024
+    loki:
+      auth_enabled: false
+      commonConfig:
+        replication_factor: 1
+      storage:
+        type: 'filesystem'
+      schemaConfig:
+        configs:
+        - from: "2024-01-01"
+          store: tsdb
+          index:
+            prefix: loki_index_
+            period: 24h
+          object_store: filesystem
+          schema: v13
+    singleBinary:
+      replicas: 1
+      nodeSelector:
+        kubernetes.io/hostname: alihka
+    read:
+      replicas: 0
+    backend:
+      replicas: 0
+    write:
+      replicas: 0
+
@@ -0,0 +1,24 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: loki-promtail
+  namespace: infra-monitor
+spec:
+  repo: https://grafana.github.io/helm-charts
+  chart: promtail
+  targetNamespace: infra-monitor
+  version: 6.7.1
+  valuesContent: |-
+    nodeSelector:
+      svccontroller.k3s.cattle.io/enablelb: "true"
+    configmap:
+      enabled: true
+    config:
+      clients:
+        - url: http://loki.infra-monitor:3100/loki/api/v1/push
+          tenant_id: 1
+      snippets:
+        extraRelabelConfigs:
+          - source_labels: [__meta_kubernetes_pod_label_log_collecting_enabled]
+            action: keep
+            regex: true
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-monitor
@@ -0,0 +1,105 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: prometheus
+  namespace: infra-monitor
+spec:
+  repo: https://prometheus-community.github.io/helm-charts
+  chart: kube-prometheus-stack
+  targetNamespace: infra-monitor
+  version: 59.1.0
+  valuesContent: |-
+    kubeControllerManager:
+      enabled: false
+    kubeScheduler:
+      enabled: false
+    kubeProxy:
+      enabled: false
+    kubeEtcd:
+      enabled: false
+
+    prometheusOperator:
+      nodeSelector:
+        kubernetes.io/hostname: alihka
+        
+    kube-state-metrics:
+      nodeSelector:
+        kubernetes.io/hostname: alihka
+              
+    grafana:
+      nodeSelector:
+        kubernetes.io/hostname: alihka
+      ingress:
+        enabled: true
+        ingressClassName: nginx
+        hosts:
+          - monitor.dev.cm
+        paths:
+          - /
+      assertNoLeakedSecrets: false
+      grafana.ini:
+        help:
+          enabled: false
+        news:
+          news_feed_enabled: false
+        database:
+          type: postgres
+          host: cnpg-cluster-hk-rw.infra-data:5432
+          name: grafana
+          user: app
+          password: nyrHzh9WWlDZzvVw7bDFo74gKb9zsls0Sy7OwRTDWiRTNPQQQkW85taUFAoX2AIC
+          
+      persistence:
+        type: pvc
+        enabled: true
+        storageClassName: local-path
+        accessModes:
+          - ReadWriteOnce
+        size: 10Gi
+        
+    prometheus:
+      prometheusSpec:
+        nodeSelector:
+          kubernetes.io/hostname: alihka
+        storageSpec:
+          volumeClaimTemplate:
+            spec:
+              storageClassName: local-path
+              accessModes:
+                - ReadWriteOnce
+              resources:
+                requests:
+                  storage: 30Gi
+        routePrefix: /prometheus
+        serviceMonitorSelectorNilUsesHelmValues: false
+        podMonitorSelectorNilUsesHelmValues: false
+        ruleSelectorNilUsesHelmValues: false
+      ingress:
+        enabled: false
+        ingressClassName: nginx
+        hosts:
+          - monitor.dev.cm
+        paths:
+          - /prometheus
+                
+    alertmanager:
+      alertmanagerSpec:
+        nodeSelector:
+          kubernetes.io/hostname: alihka
+        storage: 
+          volumeClaimTemplate:
+            spec:
+              storageClassName: local-path
+              accessModes:
+                - ReadWriteOnce
+              resources:
+                requests:
+                  storage: 10Gi
+        routePrefix: /alertmanager
+      ingress:
+        enabled: false
+        ingressClassName: nginx
+        hosts:
+          - monitor.dev.cm
+        paths:
+          - /alertmanager
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana-static
+  namespace: infra-monitor
+  annotations:
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/proxy-buffering: "on"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_cache cache;
+      proxy_cache_valid 200 302 7d;
+      proxy_cache_valid 404 10m;
+      proxy_cache_valid any 1h;
+      proxy_cache_use_stale error timeout updating http_404 http_500 http_502 http_503 http_504;
