Agosto 2025 - Git do Root C3SL

[Git][root/k8s/fluxcd][main] 2 commits: Revert "feat: remove nginx"
by MarcusVRP (＠mvreisdoefer) 08 Ago '25

08 Ago '25

MarcusVRP pushed to branch main at Root / Kubernetes / FluxCD Commits: a09c890d by marcusvrp at 2025-08-08T04:52:21-03:00 Revert "feat: remove nginx" This reverts commit 556c73cf4e431c42bd755e0923019a4c9b1d9054. - - - - - 5b280e44 by marcusvrp at 2025-08-08T04:53:19-03:00 feat(nextcloud): try using nginx snippet - - - - - 2 changed files: - apps/base/nextcloud/helmrelease.yaml - + infrastructure/base/controllers/ingress-nginx.yaml Changes: ===================================== apps/base/nextcloud/helmrelease.yaml ===================================== @@ -16,9 +16,33 @@ spec: flavor: fpm-alpine ingress: enabled: true - className: cilium + className: nginx annotations: cert-manager.io/cluster-issuer: letsencrypt-dns01 + nginx.ingress.kubernetes.io/server-snippet: |- + server_tokens off; + proxy_hide_header X-Powered-By; + rewrite ^/.well-known/webfinger /index.php/.well-known/webfinger last; + rewrite ^/.well-known/nodeinfo /index.php/.well-known/nodeinfo last; + rewrite ^/.well-known/host-meta /public.php?service=host-meta last; + rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json; + location = /.well-known/carddav { + return 301 $scheme://$host/remote.php/dav; + } + location = /.well-known/caldav { + return 301 $scheme://$host/remote.php/dav; + } + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ { + deny all; + } + location ~ ^/(?:autotest|occ|issue|indie|db_|console) { + deny all; + } tls: - secretName: nextcloud-tls hosts: @@ -78,9 +102,6 @@ spec: cronjob: enabled: true nginx: - startupProbe: - enabled: true - failureThreshold: 60 enabled: true containerPort: 8080 internalDatabase: ===================================== infrastructure/base/controllers/ingress-nginx.yaml ===================================== @@ -0,0 +1,664 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + name: ingress-nginx +--- +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx + namespace: ingress-nginx +--- +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx + namespace: ingress-nginx +rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - apiGroups: + - "" + resources: + - configmaps + - pods + - secrets + - endpoints + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - networking.k8s.io + resources: + - ingressclasses + verbs: + - get + - list + - watch + - apiGroups: + - coordination.k8s.io + resourceNames: + - ingress-nginx-leader + resources: + - leases + verbs: + - get + - update + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission + namespace: ingress-nginx +rules: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx +rules: + - apiGroups: + - "" + resources: + - configmaps + - endpoints + - nodes + - pods + - secrets + - namespaces + verbs: + - list + - watch + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.io + resources: + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - networking.k8s.io + resources: + - ingressclasses + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission +rules: + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx + namespace: ingress-nginx +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ingress-nginx +subjects: + - kind: ServiceAccount + name: ingress-nginx + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission + namespace: ingress-nginx +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ingress-nginx-admission +subjects: + - kind: ServiceAccount + name: ingress-nginx-admission + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: ingress-nginx +subjects: + - kind: ServiceAccount + name: ingress-nginx + namespace: ingress-nginx +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: ingress-nginx-admission +subjects: + - kind: ServiceAccount + name: ingress-nginx-admission + namespace: ingress-nginx +--- +apiVersion: v1 +data: null +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-controller + namespace: ingress-nginx +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-controller + namespace: ingress-nginx +spec: + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + ports: + - appProtocol: http + name: http + port: 80 + protocol: TCP + targetPort: http + - appProtocol: https + name: https + port: 443 + protocol: TCP + targetPort: https + selector: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + type: LoadBalancer +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-controller-admission + namespace: