ADD: added photoprism and immich manifest

k3s/apps/dashboard/dashboard-admin.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: admin-user
+  namespace: kubernetes-dashboard

k3s/apps/dashboard/getToken.sh

@@ -0,0 +1 @@
+kubectl -n kubernetes-dashboard create token admin-user

k3s/apps/dashboard/manifest.yaml

@@ -0,0 +1,303 @@
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubernetes-dashboard
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  type: NodePort
+  ports:
+    - port: 443
+      targetPort: 8443
+  selector:
+    k8s-app: kubernetes-dashboard
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-certs
+  namespace: kubernetes-dashboard
+type: Opaque
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-csrf
+  namespace: kubernetes-dashboard
+type: Opaque
+data:
+  csrf: ""
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-key-holder
+  namespace: kubernetes-dashboard
+type: Opaque
+
+---
+
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-settings
+  namespace: kubernetes-dashboard
+
+---
+
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+rules:
+  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
+    verbs: ["get", "update", "delete"]
+    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["kubernetes-dashboard-settings"]
+    verbs: ["get", "update"]
+    # Allow Dashboard to get metrics.
+  - apiGroups: [""]
+    resources: ["services"]
+    resourceNames: ["heapster", "dashboard-metrics-scraper"]
+    verbs: ["proxy"]
+  - apiGroups: [""]
+    resources: ["services/proxy"]
+    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
+    verbs: ["get"]
+
+---
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+rules:
+  # Allow Metrics Scraper to get metrics from the Metrics server
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods", "nodes"]
+    verbs: ["get", "list", "watch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubernetes-dashboard
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: kubernetes-dashboard
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubernetes-dashboard
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: kubernetes-dashboard
+
+---
+
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: kubernetes-dashboard
+  template:
+    metadata:
+      labels:
+        k8s-app: kubernetes-dashboard
+    spec:
+      containers:
+        - name: kubernetes-dashboard
+          image: kubernetesui/dashboard:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8443
+              protocol: TCP
+          args:
+            - --auto-generate-certificates
+            - --namespace=kubernetes-dashboard
+            # Uncomment the following line to manually specify Kubernetes API server Host
+            # If not specified, Dashboard will attempt to auto discover the API server and connect
+            # to it. Uncomment only if the default does not work.
+            # - --apiserver-host=http://my-address:port
+          volumeMounts:
+            - name: kubernetes-dashboard-certs
+              mountPath: /certs
+              # Create on-disk volume to store exec logs
+            - mountPath: /tmp
+              name: tmp-volume
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /
+              port: 8443
+            initialDelaySeconds: 30
+            timeoutSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
+      volumes:
+        - name: kubernetes-dashboard-certs
+          secret:
+            secretName: kubernetes-dashboard-certs
+        - name: tmp-volume
+          emptyDir: {}
+      serviceAccountName: kubernetes-dashboard
+      nodeSelector:
+        "kubernetes.io/os": linux
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: dashboard-metrics-scraper
+  name: dashboard-metrics-scraper
+  namespace: kubernetes-dashboard
+spec:
+  ports:
+    - port: 8000
+      targetPort: 8000
+  selector:
+    k8s-app: dashboard-metrics-scraper
+
+---
+
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  labels:
+    k8s-app: dashboard-metrics-scraper
+  name: dashboard-metrics-scraper
+  namespace: kubernetes-dashboard
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: dashboard-metrics-scraper
+  template:
+    metadata:
+      labels:
+        k8s-app: dashboard-metrics-scraper
+      annotations:
+        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
+    spec:
+      containers:
+        - name: dashboard-metrics-scraper
+          image: kubernetesui/metrics-scraper:v1.0.4
+          ports:
+            - containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /
+              port: 8000
+            initialDelaySeconds: 30
+            timeoutSeconds: 30
+          volumeMounts:
+          - mountPath: /tmp
+            name: tmp-volume
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
+      serviceAccountName: kubernetes-dashboard
+      nodeSelector:
+        "kubernetes.io/os": linux
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+      volumes:
+        - name: tmp-volume
+          emptyDir: {}