+      proxy_cache_bypass $http_x_purge;
+      proxy_ignore_headers Cache-Control;
+      add_header X-Cache-Status $upstream_cache_status;
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: monitor.dev.cm
+      http:
+        paths:
+          - path: /(.*\.(css|js|png|jpg|jpeg|gif|svg|webp|ico|woff|woff2|ttf|eot)|avatars/[^/]+)$
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: prometheus-grafana
+                port:
+                  number: 80
@@ -0,0 +1,15 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dev-cm-crt
+  namespace: infra-net
+spec:
+  secretName: dev-cm-crt
+  issuerRef:
+    name: dnspod
+    kind: ClusterIssuer
+    group: cert-manager.io
+  dnsNames:
+    - "dev.cm"
+    - "*.dev.cm"
+    - "*.node.dev.cm"
@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fillcode-com-crt
+  namespace: infra-net
+spec:
+  secretName: fillcode-com-crt
+  issuerRef:
+    name: dnspod
+    kind: ClusterIssuer
+    group: cert-manager.io
+  dnsNames:
+    - "fillcode.com"
+    - "*.fillcode.com"
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra-net
@@ -0,0 +1,116 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: ingress-nginx
+  namespace: infra-net
+spec:
+  repo: https://kubernetes.github.io/ingress-nginx
+  chart: ingress-nginx
+  version: 4.10.0
+  targetNamespace: infra-net
+  valuesContent: |-
+    fullnameOverride: ingress-nginx
+    controller:
+      nodeSelector:
+        svccontroller.k3s.cattle.io/enablelb: "true"
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          operator: "Exists"
+          effect: "NoSchedule"
+      labels:
+        log-collecting/enabled: "true"
+      kind: DaemonSet
+      hostNetwork: true
+      hostPort:
+        enabled: true
+      service:
+        enabled: false
+      publishService:
+        enabled: false
+      config:
+        use-forwarded-headers: "true"
+        allow-snippet-annotations: "true"
+        # 缓存配置
+        http-snippet: |
+          proxy_cache_path /tmp/nginx-cache levels=1:2 keys_zone=cache:2m max_size=100m inactive=7d use_temp_path=off;
+          proxy_cache_key $scheme$proxy_host$request_uri;
+          proxy_cache_lock on;
+          proxy_cache_use_stale updating;
+        # dns配置
+        server-snippet : |
+          resolver 169.254.20.10 10.43.0.10 ipv6=off;
+        # 启用geoip2模块
+        use-geoip: "false"
+        use-geoip2: "true"
+        # 日志配置
+        log-format-escape-json: "true"
+        log-format-upstream: '{
+          "msec": "$msec",
+          "connection": "$connection",
+          "connection_requests": "$connection_requests",
+          "pid": "$pid",
+          "request_id": "$request_id",
+          "request_length": "$request_length",
+          "remote_addr": "$remote_addr",
+          "remote_user": "$remote_user",
+          "remote_port": "$remote_port",
+          "time_local": "$time_local",
+          "time_iso8601": "$time_iso8601",
+          "request": "$request",
+          "request_uri": "$request_uri",
+          "args": "$args",
+          "status": "$status",
+          "body_bytes_sent": "$body_bytes_sent",
+          "bytes_sent": "$bytes_sent",
+          "http_referer": "$http_referer",
+          "http_user_agent": "$http_user_agent",
+          "http_x_forwarded_for": "$http_x_forwarded_for",
+          "http_host": "$http_host",
+          "server_name": "$server_name",
+          "request_time": "$request_time",
+          "upstream": "$upstream_addr",
+          "upstream_connect_time": "$upstream_connect_time",
+          "upstream_header_time": "$upstream_header_time",
+          "upstream_response_time": "$upstream_response_time",
+          "upstream_response_length": "$upstream_response_length",
+          "upstream_cache_status": "$upstream_cache_status",
+          "ssl_protocol": "$ssl_protocol",
+          "ssl_cipher": "$ssl_cipher",
+          "scheme": "$scheme",
+          "request_method": "$request_method",
+          "server_protocol": "$server_protocol",
+          "pipe": "$pipe",
+          "gzip_ratio": "$gzip_ratio",
+          "http_cf_ray": "$http_cf_ray",
+          "geoip_country_code": "$geoip2_city_country_code"
+        }'
+        # crowdsec插件配置
+        plugins: "crowdsec"
+        lua-shared-dicts: "crowdsec_cache: 50m"
+      # 启用geoip2模块
+      maxmindLicenseKey: "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"
+      extraArgs:
+        default-ssl-certificate: "infra-net/dev-cm-crt"