ingress-nginx +spec: + ports: + - appProtocol: https + name: https-webhook + port: 443 + targetPort: webhook + selector: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-controller + namespace: ingress-nginx +spec: + replicas: 3 + minReadySeconds: 0 + revisionHistoryLimit: 10 + selector: + matchLabels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate + template: + metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + spec: + containers: + - args: + - /nginx-ingress-controller + - --election-id=ingress-nginx-leader + - --controller-class=k8s.io/ingress-nginx + - --ingress-class=nginx + - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller + - --validating-webhook=:8443 + - --validating-webhook-certificate=/usr/local/certificates/cert + - --validating-webhook-key=/usr/local/certificates/key + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: LD_PRELOAD + value: /usr/local/lib/libmimalloc.so + image: registry.k8s.io/ingress-nginx/controller:v1.11.5@sha256:a1cbad75b0a7098bf9325132794dddf9eef917e8a7fe246749a4cea7ff6f01eb + imagePullPolicy: IfNotPresent + lifecycle: + preStop: + exec: + command: + - /wait-shutdown + livenessProbe: + failureThreshold: 5 + httpGet: + path: /healthz + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: controller + ports: + - containerPort: 80 + name: http + protocol: TCP + - containerPort: 443 + name: https + protocol: TCP + - containerPort: 8443 + name: webhook + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /healthz + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + requests: + cpu: 100m + memory: 90Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - NET_BIND_SERVICE + drop: + - ALL + readOnlyRootFilesystem: false + runAsGroup: 82 + runAsNonRoot: true + runAsUser: 101 + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /usr/local/certificates/ + name: webhook-cert + readOnly: true + dnsPolicy: ClusterFirst + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: ingress-nginx + terminationGracePeriodSeconds: 300 + volumes: + - name: webhook-cert + secret: + secretName: ingress-nginx-admission +--- +apiVersion: batch/v1 +kind: Job +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission-create + namespace: ingress-nginx +spec: + template: + metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission-create + spec: + containers: + - args: + - create + - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc + - --namespace=$(POD_NAMESPACE) + - --secret-name=ingress-nginx-admission + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4 + imagePullPolicy: IfNotPresent + name: create + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + nodeSelector: + kubernetes.io/os: linux + restartPolicy: OnFailure + serviceAccountName: ingress-nginx-admission +--- +apiVersion: batch/v1 +kind: Job +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission-patch + namespace: ingress-nginx +spec: + template: + metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission-patch + spec: + containers: + - args: + - patch + - --webhook-name=ingress-nginx-admission + - --namespace=$(POD_NAMESPACE) + - --patch-mutating=false + - --secret-name=ingress-nginx-admission + - --patch-failure-policy=Fail + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4 + imagePullPolicy: IfNotPresent + name: patch + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault + nodeSelector: + kubernetes.io/os: linux + restartPolicy: OnFailure + serviceAccountName: ingress-nginx-admission +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: nginx +spec: + controller: k8s.io/ingress-nginx +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + labels: + app.kubernetes.io/component: admission-webhook + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx + app.kubernetes.io/version: 1.12.0 + name: ingress-nginx-admission +webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: ingress-nginx-controller-admission + namespace: ingress-nginx + path: /networking/v1/ingresses + port: 443 + failurePolicy: Fail + matchPolicy: Equivalent + name: validate.nginx.ingress.kubernetes.io + rules: + - apiGroups: + - networking.k8s.io + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - ingresses + sideEffects: None View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/compare/fd3cd3b4d8e1a429bf372… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/compare/fd3cd3b4d8e1a429bf372… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] fix(nextcloud): move startupProbe to correct container
by MarcusVRP (＠mvreisdoefer) 08 Ago '25

