add config to traefik for gitea

README.md

@@ -26,12 +26,22 @@ Set Root-Password (by hand)
 # groupadd containers
 # useradd -m -g containers containers
 # passwd containers
+
+For containers User, add the following to ~/.bash_profile:
+
+# User specific environment and startup programs
+export XDG_RUNTIME_DIR=/run/user/$(id -u)
+
 # hostnamectl set-hostname onyx.nbit.ch
 # timedatectl set-timezone Europe/Zurich
 # dnf install glibc-langpack-de
 # localectl set-locale LANG=en_US.UTF-8
 # localectl set-locale LC_TIME=de_CH.UTF-8
 
+Set Journalctl-Config to persistent Storage:
+/etc/systemd/journald.conf:
+Storage=persistent
+
 # Enable Selinux in Enforcing Mode: change /etc/selinux/config
 # dnf install setroubleshoot
 `
@@ -47,6 +57,8 @@ enable EPEL Repo:
 # dnf install firewalld
 # firewall-cmd --add-service={http,https} --permanent
 # firewall-cmd --remove-service=cockpit --permanent
+# firewall-cmd --add-port=1883/tcp --permanent   ; only for MQTT
+# firewall-cmd --add-port=25/tcp --permanent     ; for Postfix
 # firewall-cmd --reload
 
 List Rules:
@@ -71,6 +83,7 @@ command to check who is banned:
 ## Install Software
 
 ```bash
+# dnf install passt
 # dnf install git
 # dnf install podman
 # dnf install jq
@@ -182,7 +195,6 @@ if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)
 
 ### Setup Env for Podman
 
-we use /data/<podname> for persitent data:
 ```bash
 # mkdir /data
 # chown containers:containers /data
@@ -192,6 +204,18 @@ Set Defaults:
 containers$ cat ~/.config/containers/containers.conf
 [network]
 network_backend = "netavark"
+
+
+Credentials for Docker Registry should be available after Reboot
+
+[containers@onyx-dev ~]$ podman login git.nbit.ch
+Username: jlehmann
+Password:
+Login Succeeded!
+
+[containers@onyx-dev ~]$ cp /run/user/1000/containers/auth.json ~/.config/containers/auth.json
+
+
 ```
 
 ### Setup Traefik
@@ -234,6 +258,29 @@ export XDG_RUNTIME_DIR=/run/user/$(id -u)
 containers$ touch /data/traefik/acme.json
 containers$ chmod 0600 /data/traefik/acme.json
 
+!!!!!!!!!!!!!!
+IMPORTANT: we changed the startup Method to Quadlets, put into
+~containers/.config/containers/systemd/
+
+See also https://www.redhat.com/sysadmin/quadlet-podman
+
+Example of such a quadlet config (Network=pasta is not to be used for Traefik):
+
+[containers@onyx-dev ~]$ more ~containers/.config/containers/systemd/onyx-dev-mqtt.kube
+[Unit]
+Description=MQTT
+Before=local-fs.target
+
+[Kube]
+Yaml=/home/containers/onyx-dev_pods/mqtt/mqtt.yaml
+LogDriver=journald
+Network=pasta
+
+[Install]
+# Start by default on boot
+WantedBy=multi-user.target default.target
+!!!!!!!!!!!!!!
+
 containers$ mkdir -p ~/.config/systemd/user/
 containers$ cd ~/.config/systemd/user/
 
@@ -257,7 +304,45 @@ containers$ systemctl --user start podman-kube@$escaped.service
 containers$ systemctl --user enable podman-kube@$escaped.service
 ```
 
+## Postfix
 
+```bash
+# dnf install postfix
+
+/etc/postfix/main.cf:
+---
+inet_interfaces = all
+
+smtpd_tls_security_level = none
+
+virtual_alias_domains = wo-bisch.ch mini-beieli.ch
+virtual_alias_maps = hash:/etc/postfix/virtual
+---
+
+# tail -12 /etc/postfix/virtual
+abuse@mini-beieli.ch nbitinf@nbit.ch
+hostmaster@mini-beieli.ch nbitinf@nbit.ch
+info@mini-beieli.ch nbitinf@nbit.ch
+mail@mini-beieli.ch nbitinf@nbit.ch
+postmaster@mini-beieli.ch nbitinf@nbit.ch
+register@mini-beieli.ch nbitinf@nbit.ch
+abuse@wo-bisch.ch nbitinf@nbit.ch
+hostmaster@wo-bisch.ch nbitinf@nbit.ch
+info@wo-bisch.ch nbitinf@nbit.ch
+mail@wo-bisch.ch nbitinf@nbit.ch
+postmaster@wo-bisch.ch nbitinf@nbit.ch
+register@wo-bisch.ch nbitinf@nbit.ch
+
+# postmap /etc/postfix/virtual
+
+# systemctl enable postfix
+# systemctl start postfix
+
+Creat DNS Records:
+mx1.nbit.ch and mx2.nbit.ch (A/AAAA Records to the same IPs as onyx and onyx-dev)
+
+Change SPF Records to include mx1 and mx2
+```
 