k3s/apps/dashboard/values.yaml

@@ -0,0 +1,452 @@
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# General configuration shared across resources
+app:
+  # Mode determines if chart should deploy a full Dashboard with all containers or just the API.
+  # - dashboard - deploys all the containers
+  # - api - deploys just the API
+  mode: 'dashboard'
+  image:
+    pullPolicy: IfNotPresent
+    pullSecrets: []
+  scheduling:
+    # Node labels for pod assignment
+    # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
+    nodeSelector: {}
+  security:
+    # Allow overriding csrfKey used by API/Auth containers.
+    # It has to be base64 encoded random 256 bytes string.
+    # If empty, it will be autogenerated.
+    csrfKey: ~
+    # SecurityContext to be added to pods
+    # To disable set the following configuration to null:
+    # securityContext: null
+    securityContext:
+      runAsNonRoot: true
+      seccompProfile:
+        type: RuntimeDefault
+    # ContainerSecurityContext to be added to containers
+    # To disable set the following configuration to null:
+    # containerSecurityContext: null
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      runAsUser: 1001
+      runAsGroup: 2001
+      capabilities:
+        drop: ["ALL"]
+    # Pod Disruption Budget configuration
+    # Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+    podDisruptionBudget:
+      enabled: false
+      minAvailable: 0
+      maxUnavailable: 0
+    networkPolicy:
+      enabled: false
+      ingressDenyAll: false
+      # Raw network policy spec that overrides predefined spec
+      # Example:
+      # spec:
+      #   egress:
+      #     - ports:
+      #         - port: 123
+      spec: {}
+
+  # Common labels & annotations shared across all deployed resources
+  labels: {}
+  annotations: {}
+  # Common priority class used for all deployed resources
+  priorityClassName: null
+  settings:
+    ## Global dashboard settings
+    global:
+    #  # Cluster name that appears in the browser window title if it is set
+    #  clusterName: ""
+    #  # Max number of items that can be displayed on each list page
+    #  itemsPerPage: 10
+    #  # Max number of labels that are displayed by default on most views.
+    #  labelsLimit: 3
+    #  # Number of seconds between every auto-refresh of logs
+    #  logsAutoRefreshTimeInterval: 5
+    #  # Number of seconds between every auto-refresh of every resource. Set 0 to disable
+    #  resourceAutoRefreshTimeInterval: 10
+    #  # Hide all access denied warnings in the notification panel
+    #  disableAccessDeniedNotifications: false
+    #  # Hide all namespaces option in namespace selection dropdown to avoid accidental selection in large clusters thus preventing OOM errors
+    #  hideAllNamespaces: false
+    #  # Namespace that should be selected by default after logging in.
+    #  defaultNamespace: default
+    #  # List of namespaces that should be presented to user without namespace list privileges.
+    #  namespaceFallbackList:
+    #  - default
+    ## Pinned resources that will be displayed in dashboard's menu
+    pinnedResources: []
+    # - kind: customresourcedefinition
+    #  #  Fully qualified name of a CRD
+    #  name: prometheus.monitoring.coreos.com
+    #  #  Display name
+    #  displayName: Prometheus
+    #  #  Is this CRD namespaced?
+    #  namespaced: true
+  ingress:
+    enabled: false
+    hosts:
+      # Keep 'localhost' host only if you want to access Dashboard using 'kubectl port-forward ...' on:
+      # https://localhost:8443
+    #  - localhost
+      - dashboard
+    #  - kubernetes.dashboard.domain.com
+    ingressClassName: internal-nginx
+    # Use only if your ingress controllers support default ingress classes.
+    # If set to true ingressClassName will be ignored and not added to the Ingress resources.
+    # It should fall back to using IngressClass marked as the default.
+    useDefaultIngressClass: false
+    # This will append our Ingress with annotations required by our default configuration.
+    #    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    #    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    #    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    useDefaultAnnotations: true
+    pathType: ImplementationSpecific
+    # If path is not the default (/), rewrite-target annotation will be added to the Ingress.
+    # It allows serving Kubernetes Dashboard on a sub-path. Make sure that the configured path