08 Ago '25

MarcusVRP pushed to branch main at Root / Kubernetes / FluxCD Commits: fd3cd3b4 by marcusvrp at 2025-08-08T03:34:37-03:00 fix(nextcloud): move startupProbe to correct container - - - - - 1 changed file: - apps/base/nextcloud/helmrelease.yaml Changes: ===================================== apps/base/nextcloud/helmrelease.yaml ===================================== @@ -27,9 +27,6 @@ spec: enabled: true existingClaim: nextcloud-www-html nextcloud: - startupProbe: - enabled: true - failureThreshold: 60 host: nextcloud.c3sl.ufpr.br existingSecret: enabled: true @@ -81,6 +78,9 @@ spec: cronjob: enabled: true nginx: + startupProbe: + enabled: true + failureThreshold: 60 enabled: true containerPort: 8080 internalDatabase: View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/fd3cd3b4d8e1a429bf372a… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/fd3cd3b4d8e1a429bf372a… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] feat(nextcloud): generous startupProbe
by MarcusVRP (＠mvreisdoefer) 08 Ago '25

08 Ago '25

MarcusVRP pushed to branch main at Root / Kubernetes / FluxCD Commits: f92c799d by marcusvrp at 2025-08-08T02:54:19-03:00 feat(nextcloud): generous startupProbe - - - - - 1 changed file: - apps/base/nextcloud/helmrelease.yaml Changes: ===================================== apps/base/nextcloud/helmrelease.yaml ===================================== @@ -1,4 +1,4 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 +apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: nextcloud @@ -27,6 +27,9 @@ spec: enabled: true existingClaim: nextcloud-www-html nextcloud: + startupProbe: + enabled: true + failureThreshold: 60 host: nextcloud.c3sl.ufpr.br existingSecret: enabled: true View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/f92c799d376b711fcb2ac0… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/f92c799d376b711fcb2ac0… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] fix(matrix): remove rambling comments
by MarcusVRP (＠mvreisdoefer) 08 Ago '25

08 Ago '25

MarcusVRP pushed to branch main at Root / Kubernetes / FluxCD Commits: c03a86d0 by marcusvrp at 2025-08-08T02:41:55-03:00 fix(matrix): remove rambling comments - - - - - 1 changed file: - apps/base/matrix/helmrelease.yaml Changes: ===================================== apps/base/matrix/helmrelease.yaml ===================================== @@ -22,29 +22,6 @@ spec: # do not use **internal** postgres db enabled: false synapse: - # TLDR; synapse has no HA support ;-; (yet) - # https://matrix.org/blog/2020/11/03/how-we-fixed-synapse-s-scalability/ - # Note: we don't have nearly as many users as Matrix.org, so - # fine-tuning the values for our use-case would be best - # workers: - # https://docs.element.io/latest/element-server-suite-classic/advanced-config… - # client-reader: - # enabled: true - # replicas: 2 - # -> We could probably just enable everything, stress test bottenecks and - # increase replication for the bottleneck processes - # As far as we are concerned, our deployment is (very) small, sub 70 users - # as of right now, so configuring workers is pointless - # Synapse will use redis by default for pub/sub IPC when using workers, - # so we might as well enable it for caching - # redis: - # enabled: true - # Also note: workers are more of a scalability thing, not a HA thing - # We can't really have a "hot-spare/hot-replication" synapse server either, - # because of the way synapse streams deal with caching - # (matrix.org itself goes down if the server crashes, so we kinda gotta accept it) - # Best thing we can do for HA is making it come back faster, like our GitLab instance - # Another option is having a "cold-spare", but I have no idea how to do that. image: registry: harbor.c3sl.ufpr.br repository: root/synapse View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/c03a86d026ec5c17ea0313… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/c03a86d026ec5c17ea0313… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] feat(matrix): Increase HA. Kinda closes #10.
by MarcusVRP (＠mvreisdoefer) 08 Ago '25