 ## Secondary Nameserver
 
@@ -309,3 +394,7 @@ on master:
 
 
 ```
+
+Read Rights for Grafana Agent:
+
+# setfacl -R -m u:grafana-agent:rX /var/log

gitea/README.md

@@ -0,0 +1,7 @@
+
+Config of Gitea is done in config/app.ini
+
+To disable the possibility to self-register:
+
+[root@onyx ~]# grep DISABLE_REGISTRATION /data/gitea/config/app.ini
+DISABLE_REGISTRATION              = true

gitea/gitea.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    io.kubernetes.cri-o.TTY/gitea: "false"
+    io.podman.annotations.autoremove/gitea: "FALSE"
+    io.podman.annotations.init/gitea: "FALSE"
+    io.podman.annotations.label/gitea: type:container_runtime_t
+    io.podman.annotations.privileged/gitea: "FALSE"
+    io.podman.annotations.publish-all/gitea: "FALSE"
+  labels:
+    app: gitea-pod
+  name: gitea-pod
+spec:
+  containers:
+  - image: docker.io/gitea/gitea:latest-rootless
+    name: gitea
+    ports:
+    - containerPort: 3000
+      hostPort: 9080
+      hostIP: 127.0.0.1
+    securityContext:
+      capabilities:
+        drop:
+        - CAP_MKNOD
+        - CAP_AUDIT_WRITE
+    volumeMounts:
+    - mountPath: /var/lib/gitea
+      name: data-gitea-data-0
+    - mountPath: /etc/gitea
+      name: data-gitea-config-0
+    - mountPath: /etc/timezone
+      name: etc-timezone-0
+      readOnly: true
+    - mountPath: /etc/localtime
+      name: etc-localtime-0
+      readOnly: true
+  volumes:
+  - hostPath:
+      path: /data/gitea/data
+      type: Directory
+    name: data-gitea-data-0
+  - hostPath:
+      path: /data/gitea/config
+      type: Directory
+    name: data-gitea-config-0
+  - hostPath:
+      path: /etc/timezone
+      type: File
+    name: etc-timezone-0
+  - hostPath:
+      path: /etc/localtime
+      type: File
+    name: etc-localtime-0

minibeieli/minibeieli.yaml

@@ -2,10 +2,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/minibeieli/influxdb: z
-    bind-mount-options:/data/minibeieli/redis: z
-    bind-mount-options:/data/minibeieli/lorahandlerdata: z
-    bind-mount-options:/home/containers/onyx_pods/minibeieli/telegraf.conf: z
     io.kubernetes.cri-o.TTY/minibeieli: "false"
     io.podman.annotations.autoremove/minibeieli: "FALSE"
     io.podman.annotations.init/minibeieli: "FALSE"
@@ -18,8 +14,10 @@ metadata:
 spec:
   containers:
   - name: mini-beieli-web
-    image: registry.gitlab.com/drpuur/mini-beieli-web:2022122601
+    image: git.nbit.ch/drpuur/mini-beieli-web:2025092001
     env:
+    - name: CONFIG_ENVVAR
+      value: nbit Informatik GmbH<br />Untere Stockteile 16<br />3806 B&ouml;nigen b. Interlaken<br /><br />+41 31 792 00 40<br /><a href='&#109;ai&#108;&#116;o&#58;i&#37;6Ef&#111;&#64;%6Ebi&#116;&#46;%63h'>&#105;nfo&#64;nbit&#46;ch</a>,CHF 200.--,CHF 80.--
     - name: REDIS_CONNECTION_STRING
       value: 127.0.0.1:6379
     - name: INFLUX_URL
@@ -31,7 +29,7 @@ spec:
     - name: STRIPE_PK
       value: pk_live_G9vgPopd9opsY81AfzguwMrq
     - name: MAILSERVER_HOST
-      value: mail.nbit.ch
+      value: 127.0.0.1
     ports:
     - containerPort: 4000
       hostPort: 9070
@@ -43,7 +41,7 @@ spec:
         - CAP_NET_RAW
         - CAP_AUDIT_WRITE
   - name: mini-beieli-lorahandler
-    image: registry.gitlab.com/drpuur/mini-beieli-lorahandler:2022122601
+    image: git.nbit.ch/drpuur/mini-beieli-lorahandler:2022122801
     env:
     - name: REDIS_CONNECTION_STRING