+    # does not conflict with gateway route configuration.
+    path: /
+    issuer:
+      name: selfsigned
+      # Scope determines what kind of issuer annotation will be used on ingress resource
+      # - default - adds 'cert-manager.io/issuer'
+      # - cluster - adds 'cert-manager.io/cluster-issuer'
+      # - disabled - disables cert-manager annotations
+      scope: default
+    tls:
+      enabled: true
+      # If provided it will override autogenerated secret name
+      secretName: ""
+    labels: {}
+    annotations: {}
+  # Use the following toleration if Dashboard can be deployed on a tainted control-plane nodes
+  # - key: node-role.kubernetes.io/control-plane
+  #   effect: NoSchedule
+  tolerations: []
+  affinity: {}
+
+auth:
+  role: auth
+  image:
+    repository: docker.io/kubernetesui/dashboard-auth
+    tag: 1.2.4
+  scaling:
+    replicas: 1
+    revisionHistoryLimit: 10
+  service:
+    type: ClusterIP
+    extraSpec: ~
+  containers:
+    ports:
+      - name: auth
+        containerPort: 8000
+        protocol: TCP
+    args: []
+    env: []
+    volumeMounts:
+      - mountPath: /tmp
+        name: tmp-volume
+    # TODO: Validate configuration
+    resources:
+      requests:
+        cpu: 100m
+        memory: 200Mi
+      limits:
+        cpu: 250m
+        memory: 400Mi
+  automountServiceAccountToken: true
+  volumes:
+    # Create on-disk volume to store exec logs (required)
+    - name: tmp-volume
+      emptyDir: {}
+  nodeSelector: {}
+  # Labels & annotations for Auth related resources
+  labels: {}
+  annotations: {}
+  serviceLabels: {}
+  serviceAnnotations: {}
+
+# API deployment configuration
+api:
+  role: api
+  image:
+    repository: docker.io/kubernetesui/dashboard-api
+    tag: 1.12.0
+  scaling:
+    replicas: 1
+    revisionHistoryLimit: 10
+  service:
+    type: ClusterIP
+    extraSpec: ~
+  containers:
+    ports:
+      - name: api
+        containerPort: 8000
+        protocol: TCP
+    # Additional container arguments
+    # Full list of arguments: https://github.com/kubernetes/dashboard/blob/master/docs/common/arguments.md
+    # args:
+    # - --system-banner="Welcome to the Kubernetes Dashboard"
+    args: []
+    # Additional container environment variables
+    # env:
+    # - name: SOME_VAR
+    #   value: 'some value'
+    env: []
+    # Additional volume mounts
+    # - mountPath: /kubeconfig
+    #   name: dashboard-kubeconfig
+    #   readOnly: true
+    volumeMounts:
+      # Create volume mount to store exec logs (required)
+      - mountPath: /tmp
+        name: tmp-volume
+    # TODO: Validate configuration
+    resources:
+      requests:
+        cpu: 100m
+        memory: 200Mi
+      limits:
+        cpu: 250m
+        memory: 400Mi
+  automountServiceAccountToken: true
+  # Additional volumes
+  # - name: dashboard-kubeconfig
+  #   secret:
+  #     defaultMode: 420
+  #     secretName: dashboard-kubeconfig
+  volumes:
+    # Create on-disk volume to store exec logs (required)
+    - name: tmp-volume
+      emptyDir: {}
+  nodeSelector: {}
+  # Labels & annotations for API related resources
+  labels: {}
+  annotations: {}
+  serviceLabels: {}
+  serviceAnnotations: {}
+
+# WEB UI deployment configuration
+web:
+  role: web
+  image:
+    repository: docker.io/kubernetesui/dashboard-web
+    tag: 1.6.2
+  scaling:
+    replicas: 1
+    revisionHistoryLimit: 10
+  service:
+    type: ClusterIP
+    extraSpec: ~
+  containers:
+    ports:
+      - name: web
+        containerPort: 8000
+        protocol: TCP
+    # Additional container arguments
+    # Full list of arguments: https://github.com/kubernetes/dashboard/blob/master/docs/common/arguments.md
+    # args:
+    # - --system-banner="Welcome to the Kubernetes Dashboard"
+    args: []
+    # Additional container environment variables
+    # env:
+    # - name: SOME_VAR
+    #   value: 'some value'
+    env: []
+    # Additional volume mounts
+    # - mountPath: /kubeconfig
+    #   name: dashboard-kubeconfig
+    #   readOnly: true
+    volumeMounts:
+      # Create volume mount to store logs (required)
+      - mountPath: /tmp
+        name: tmp-volume
+    # TODO: Validate configuration
+    resources:
+      requests:
+        cpu: 100m
+        memory: 200Mi
+      limits:
+        cpu: 250m
+        memory: 400Mi
+  automountServiceAccountToken: true
+  # Additional volumes
+  # - name: dashboard-kubeconfig
+  #   secret:
+  #     defaultMode: 420
+  #     secretName: dashboard-kubeconfig
+  volumes:
+    # Create on-disk volume to store exec logs (required)
+    - name: tmp-volume
+      emptyDir: {}
+  nodeSelector: {}
+  # Labels & annotations for WEB UI related resources
+  labels: {}
+  annotations: {}
+  serviceLabels: {}
+  serviceAnnotations: {}
+
+### Metrics Scraper
+### Container to scrape, store, and retrieve a window of time from the Metrics Server.
+### refs: https://github.com/kubernetes/dashboard/tree/master/modules/metrics-scraper
+metricsScraper:
+  enabled: true
+  role: metrics-scraper
+  image:
+    repository: docker.io/kubernetesui/dashboard-metrics-scraper
+    tag: 1.2.2
+  scaling:
+    replicas: 1
+    revisionHistoryLimit: 10
+  service:
+    type: ClusterIP
+    extraSpec: ~
+  containers:
+    ports:
+      - containerPort: 8000
+        protocol: TCP
+    args: []
+    # Additional container environment variables
+    # env:
+    # - name: SOME_VAR
+    #   value: 'some value'
+    env: []
+    # Additional volume mounts
+    # - mountPath: /kubeconfig
+    #   name: dashboard-kubeconfig
+    #   readOnly: true
+    volumeMounts:
+      # Create volume mount to store logs (required)
+      - mountPath: /tmp
+        name: tmp-volume
+    # TODO: Validate configuration
+    resources:
+      requests:
+        cpu: 100m
+        memory: 200Mi
+      limits:
+        cpu: 250m
+        memory: 400Mi
+    livenessProbe:
+      httpGet:
+        scheme: HTTP
+        path: /
+        port: 8000
+      initialDelaySeconds: 30
+      timeoutSeconds: 30
+  automountServiceAccountToken: true
+  # Additional volumes
+  # - name: dashboard-kubeconfig
+  #   secret:
+  #     defaultMode: 420
+  #     secretName: dashboard-kubeconfig
+  volumes:
+    - name: tmp-volume
+      emptyDir: {}
+  nodeSelector: {}
+  # Labels & annotations for Metrics Scraper related resources
+  labels: {}
+  annotations: {}
+  serviceLabels: {}
+  serviceAnnotations: {}
+
+## Optional Metrics Server sub-chart configuration
+## Enable this if you don't already have metrics-server enabled on your cluster and
+## want to use it with dashboard metrics-scraper
+## refs:
+##  - https://github.com/kubernetes-sigs/metrics-server
+##  - https://github.com/kubernetes-sigs/metrics-server/tree/master/charts/metrics-server
+metrics-server:
+  enabled: false
+  args:
+    - --kubelet-preferred-address-types=InternalIP
+    - --kubelet-insecure-tls
+
+## Required Kong sub-chart with DBless configuration to act as a gateway
+## for our all containers.
+kong:
+  enabled: true
+  ## Configuration reference: https://docs.konghq.com/gateway/3.6.x/reference/configuration
+  env:
+    dns_order: LAST,A,CNAME,AAAA,SRV
+    plugins: 'off'
+    nginx_worker_processes: 1
+  ingressController:
+    enabled: false
+  manager:
+    enabled: false
+  dblessConfig:
+    configMap: kong-dbless-config
+  proxy:
+    type: ClusterIP
+    http:
+      enabled: false
+
+## Optional Cert Manager sub-chart configuration
+## Enable this if you don't already have cert-manager enabled on your cluster.
+cert-manager:
+  enabled: false
+  installCRDs: true
+
+## Optional Nginx Ingress sub-chart configuration
+## Enable this if you don't already have nginx-ingress enabled on your cluster.
+nginx:
+  enabled: false
+  controller:
+    electionID: ingress-controller-leader
+    ingressClassResource:
+      name: internal-nginx
+      default: false
+      controllerValue: k8s.io/internal-ingress-nginx
+    service:
+      type: ClusterIP
+
+## Extra configurations:
+## - manifests
+## - predefined roles
+## - prometheus
+## - etc...
+extras:
+  # Extra Kubernetes manifests to be deployed
+  # manifests:
+  # - apiVersion: v1
+  #   kind: ConfigMap
+  #   metadata:
+  #     name: additional-configmap
+  #   data:
+  #     mykey: myvalue
+  manifests: []
+  serviceMonitor:
+    # Whether to create a Prometheus Operator service monitor.
+    enabled: false
+    # Here labels can be added to the serviceMonitor
+    labels: {}
+    # Here annotations can be added to the serviceMonitor
+    annotations: {}
+    # metrics.serviceMonitor.metricRelabelings Specify Metric Relabelings to add to the scrape endpoint
+    # ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig
+    metricRelabelings: []
+    # metrics.serviceMonitor.relabelings [array] Prometheus relabeling rules
+    relabelings: []
+    # ServiceMonitor connection scheme. Defaults to HTTPS.
+    scheme: https
+    # ServiceMonitor connection tlsConfig. Defaults to {insecureSkipVerify:true}.
+    tlsConfig:
+      insecureSkipVerify: true