08 Ago '25

MarcusVRP pushed to branch main at Root / Kubernetes / FluxCD Commits: 929d0379 by marcusvrp at 2025-08-08T02:22:08-03:00 feat(matrix): Increase HA. Kinda closes #10. - - - - - 1 changed file: - apps/base/matrix/helmrelease.yaml Changes: ===================================== apps/base/matrix/helmrelease.yaml ===================================== @@ -22,6 +22,29 @@ spec: # do not use **internal** postgres db enabled: false synapse: + # TLDR; synapse has no HA support ;-; (yet) + # https://matrix.org/blog/2020/11/03/how-we-fixed-synapse-s-scalability/ + # Note: we don't have nearly as many users as Matrix.org, so + # fine-tuning the values for our use-case would be best + # workers: + # https://docs.element.io/latest/element-server-suite-classic/advanced-config… + # client-reader: + # enabled: true + # replicas: 2 + # -> We could probably just enable everything, stress test bottenecks and + # increase replication for the bottleneck processes + # As far as we are concerned, our deployment is (very) small, sub 70 users + # as of right now, so configuring workers is pointless + # Synapse will use redis by default for pub/sub IPC when using workers, + # so we might as well enable it for caching + # redis: + # enabled: true + # Also note: workers are more of a scalability thing, not a HA thing + # We can't really have a "hot-spare/hot-replication" synapse server either, + # because of the way synapse streams deal with caching + # (matrix.org itself goes down if the server crashes, so we kinda gotta accept it) + # Best thing we can do for HA is making it come back faster, like our GitLab instance + # Another option is having a "cold-spare", but I have no idea how to do that. image: registry: harbor.c3sl.ufpr.br repository: root/synapse @@ -72,6 +95,7 @@ spec: database: allow_unsafe_locale: true matrixAuthenticationService: + replicas: 3 ingress: host: auth.matrix.c3sl.ufpr.br tlsSecret: mas-tls @@ -91,6 +115,7 @@ spec: configSecret: matrix configSecretKey: masOidcConfig matrixRTC: + replicas: 3 ingress: host: rtc.matrix.c3sl.ufpr.br tlsSecret: rtc-tls @@ -98,6 +123,7 @@ spec: ingress: tlsSecret: well-known-tls elementWeb: + replicas: 2 image: registry: docker.io repository: vectorim/element-web View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/929d0379ae5c94ce038b2e… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/929d0379ae5c94ce038b2e… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/services/dhcp][main] Add machines and update constantine
by Fernando K (＠fmkiotheka) 07 Ago '25

07 Ago '25

Fernando K pushed to branch main at Root / Serviços / DHCP Commits: edbdf3e4 by Fernando Monteiro Kiotheka at 2025-08-07T17:55:46-03:00 Add machines and update constantine - - - - - 1 changed file: - kea-dhcp4.conf Changes: ===================================== kea-dhcp4.conf ===================================== @@ -405,7 +405,7 @@ }, { "hostname": "constantine", - "hw-address": "00:10:18:E5:6C:E8", + "hw-address": "D4:AE:52:8F:EA:D6", "ip-address": "200.17.212.40", "user-context": { "nextbox_ip_address_id": 1705 } }, @@ -4489,6 +4489,12 @@ "ip-address": "10.254.221.79", "user-context": { "nextbox_ip_address_id": 2777 } }, + { + "hostname": "jpvr22-118", + "hw-address": "60:C7:27:2D:AE:AD", + "ip-address": "10.254.221.80", + "user-context": { "nextbox_ip_address_id": 2778 } + }, { "hostname": "deathstar", "hw-address": "70:85:C2:08:88:8B", @@ -4501,6 +4507,18 @@ "ip-address": "10.254.221.82", "user-context": { "nextbox_ip_address_id": 97 } }, + { + "hostname": "pcteste1-118", + "hw-address": "60:C7:27:29:28:A2", + "ip-address": "10.254.221.83", + "user-context": { "nextbox_ip_address_id": 2780 } + }, + { + "hostname": "pcteste2-118", + "hw-address": "60:C7:27:29:28:B7", + "ip-address": "10.254.221.84", + "user-context": { "nextbox_ip_address_id": 2781 } + }, { "hostname": "bojack", "hw-address": "70:85:C2:08:86:F7", @@ -4525,6 +4543,12 @@ "ip-address": "10.254.221.89", "user-context": { "nextbox_ip_address_id": 101 } }, + { + "hostname": "rubiks-99", + "hw-address": "60:C7:27:29:28:AC", + "ip-address": "10.254.221.90", + "user-context": { "nextbox_ip_address_id": 2779 } + }, { "hostname": "rany", "hw-address": "70:85:C2:08:88:B2", View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dhcp/-/commit/edbdf3e4c5a983858f0… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dhcp/-/commit/edbdf3e4c5a983858f0… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/services/dns][main] Add machines and update constantine
by Fernando K (＠fmkiotheka) 07 Ago '25

