feat(halo): 增加halo配置 & 优化apps结构
这个提交包含在：
@@ -0,0 +1,15 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: dev-cm-crt
|
||||
namespace: infra-net
|
||||
spec:
|
||||
secretName: dev-cm-crt
|
||||
issuerRef:
|
||||
name: dnspod
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
dnsNames:
|
||||
- "dev.cm"
|
||||
- "*.dev.cm"
|
||||
- "*.node.dev.cm"
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: fillcode-com-crt
|
||||
namespace: infra-net
|
||||
spec:
|
||||
secretName: fillcode-com-crt
|
||||
issuerRef:
|
||||
name: dnspod
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
dnsNames:
|
||||
- "fillcode.com"
|
||||
- "*.fillcode.com"
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: infra-net
|
||||
@@ -0,0 +1,116 @@
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: infra-net
|
||||
spec:
|
||||
repo: https://kubernetes.github.io/ingress-nginx
|
||||
chart: ingress-nginx
|
||||
version: 4.10.0
|
||||
targetNamespace: infra-net
|
||||
valuesContent: |-
|
||||
fullnameOverride: ingress-nginx
|
||||
controller:
|
||||
nodeSelector:
|
||||
svccontroller.k3s.cattle.io/enablelb: "true"
|
||||
tolerations:
|
||||
- key: "node-role.kubernetes.io/master"
|
||||
operator: "Exists"
|
||||
effect: "NoSchedule"
|
||||
labels:
|
||||
log-collecting/enabled: "true"
|
||||
kind: DaemonSet
|
||||
hostNetwork: true
|
||||
hostPort:
|
||||
enabled: true
|
||||
service:
|
||||
enabled: false
|
||||
publishService:
|
||||
enabled: false
|
||||
config:
|
||||
use-forwarded-headers: "true"
|
||||
allow-snippet-annotations: "true"
|
||||
# 缓存配置
|
||||
http-snippet: |
|
||||
proxy_cache_path /tmp/nginx-cache levels=1:2 keys_zone=cache:2m max_size=100m inactive=7d use_temp_path=off;
|
||||
proxy_cache_key $scheme$proxy_host$request_uri;
|
||||
proxy_cache_lock on;
|
||||
proxy_cache_use_stale updating;
|
||||
# dns配置
|
||||
server-snippet : |
|
||||
resolver 169.254.20.10 10.43.0.10 ipv6=off;
|
||||
# 启用geoip2模块
|
||||
use-geoip: "false"
|
||||
use-geoip2: "true"
|
||||
# 日志配置
|
||||
log-format-escape-json: "true"
|
||||
log-format-upstream: '{
|
||||
"msec": "$msec",
|
||||
"connection": "$connection",
|
||||
"connection_requests": "$connection_requests",
|
||||
"pid": "$pid",
|
||||
"request_id": "$request_id",
|
||||
"request_length": "$request_length",
|
||||
"remote_addr": "$remote_addr",
|
||||
"remote_user": "$remote_user",
|
||||
"remote_port": "$remote_port",
|
||||
"time_local": "$time_local",
|
||||
"time_iso8601": "$time_iso8601",
|
||||
"request": "$request",
|
||||
"request_uri": "$request_uri",
|
||||
"args": "$args",
|
||||
"status": "$status",
|
||||
"body_bytes_sent": "$body_bytes_sent",
|
||||
"bytes_sent": "$bytes_sent",
|
||||
"http_referer": "$http_referer",
|
||||
"http_user_agent": "$http_user_agent",
|
||||
"http_x_forwarded_for": "$http_x_forwarded_for",
|
||||
"http_host": "$http_host",
|
||||
"server_name": "$server_name",
|
||||
"request_time": "$request_time",
|
||||
"upstream": "$upstream_addr",
|
||||
"upstream_connect_time": "$upstream_connect_time",
|
||||
"upstream_header_time": "$upstream_header_time",
|
||||
"upstream_response_time": "$upstream_response_time",
|
||||
"upstream_response_length": "$upstream_response_length",
|
||||
"upstream_cache_status": "$upstream_cache_status",
|
||||
"ssl_protocol": "$ssl_protocol",
|
||||
"ssl_cipher": "$ssl_cipher",
|
||||
"scheme": "$scheme",
|
||||
"request_method": "$request_method",
|
||||
"server_protocol": "$server_protocol",
|
||||
"pipe": "$pipe",
|
||||
"gzip_ratio": "$gzip_ratio",
|
||||
"http_cf_ray": "$http_cf_ray",
|
||||
"geoip_country_code": "$geoip2_city_country_code"
|
||||
}'
|
||||
# crowdsec插件配置
|
||||
plugins: "crowdsec"
|
||||
lua-shared-dicts: "crowdsec_cache: 50m"
|
||||
# 启用geoip2模块
|
||||
maxmindLicenseKey: "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"
|
||||
extraArgs:
|
||||
default-ssl-certificate: "infra-net/dev-cm-crt"
|
||||
# crowdsec插件配置
|
||||
extraVolumes:
|
||||
- name: crowdsec-bouncer-plugin
|
||||
emptyDir: {}
|
||||
extraInitContainers:
|
||||
- name: init-clone-crowdsec-bouncer
|
||||
image: devcm/lua-bouncer-plugin
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: API_URL