k3s/apps/gitea/gitea.yaml

@@ -0,0 +1,185 @@
+# Namespace
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
+
+# PV + PVC: Gitea (NFS)
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: gitea-pv
+spec:
+  storageClassName: nfs
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.178.132
+    path: /slowData/gitea/repos
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-pvc
+  namespace: gitea
+spec:
+  storageClassName: nfs
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 30Gi
+
+# PV + PVC: PostgreSQL (NFS)
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: postgres-pv
+spec:
+  storageClassName: nfs
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  nfs:
+    server: 192.168.178.132
+    path: /slowData/gitea/postgres
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres-pvc
+  namespace: gitea
+spec:
+  storageClassName: nfs
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+
+# Deployment: PostgreSQL
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:13
+          env:
+            - name: POSTGRES_DB
+              value: gitea
+            - name: POSTGRES_USER
+              value: gitea
+            - name: POSTGRES_PASSWORD
+              value: giteapassword
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: postgres-storage
+              mountPath: /var/lib/postgresql/data
+      volumes:
+        - name: postgres-storage
+          persistentVolumeClaim:
+            claimName: postgres-pvc
+
+# Service: PostgreSQL
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: gitea
+spec:
+  selector:
+    app: postgres
+  ports:
+    - protocol: TCP
+      port: 5432
+      targetPort: 5432
+
+# Deployment: Gitea
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea
+  template:
+    metadata:
+      labels:
+        app: gitea
+    spec:
+      containers:
+        - name: gitea
+          image: gitea/gitea:latest
+          env:
+            - name: USER_UID
+              value: "1000"
+            - name: USER_GID
+              value: "1000"
+            - name: GITEA__database__DB_TYPE
+              value: postgres
+            - name: GITEA__database__HOST
+              value: postgres:5432
+            - name: GITEA__database__NAME
+              value: gitea
+            - name: GITEA__database__USER
+              value: gitea
+            - name: GITEA__database__PASSWD
+              value: giteapassword
+          ports:
+            - containerPort: 3000   # HTTP
+            - containerPort: 22     # SSH
+          volumeMounts:
+            - name: gitea-storage
+              mountPath: /data
+      volumes:
+        - name: gitea-storage
+          persistentVolumeClaim:
+            claimName: gitea-pvc
+
+# Service: Gitea (inkl. SSH)
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  selector:
+    app: gitea
+  type: NodePort  # Alternativ: LoadBalancer für Clouds
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: 3000
+    - name: ssh
+      protocol: TCP
+      port: 22
+      targetPort: 22

k3s/apps/photo/icloudpd/base64pw.sh

@@ -0,0 +1 @@
+echo -n 'Z6x3h5xy569' | base64

k3s/apps/photo/icloudpd/icloud-secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: icloudpd-secret
+  namespace: photoprism
+type: Opaque
+data:
+  apple_password: WjZ4M2g1eHk1Njk=

k3s/apps/photo/icloudpd/icloudpd.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: icloudpd
+  namespace: photoprism
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: icloudpd
+  template:
+    metadata:
+      labels:
+        app: icloudpd
+    spec:
+      containers:
+        - name: icloudpd
+          image: r3d454/iclouddownloader:latest
+#          image: r3d454/dockericloudpd:latest
+          env:
+            - name: apple_id
+              value: "Henry-Winkel@web.de"
+            - name: apple_password
+              valueFrom:
+                secretKeyRef:
+                  name: icloudpd-secret
+                  key: apple_password
+            - name: download_path
+              value: "/data/originals"
+            - name: authentication_type
+              value: "Web"
+            - name: directory_permissions
+              value: "777"
+            - name: file_permissions
+              value: "777"
+            - name: set_exif_datetime
+              value: "false"
+            - name: auto_delete
+              value: "False"
+          volumeMounts:
+            - name: icloudpd-storage
+              mountPath: /data/
+      volumes:
+        - name: icloudpd-storage
+          persistentVolumeClaim:
+            claimName: photoprism-storage
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: icloudpd-service
+  namespace: photoprism
+spec:
+  selector:
+    app: icloudpd
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+  type: NodePort