07 Ago '25

Fernando K pushed to branch main at Root / Serviços / DNS Commits: 496fe5eb by Fernando Monteiro Kiotheka at 2025-08-07T17:55:01-03:00 Add machines and update constantine - - - - - 4 changed files: - global-0.0.f.f.0.8.2.8.0.0.1.0.8.2.ip6.arpa.zone - global-inf.ufpr.br.zone - interna-254.10.in-addr.arpa.zone - interna-c3local.zone Changes: ===================================== global-0.0.f.f.0.8.2.8.0.0.1.0.8.2.ip6.arpa.zone ===================================== @@ -7,7 +7,7 @@ $TTL 21600 0.0.e.e.5.4.e.f.f.f.7.2.0.0.a.0.c.0 IN PTR sashimilx.inf.ufpr.br. @ IN NS ns2.c3sl.ufpr.br. @ IN NS ns.c3sl.ufpr.br. -@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1752161816 86400 7200 2592000 3600 +@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754600014 86400 7200 2592000 3600 0.3.1.e.9.d.e.f.f.f.6.6.4.9.2.d.c.0 IN PTR menotti-r85-omi7.inf.ufpr.br. 0.8.5.c.f.8.e.f.f.f.e.9.6.2.2.0.c.0 IN PTR vignatti.inf.ufpr.br. 0.8.d.8.a.7.e.f.f.f.1.5.3.c.8.1.0.1 IN PTR listas.sus.c3sl.ufpr.br. @@ -35,6 +35,7 @@ $TTL 21600 5.6.8.5.3.9.e.f.f.f.a.d.6.6.a.1.6.0 IN PTR thrawn.inf.ufpr.br. 5.a.9.d.a.0.e.f.f.f.5.1.2.2.2.0.c.0 IN PTR renato.inf.ufpr.br. 6.8.9.5.2.a.e.f.f.f.5.5.b.d.2.e.c.0 IN PTR sandman.inf.ufpr.br. +6.d.a.e.f.8.e.f.f.f.2.5.e.a.6.d.2.1 IN PTR constantine.inf.ufpr.br. 6.e.0.b.e.4.e.f.f.f.2.c.5.8.2.7.2.1 IN PTR daugman.inf.ufpr.br. 7.1.0.0.a.a.e.f.f.f.c.c.6.1.2.0.6.0 IN PTR mph.inf.ufpr.br. 7.2.0.3.2.c.e.f.f.f.8.8.7.2.2.d.c.0 IN PTR dtlntce.inf.ufpr.br. @@ -43,7 +44,6 @@ $TTL 21600 7.f.c.f.5.9.e.f.f.f.1.5.3.c.8.1.0.1 IN PTR mapas.sus.c3sl.ufpr.br. 8.4.7.f.e.0.e.f.f.f.1.6.8.d.2.0.2.1 IN PTR thanos.inf.ufpr.br. 8.d.9.d.4.6.e.f.f.f.3.6.9.a.a.f.c.0 IN PTR bereldange.inf.ufpr.br. -8.e.c.6.5.e.e.f.f.f.8.1.0.1.2.0.2.1 IN PTR constantine.inf.ufpr.br. 8.f.a.c.d.5.e.f.f.f.3.d.e.5.a.d.2.1 IN PTR peixoto.inf.ufpr.br. 9.3.c.3.d.f.e.f.f.f.1.0.e.4.2.0.2.1 IN PTR oneiros.inf.ufpr.br. 9.8.b.f.7.e.e.f.f.f.8.c.7.1.2.0.c.0 IN PTR imprlamir.inf.ufpr.br. ===================================== global-inf.ufpr.br.zone ===================================== @@ -25,7 +25,7 @@ ceib IN CNAME whiskey.c3sl.ufpr.br cinema1 IN AAAA 2801:82:80ff:a:ce96:e5ff:fe0b:b62d cinema2 IN AAAA 2801:82:80ff:a:ce96:e5ff:fe0b:b91f constantine IN A 200.17.212.40 -constantine IN AAAA 2801:82:80ff:12:210:18ff:fee5:6ce8 +constantine IN AAAA 2801:82:80ff:12:d6ae:52ff:fe8f:ead6 croisic IN A 200.17.212.180 croisic IN AAAA 2801:82:80ff:c:aa60:b6ff:fe0b:a58b daugman IN A 200.17.212.42 @@ -53,7 +53,7 @@ imprlamir IN AAAA 2801:82:80ff:c:217:c @ IN MX 0 mx.c3sl.ufpr.br. @ IN NS ns2.c3sl.ufpr.br. @ IN NS ns.c3sl.ufpr.br. -@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1753497455 86400 7200 2592000 3600 +@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754600014 86400 7200 2592000 3600 @ IN TXT "google-site-verification=JosUB9hL3B-6udQ4JGz4yVFvjPGiseXKWBo1xh9d4jw" @ IN TXT "v=spf1 a:mx.c3sl.ufpr.br mx:inf.ufpr.br mx:c3sl.ufpr.br -all" klingon IN A 200.17.212.153 ===================================== interna-254.10.in-addr.arpa.zone ===================================== @@ -444,13 +444,16 @@ $TTL 21600 79.221 IN PTR gst22-113.c3local. 