|
||||
value: "http://crowdsec-service.infra-monitor.svc.cluster.local:8080"
|
||||
- name: API_KEY
|
||||
value: "rgILO2mh/t+30LMvzyyMXbfHRmDfBkDDkhEflzHaoQ0"
|
||||
- name: BOUNCER_CONFIG
|
||||
value: "/crowdsec/crowdsec-bouncer.conf"
|
||||
command: ['sh', '-c', "bash /docker_start.sh; mkdir -p /lua_plugins/crowdsec/; cp -R /crowdsec/* /lua_plugins/crowdsec/"]
|
||||
volumeMounts:
|
||||
- name: crowdsec-bouncer-plugin
|
||||
mountPath: /lua_plugins
|
||||
extraVolumeMounts:
|
||||
- name: crowdsec-bouncer-plugin
|
||||
mountPath: /etc/nginx/lua/plugins/crowdsec
|
||||
subPath: crowdsec
|
||||
@@ -0,0 +1,60 @@
|
||||
http:
|
||||
routers:
|
||||
router:
|
||||
entryPoints:
|
||||
- websecure
|
||||
rule: "Host(`router.dev.cm`)"
|
||||
service: "router@file"
|
||||
middlewares:
|
||||
- web-base
|
||||
vm:
|
||||
entryPoints:
|
||||
- websecure
|
||||
rule: "Host(`vm.dev.cm`)"
|
||||
service: "vm@file"
|
||||
middlewares:
|
||||
- web-base
|
||||
nas:
|
||||
entryPoints:
|
||||
- websecure
|
||||
rule: "Host(`nas.dev.cm`)"
|
||||
service: "nas@file"
|
||||
middlewares:
|
||||
- web-base
|
||||
download:
|
||||
entryPoints:
|
||||
- websecure
|
||||
rule: "Host(`download.dev.cm`)"
|
||||
service: "download@file"
|
||||
middlewares:
|
||||
- traefik-forward-auth
|
||||
- web-base
|
||||
downloadRpc:
|
||||
entryPoints:
|
||||
- websecure
|
||||
rule: "Host(`download.dev.cm`) && PathPrefix(`/jsonrpc`)"
|
||||
service: "downloadRpc@file"
|
||||
middlewares:
|
||||
- web-base
|
||||
|
||||
services:
|
||||
router:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://192.168.21.1/"
|
||||
vm:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "https://192.168.21.2:8006/"
|
||||
nas:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.21.3/"
|
||||
download:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.21.3:6880/"
|
||||
downloadRpc:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://192.168.21.3:6800/"
|
||||
@@ -0,0 +1,33 @@
|
||||
apiVersion: helm.cattle.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: tailscale-derp-hk
|
||||
namespace: infra-net
|
||||
spec:
|
||||
repo: https://devcm-repo.github.io/helm-charts
|
||||
chart: tailscale-derp
|
||||
version: 0.0.3
|
||||
targetNamespace: infra-net
|
||||
valuesContent: |-
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: tchk
|
||||
hostNetwork: true
|
||||
extraVolumes:
|
||||
- name: cert-volume
|
||||
secret:
|
||||
secretName: dev-cm-crt
|
||||
items:
|
||||
- key: tls.key
|
||||
path: tchk.node.dev.cm.key
|
||||
- key: tls.crt
|
||||
path: tchk.node.dev.cm.crt
|
||||
extraVolumeMounts:
|
||||
- name: cert-volume
|
||||
mountPath: /certs
|
||||
derp:
|
||||
hostname: 'tchk.node.dev.cm'
|
||||
verify_clients: true
|
||||
http_port: -1
|
||||
https_port: 30443
|
||||
stun_port: 33478
|
||||
certdir: /certs
|
||||
@@ -0,0 +1,69 @@
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
name: xray
|
||||
namespace: infra-net
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: xray
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: xray
|
||||
spec:
|
||||
volumes:
|
||||
- name: config
|
||||
secret:
|
||||
secretName: config-secret
|
||||
containers:
|
||||
- name: xray
|
||||
image: ghcr.io/xtls/xray-core:latest
|
||||
ports:
|
||||
- name: port
|
||||
containerPort: 443
|
||||
protocol: TCP
|
||||
resources: {}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
readOnly: true
|
||||
mountPath: /etc/xray/config.json
|
||||
subPath: config.json
|
||||
|
||||
----------------------------
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: xray
|
||||
namespace: vpn
|
||||
spec:
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 443
|
||||
targetPort: 443
|
||||
selector:
|
||||
app: xray
|
||||
|
||||
----------------------------
|
||||
kind: Ingress
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: xray
|
||||
namespace: infra-net
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: 'true'
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: *.node.dev.cm
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: xray
|
||||
port:
|
||||
number: 443
|
||||
在新议题中引用
屏蔽一个用户