k3s/apps/photo/immich/immich-configmap.yaml

@@ -0,0 +1,23 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: immich-env
+  namespace: photoprism
+  labels:
+    app: immich
+data:
+  DB_DATABASE_NAME: "immich"
+  DB_HOSTNAME: "immich-database"
+  DB_USERNAME: "immich"
+  IMMICH_MACHINE_LEARNING_URL: "http://immich-machine-learning:3003"
+#  REDIS_HOSTNAME: "redis-server.redis-server.svc.cluster.local"
+  REDIS_HOSTNAME: "redis-server"
+  REDIS_PORT: "6379"
+  REDIS_DBINDEX: "0"
+  REDIS_PASSWORD: ""
+  DISABLE_REVERSE_GEOCODING: "false"
+  REVERSE_GEOCODING_PRECISION: "2"
+  PUBLIC_LOGIN_PAGE_MESSAGE: ""
+  PUID: "0"
+  PGID: "0"
+  DB_PASSWORD: "password"

k3s/apps/photo/immich/immich-db-deployment.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: immich-database
+  namespace: photoprism
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: immich-database
+  template:
+    metadata:
+      labels:
+        app: immich-database
+    spec:
+      containers:
+        - name: immich-postgres
+          image: "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0"
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: immich-env
+                  key: DB_USERNAME
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                configMapKeyRef:
+                  name: immich-env
+                  key: DB_PASSWORD
+            - name: POSTGRES_DB
+              valueFrom:
+                configMapKeyRef:
+                  name: immich-env
+                  key: DB_DATABASE_NAME
+          volumeMounts:
+            - name: pgdata
+              mountPath: /var/lib/postgresql/data
+              subPath: postgres
+          resources: {}
+      volumes:
+        - name: pgdata
+          persistentVolumeClaim:
+            claimName: immich-db-pvc

k3s/apps/photo/immich/immich-db-pv.yaml

@@ -0,0 +1,17 @@
+kind: PersistentVolume
+apiVersion: v1
+metadata:
+  name: immich-db-pv
+  namespace: photoprism
+  labels:
+    app: immich-postgresql
+spec:
+  capacity:
+    storage: 20Gi  # Adjust the storage size as needed
+  storageClassName: nfs
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /slowData/immichDB  # Static path on the NFS server
+    server: 192.168.178.132               # Your NFS server's IP
+  persistentVolumeReclaimPolicy: Retain

k3s/apps/photo/immich/immich-db-pvc.yaml

@@ -0,0 +1,15 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: immich-db-pvc
+  namespace: photoprism
+  labels:
+    app: immich
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 20Gi  # Match or be less than the PV's capacity
+  volumeName: immich-db-pv  # Bind explicitly to the PV created above
+  storageClassName: nfs

k3s/apps/photo/immich/immich-db-service.yaml

@@ -0,0 +1,15 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: immich-database
+  namespace: photoprism
+  labels:
+    app: immich-database
+spec:
+  type: ClusterIP
+  selector:
+    app: immich-database
+  ports:
+    - name: tcp-postgresql
+      port: 5432
+      targetPort: 5432

k3s/apps/photo/immich/immich-library-pv.yaml

@@ -0,0 +1,16 @@
+kind: PersistentVolume
+apiVersion: v1
+metadata:
+  name: immich-library-pv
+  namespace: immich
+  labels:
+    app: immich
+spec:
+  capacity:
+    storage: 50Gi  # Adjust the storage size as needed
+  storageClassName: nfs
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    path: /fastData/immichLibrary  # Static path on the NFS server
+    server: 192.168.178.132

k3s/apps/photo/immich/immich-library-pvc.yaml

@@ -0,0 +1,15 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: immich-library-pvc
+  namespace: photoprism
+  labels:
+    app: immich
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 50Gi  # Match or be less than the PV's capacity
+  volumeName: immich-library-pv  # Bind explicitly to the PV created above
+  storageClassName: nfs