79.223 IN PTR h51.c3local. 79.249 IN PTR kiev1-ipmi.c3local. +80.221 IN PTR jpvr22-118.c3local. 80.223 IN PTR h52.c3local. 80.249 IN PTR tesla1.c3local. 81.221 IN PTR deathstar.c3local. 81.223 IN PTR h53.c3local. 82.221 IN PTR trinca-ferro.c3local. 82.223 IN PTR h54.c3local. +83.221 IN PTR pcteste1-118.c3local. 83.223 IN PTR h55.c3local. +84.221 IN PTR pcteste2-118.c3local. 84.223 IN PTR h56.c3local. 85.221 IN PTR bojack.c3local. 85.223 IN PTR h57.c3local. @@ -460,6 +463,7 @@ $TTL 21600 88.221 IN PTR sherekhan.c3local. 88.223 IN PTR h60.c3local. 89.221 IN PTR daphne.c3local. +90.221 IN PTR rubiks-99.c3local. 93.221 IN PTR rany.c3local. 94.221 IN PTR sala40.c3local. 95.221 IN PTR mt1.c3local. @@ -474,4 +478,4 @@ $TTL 21600 249.227 IN PTR mojito7.c3local. @ IN NS ns2.c3sl.ufpr.br. @ IN NS ns.c3sl.ufpr.br. -@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754571004 86400 7200 2592000 3600 +@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754573110 86400 7200 2592000 3600 ===================================== interna-c3local.zone ===================================== @@ -71,7 +71,7 @@ brioja IN A 10.254.221.54 buxfox IN A 10.254.237.8 @ IN NS ns2.c3sl.ufpr.br. @ IN NS ns.c3sl.ufpr.br. -@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754571004 86400 7200 2592000 3600 +@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754573110 86400 7200 2592000 3600 caio IN A 10.254.221.1 calvin IN A 10.254.229.6 carate IN A 10.254.221.43 @@ -259,6 +259,7 @@ jatoba2-ipmi IN A 10.254.249.72 jatoba2 IN A 10.254.249.64 joe IN A 10.254.238.7 jonas IN A 10.254.232.4 +jpvr22-118 IN A 10.254.221.80 jz22-118 IN A 10.254.221.59 k11 IN A 10.254.234.11 k12 IN A 10.254.234.12 @@ -360,6 +361,8 @@ octans IN A 10.254.236.21 odin IN A 10.254.236.26 onceler IN A 10.254.221.72 organa IN A 10.254.221.65 +pcteste1-118 IN A 10.254.221.83 +pcteste2-118 IN A 10.254.221.84 pegasus IN A 10.254.236.31 penkal IN A 10.254.232.9 penkal2 IN A 10.254.255.14 @@ -400,6 +403,7 @@ roberto IN A 10.254.229.40 rootstation IN A 10.254.237.14 rpereira IN A 10.254.229.10 rubens IN A 10.254.221.67 +rubiks-99 IN A 10.254.221.90 sala40 IN A 10.254.221.94 sala103 IN A 10.254.254.6 selene IN A 10.254.221.73 View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dns/-/commit/496fe5eb848feec3544f… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dns/-/commit/496fe5eb848feec3544f… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/netbox-disks-plugin] Pushed new branch master
by adm23 (＠adm23) 07 Ago '25