+      # crowdsec插件配置
+      extraVolumes:
+        - name: crowdsec-bouncer-plugin
+          emptyDir: {}
+      extraInitContainers:
+        - name: init-clone-crowdsec-bouncer
+          image: devcm/lua-bouncer-plugin
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: API_URL
+              value: "http://crowdsec-service.infra-monitor.svc.cluster.local:8080"
+            - name: API_KEY
+              value: "rgILO2mh/t+30LMvzyyMXbfHRmDfBkDDkhEflzHaoQ0"
+            - name: BOUNCER_CONFIG
+              value: "/crowdsec/crowdsec-bouncer.conf"
+          command: ['sh', '-c', "bash /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -R /crowdsec/* /lua_plugins/crowdsec/"]
+          volumeMounts:
+            - name: crowdsec-bouncer-plugin
+              mountPath: /lua_plugins
+      extraVolumeMounts:
+        - name: crowdsec-bouncer-plugin
+          mountPath: /etc/nginx/lua/plugins/crowdsec
+          subPath: crowdsec
@@ -0,0 +1,60 @@
+http:
+  routers:
+    router:
+      entryPoints:
+        - websecure
+      rule: "Host(`router.dev.cm`)"
+      service: "router@file"
+      middlewares:
+        - web-base
+    vm:
+      entryPoints:
+        - websecure
+      rule: "Host(`vm.dev.cm`)"
+      service: "vm@file"
+      middlewares:
+        - web-base
+    nas:
+      entryPoints:
+        - websecure
+      rule: "Host(`nas.dev.cm`)"
+      service: "nas@file"
+      middlewares:
+        - web-base
+    download:
+      entryPoints:
+        - websecure
+      rule: "Host(`download.dev.cm`)"
+      service: "download@file"
+      middlewares:
+        - traefik-forward-auth
+        - web-base
+    downloadRpc:
+      entryPoints:
+        - websecure
+      rule: "Host(`download.dev.cm`) && PathPrefix(`/jsonrpc`)"
+      service: "downloadRpc@file"
+      middlewares:
+        - web-base
+
+  services:
+    router:
+      loadBalancer:
+        servers:
+          - url: "https://192.168.21.1/"
+    vm:
+      loadBalancer:
+        servers:
+          - url: "https://192.168.21.2:8006/"
+    nas:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.21.3/"
+    download:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.21.3:6880/"
+    downloadRpc:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.21.3:6800/"
@@ -0,0 +1,33 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: tailscale-derp-hk
+  namespace: infra-net
+spec:
+  repo: https://devcm-repo.github.io/helm-charts
+  chart: tailscale-derp
+  version: 0.0.3
+  targetNamespace: infra-net
+  valuesContent: |-
+    nodeSelector:
+      kubernetes.io/hostname: tchk
+    hostNetwork: true
+    extraVolumes:
+      - name: cert-volume
+        secret:
+          secretName: dev-cm-crt
+          items:
+            - key: tls.key
+              path: tchk.node.dev.cm.key
+            - key: tls.crt
+              path: tchk.node.dev.cm.crt
+    extraVolumeMounts:
+      - name: cert-volume
+        mountPath: /certs
+    derp:
+      hostname: 'tchk.node.dev.cm'
+      verify_clients: true
+      http_port: -1
+      https_port: 30443
+      stun_port: 33478
+      certdir: /certs
@@ -0,0 +1,69 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: xray
+  namespace: infra-net
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: xray
+  template:
+    metadata:
+      labels:
+        app: xray
+    spec:
+      volumes:
+        - name: config
+          secret:
+            secretName: config-secret
+      containers:
+        - name: xray
+          image: ghcr.io/xtls/xray-core:latest
+          ports:
+            - name: port
+              containerPort: 443
+              protocol: TCP
+          resources: {}
+          volumeMounts:
+            - name: config
+              readOnly: true
+              mountPath: /etc/xray/config.json
+              subPath: config.json
+
+----------------------------
+kind: Service
+apiVersion: v1
+metadata:
+  name: xray
+  namespace: vpn
+spec:
+  ports:
+    - protocol: TCP
+      port: 443
+      targetPort: 443
+  selector:
+    app: xray
+
+----------------------------
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: xray
+  namespace: infra-net
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+    nginx.ingress.kubernetes.io/ssl-passthrough: 'true'
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: *.node.dev.cm
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: xray
+                port:
+                  number: 443