k3s/apps/photo/immich/immich-ml-deployment.yaml

@@ -0,0 +1,65 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: immich-machine-learning
+  namespace: photoprism
+  labels:
+    app: immich-machine-learning
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: immich-machine-learning
+  template:
+    metadata:
+      labels:
+        app: immich-machine-learning
+    spec:
+      securityContext:
+        fsGroup: 0
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      dnsPolicy: ClusterFirst
+      enableServiceLinks: true
+      containers:
+        - name: immich-machine-learning
+          image: "ghcr.io/immich-app/immich-machine-learning:release"
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3003
+          env:
+            - name: DB_PASSWORD
+              valueFrom:
+                configMapKeyRef:
+                  name: immich-env
+                  key: DB_PASSWORD
+            - name: TRANSFORMERS_CACHE
+              value: /cache
+          envFrom:
+            - configMapRef:
+                name: immich-env
+                optional: false
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /ping
+              port: 3003
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            timeoutSeconds: 1
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /ping
+              port: 3003
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            timeoutSeconds: 1
+          volumeMounts:
+            - name: cache
+              mountPath: /cache
+          resources: {}
+      volumes:
+        - name: cache
+          emptyDir: {}

k3s/apps/photo/immich/immich-ml-service.yaml

@@ -0,0 +1,15 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: immich-machine-learning
+  namespace: photoprism
+  labels:
+    app: immich-machine-learning
+spec:
+  type: ClusterIP
+  selector:
+    app: immich-machine-learning
+  ports:
+    - port: 3003
+      targetPort: 3003
+      protocol: TCP

k3s/apps/photo/immich/immich-server-deployment.yaml

@@ -0,0 +1,97 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: immich-server
+  namespace: photoprism
+  labels:
+    app: immich-server
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: immich-server
+  template:
+    metadata:
+      labels:
+        app: immich-server
+      annotations:
+        k8s.v1.cni.cncf.io/networks: |
+          [{
+            "name": "multus-iot",
+            "namespace": "default",
+            "mac": "2e:f8:57:99:6e:31",
+            "ips": ["192.168.1.192/24"]
+          }]
+    spec:
+      securityContext:
+        fsGroup: 0
+      serviceAccountName: default
+      dnsPolicy: ClusterFirst
+      initContainers:
+        - name: postgresql-isready
+          image: "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0"
+          imagePullPolicy: Always
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                configMapKeyRef:
+                  name: immich-env
+                  key: DB_USERNAME
+            - name: POSTGRES_DB
+              valueFrom:
+                configMapKeyRef:
+                  name: immich-env
+                  key: DB_DATABASE_NAME
+          command:
+            - /bin/sh
+            - -c
+            - until pg_isready -U "${POSTGRES_USER}" -d "dbname=${POSTGRES_DB}"
+              -h immich-database -p 5432 ; do sleep 2 ; done
+      containers:
+        - name: immich-server
+          image: "ghcr.io/immich-app/immich-server:release"
+          imagePullPolicy: Always
+          securityContext:
+            runAsUser: 0
+          ports:
+            - containerPort: 3001
+          env:
+            - name: DB_PASSWORD
+              valueFrom:
+                configMapKeyRef:
+                  name: immich-env
+                  key: DB_PASSWORD
+          envFrom:
+            - configMapRef:
+                name: immich-env
+                optional: false
+          livenessProbe:
+            failureThreshold: 120
+            httpGet:
+              path: /server/ping
+              port: 2283
+            initialDelaySeconds: 10
+            periodSeconds: 120
+            timeoutSeconds: 1
+          readinessProbe:
+            failureThreshold: 120
+            httpGet:
+              path: /server/ping
+              port: 2283
+            initialDelaySeconds: 10
+            periodSeconds: 120
+            timeoutSeconds: 1
+          volumeMounts:
+            - name: library
+              mountPath: /usr/src/app/upload
+              subPath: library
+            - name: ext-library
+              mountPath: /photos
+      volumes:
+        - name: library
+          persistentVolumeClaim:
+            claimName: immich-library-pvc
+        - name: ext-library
+          persistentVolumeClaim:
+            claimName: photoprism-storage

k3s/apps/photo/immich/immich-server-service.yaml

@@ -0,0 +1,15 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: immich-server
+  namespace: photoprism
+  labels:
+    app: immich-server
+spec:
+  type: NodePort
+  selector:
+    app: immich-server
+  ports:
+    - port: 2283
+      targetPort: 2283
+      protocol: TCP