07 Ago '25

adm23 pushed new branch master at Root / netbox-disks-plugin -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/netbox-disks-plugin/-/tree/master You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/dmarc-report][main] [ADD] Mudando filtros para url query, datas no formato br, ordenação de...
by Guiusepe (＠godp21) 07 Ago '25

07 Ago '25

Guiusepe pushed to branch main at Root / DMARC Report Commits: 1c73d465 by godp21 at 2025-08-07T14:53:17-03:00 [ADD] Mudando filtros para url query, datas no formato br, ordenação de resultados por min e maxdate - - - - - 2 changed files: - README.md - backend.js Changes: ===================================== README.md ===================================== @@ -3,10 +3,12 @@ [x] Renomear a rota /details?serial=:serial para /reports/details/:serial. [x] ip e ip6 tão vindo em número/bytes, dá pra vir como uma string formatada de IP. [x] Criar uma rota pra baixar o XML, algo tipo /reports/:id.xml -[ ] Adicionar um /reports/extended/ que vem com cada linha "expandida", ou seja, já vem tipo um details em cada linha. +[x] Converter as datas para padrão BR +[x] Mudar padrão de argumentos pela URL para usar query +[x] Adicionar ordenação, tipo um ?sort ou ?order, daí a ordenação padrão poderia ser ?order=-maxdate, ou seja data máxima descendente. [ ] Adicionar paginação, ?page, ?offset, algo tipo 50 resultados por página ou escolhe via ?per_page. -[ ] Adicionar ordenação, tipo um ?sort ou ?order, daí a ordenação padrão poderia ser ?order=-maxdate, ou seja data máxima descendente. +[ ] Adicionar um /reports/extended/ que vem com cada linha "expandida", ou seja, já vem tipo um details em cada linha. [ ]O dmarc_result_max é igual ao dmarc_result_min no details, dá pra só mudar pra dmarc_result, esse é tipo um "score" do que passou. ### Filtros ===================================== backend.js ===================================== @@ -5,10 +5,22 @@ const ip = require('ip') ; const { createServer } = require('node:http') ; const express = require('express') ; const app = express() ; - +const { DateTime } = require('luxon') ; // Postgres client const { Client } = require('pg') ; + +// Auxiliar functions +function convertDate(date) { + return DateTime + .fromJSDate(date, { zone: 'utc' }) + .setZone('America/Sao_Paulo') + .toFormat('dd/MM/yyyy HH:mm:ss') ; +} +//############################################################################## + + + // Postgres queries ############################################################ const xml_query = ` SELECT @@ -102,6 +114,8 @@ const reports_query = ` AS rptrecord ON report.serial = rptrecord.serial + ORDER BY + @@@@ ` ; const details_query = ` @@ -146,10 +160,32 @@ app.get('/', (req, res) => { // Reports list app.get('/reports', (req, res) => { - pgClient.query(reports_query, (err, result) => { + const { sort } = req.query ; + + var sortStr = "" ; + switch (sort) { + case "maxdate": + sortStr = "maxdate ASC" ; + break ; + case "mindate": + sortStr = "mindate ASC" ; + break ; + case "-mindate": + sortStr = "mindate DESC" ; + break ; + default: + sortStr = "maxdate DESC" ; + } + + pgClient.query(reports_query.replace("@@@@", sortStr), (err, result) => { if (err) { console.log("ERROR: Unable to run query") ; } else { + // Converting results + result["rows"].forEach((row, index) => { + row["maxdate"] = convertDate(row["maxdate"]) ; + row["mindate"] = convertDate(row["mindate"]) ; + }) ; res.send(result["rows"]) ; } }) ; @@ -157,8 +193,13 @@ app.get('/reports', (req, res) => { //############################################################################## // Individual report details -app.get('/reports/details/:serial', (req, res) => { - pgClient.query(details_query, [req.params.serial], (err, result) => { +app.get('/reports/details', (req, res) => { + const { serial } = req.query ; + if (! serial) { + res.send("No serial specified...") ; + return + } + pgClient.query(details_query, [serial], (err, result) => { if (err) { console.log("ERROR: Unable to run query") ; console.log(err) ; @@ -202,9 +243,8 @@ app.get('/reports/:serial.xml', (req, res) => { //############################################################################## app.get('/test', (req, res) => { - pgClient.query("SELECT * FROM report WHERE serial = 100000000", (err, result) => { - res.send(result) ; - }) ; + const { var1, var2, var3 } = req.query + res.send(`${var1} ${var2} ${var3}`) ; }) ; app.listen(3001, () => { View it on GitLab: https://gitlab.c3sl.ufpr.br/root/dmarc-report/-/commit/1c73d465452be71c0d46… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/dmarc-report/-/commit/1c73d465452be71c0d46… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] refactor(wordpress and rallly): move ingress to stage overlay
by yyvf22 (＠yyvf22) 07 Ago '25

07 Ago '25

yyvf22 pushed to branch main at Root / Kubernetes / FluxCD Commits: 61773852 by yyvf at 2025-08-07T11:38:24-03:00 refactor(wordpress and rallly): move ingress to stage overlay Issue #9 - - - - - 5 changed files: - apps/base/rallly/kustomization.yaml - apps/base/wordpress/kustomization.yaml - apps/stage/kustomization.yaml - apps/base/rallly/ing.yaml → apps/stage/rallly/ing.yaml - apps/base/wordpress/ing.yaml → apps/stage/wordpress/ing.yaml Changes: ===================================== apps/base/rallly/kustomization.yaml ===================================== @@ -2,6 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - deploy.yaml - - ing.yaml - ns.yaml - svc.yaml ===================================== apps/base/wordpress/kustomization.yaml ===================================== @@ -6,4 +6,3 @@ resources: - deploy.yaml - svc.yaml - pvc.yaml - - ing.yaml ===================================== apps/stage/kustomization.yaml ===================================== @@ -8,5 +8,7 @@ resources: - ../base/matrix - ../base/nextcloud - ../base/rallly + - ./rallly/ing.yaml - ../base/wordpress + - ./wordpress/ing.yaml - ../base/netbox ===================================== apps/base/rallly/ing.yaml → apps/stage/rallly/ing.yaml ===================================== ===================================== apps/base/wordpress/ing.yaml → apps/stage/wordpress/ing.yaml ===================================== View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/61773852088c2938235bc6… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/61773852088c2938235bc6… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0