k3s/apps/photo/immich/redis-deployment.yaml

@@ -0,0 +1,45 @@
+#apiVersion: v1
+#kind: Namespace
+#metadata:
+#  name: redis-server
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis-server
+  namespace: photoprism
+  labels:
+    app: redis-server
+spec:
+  selector:
+    matchLabels:
+      app: redis-server
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: redis-server
+    spec:
+      containers:
+        - image: redis:alpine
+          name: redis-server
+          ports:
+            - containerPort: 6379
+      restartPolicy: Always
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-server
+  namespace: photoprism
+  labels:
+    app: redis-server
+spec:
+  ports:
+    - port: 6379
+  selector:
+    app: redis-server

k3s/apps/photo/photoprism/mariadb-pv.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mariadb-pv
+spec:
+  capacity:
+    storage: 50Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain  # Optional: verhindert, dass K8s dein Share löscht
+  storageClassName: local-path
+  hostPath:
+    path: /slowData/photoprismDB

k3s/apps/photo/photoprism/mariadb.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mariadb
+  namespace: photoprism
+spec:
+  storageClassName: local-path
+  volumeName: mariadb-pv
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 50Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mariadb
+  namespace: photoprism
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mariadb
+  template:
+    metadata:
+      labels:
+        app: mariadb
+    spec:
+      containers:
+        - name: mariadb
+          image: mariadb:10.11
+          env:
+            - name: MYSQL_ROOT_PASSWORD
+              value: photoprism
+            - name: MYSQL_DATABASE
+              value: photoprism
+            - name: MYSQL_USER
+              value: photoprism
+            - name: MYSQL_PASSWORD
+              value: photoprism
+          volumeMounts:
+            - mountPath: /var/lib/mysql
+              name: mariadb
+      volumes:
+        - name: mariadb
+          persistentVolumeClaim:
+            claimName: mariadb
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mariadb
+  namespace: photoprism
+spec:
+  type: ClusterIP
+  selector:
+    app: mariadb
+  ports:
+    - port: 3306

k3s/apps/photo/photoprism/photoprism.yaml

@@ -0,0 +1,98 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: photoprism-storage
+  namespace: photoprism
+spec:
+  storageClassName: nfs
+  volumeName: nfs-pv
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 50Gi
+---
+#apiVersion: v1
+#kind: PersistentVolumeClaim
+#metadata:
+#  name: photoprism-originals
+#  namespace: photoprism
+#spec:
+#  storageClassName: nfs
+#  volumeName: nfs-pv
+#  accessModes:
+#    - ReadWriteMany
+#  resources:
+#    requests:
+#      storage: 100Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: photoprism
+  namespace: photoprism
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: photoprism
+  template:
+    metadata:
+      labels:
+        app: photoprism
+    spec:
+      containers:
+        - name: photoprism
+          image: photoprism/photoprism
+          env:
+            - name: PHOTOPRISM_ADMIN_USER
+              value: admin
+            - name: PHOTOPRISM_ADMIN_PASSWORD
+              value: photoprism
+            - name: PHOTOPRISM_AUTH_MODE
+              value: password
+            - name: PHOTOPRISM_SITE_URL
+              value: https://photoprism.henryathome.home64.de
+            - name: PHOTOPRISM_INDEX_WORKERS
+              value: "3"
+            - name: PHOTOPRISM_INDEX_SCHEDULE
+              value: "@every 3h"
+            # DB
+            - name: PHOTOPRISM_DATABASE_DRIVER
+              value: mysql
+            - name: PHOTOPRISM_DATABASE_SERVER
+              value: mariadb:3306
+            - name: PHOTOPRISM_DATABASE_NAME
+              value: photoprism
+            - name: PHOTOPRISM_DATABASE_USER
+              value: photoprism
+            - name: PHOTOPRISM_DATABASE_PASSWORD
+              value: photoprism
+          volumeMounts:
+            - mountPath: /photoprism/
+              name: photoprism-storage
+#            - mountPath: /photoprism/storage
+#              name: photoprism-storage
+#            - mountPath: /photoprism/originals
+#              name: photoprism-storage
+#              name: photoprism-originals
+      volumes:
+        - name: photoprism-storage
+          persistentVolumeClaim:
+            claimName: photoprism-storage
+#        - name: photoprism-originals
+#          persistentVolumeClaim:
+#            claimName: photoprism-originals
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: photoprism
+  namespace: photoprism
+spec:
+  type: NodePort
+  selector:
+    app: photoprism
+  ports:
+    - port: 2342
+