       value: 127.0.0.1:6379
@@ -61,10 +59,10 @@ spec:
     - mountPath: /data
       name: lorahandlerdata
   - name: influxdb
-    image: docker.io/library/influxdb:2.6
+    image: docker.io/library/influxdb:2.7
     ports:
     - containerPort: 8086
-      hostPort: 8086
+      hostPort: 9072
     resources: {}
     securityContext:
       capabilities:
@@ -80,6 +78,7 @@ spec:
     args: ["--save 60 1", "--loglevel warning"]
     ports:
     - containerPort: 5432
+      hostPort: 9073
     resources: {}
     securityContext:
       capabilities:
@@ -98,6 +97,8 @@ spec:
         drop:
         - CAP_MKNOD
         - CAP_AUDIT_WRITE
+        add:
+        - CAP_NET_RAW
     volumeMounts:
     - mountPath: /data
       name: lorahandlerdata

nbitwebsite/nbitwebsite.yaml

@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/nbitwebsite/document_root: z
     io.kubernetes.cri-o.TTY/nbitwebsite: "false"
     io.podman.annotations.autoremove/nbitwebsite: "FALSE"
     io.podman.annotations.init/nbitwebsite: "FALSE"
@@ -29,8 +28,14 @@ spec:
     volumeMounts:
     - mountPath: /usr/share/nginx/html
       name: data-nbitwebsite-host-0
+    - mountPath: /etc/nginx/conf.d
+      name: data-nbitwebsite-config-0
   volumes:
   - hostPath:
       path: /data/nbitwebsite/document_root
       type: Directory
     name: data-nbitwebsite-host-0
+  - hostPath:
+      path: /data/nbitwebsite/conf.d
+      type: Directory
+    name: data-nbitwebsite-config-0

nbitwiki/nbitwiki.yaml

@@ -3,7 +3,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/nbitwiki/config: z
     io.kubernetes.cri-o.TTY/nbitwiki: "false"
     io.podman.annotations.autoremove/nbitwiki: "FALSE"
     io.podman.annotations.init/nbitwiki: "FALSE"

traefik/configuration/gitea.yml

@@ -0,0 +1,17 @@
+http:
+  routers:
+    gitea:
+      entrypoints:
+      - websecure
+      tls:
+        certresolver: "myresolver"
+        domains:
+          - main: "git.nbit.ch"
+      rule: "Host(`git.nbit.ch`)"
+      service: gitea
+
+  services:
+    gitea:
+      loadBalancer:
+        servers:
+        - url: http://127.0.0.1:9080/

traefik/configuration/minibeieli.yml

@@ -8,7 +8,7 @@ http:
         domains:
           - main: "mini-beieli.ch"
             sans: "www.mini-beieli.ch"
-      rule: "Host(`mini-beieli.ch`,`www.mini-beieli.ch`)"
+      rule: "Host(`mini-beieli.ch`) || Host(`www.mini-beieli.ch`)"
       service: minibeieli-web
 
     minibeieli-lorahandler:
@@ -19,7 +19,7 @@ http:
         domains:
           - main: "mini-beieli.ch"
             sans: "www.mini-beieli.ch"
-      rule: "Host(`mini-beieli.ch`,`www.mini-beieli.ch`) && PathPrefix(`/lorahandler`)"
+      rule: "Host(`mini-beieli.ch`) && PathPrefix(`/lorahandler`) || Host(`www.mini-beieli.ch`) && PathPrefix(`/lorahandler`)"
       service: minibeieli-lorahandler
 
   services:

traefik/configuration/nbitwebsite.yml

@@ -7,8 +7,8 @@ http:
         certresolver: "myresolver"
         domains:
           - main: "nbit.ch"
-            sans: "www.nbit.ch,linux-freelancer.ch,www.linux-freelancer.ch"
+            sans: "www.nbit.ch"
-      rule: "Host(`nbit.ch`,`www.nbit.ch`,`linux-freelancer.ch`,`www.linux-freelancer.ch`)"
+      rule: "Host(`nbit.ch`) || Host(`www.nbit.ch`)"
       service: nbitwebsite
 
   services:

traefik/configuration/wobisch.yml

@@ -0,0 +1,35 @@
+http:
+  routers:
+    wobisch-web:
+      entrypoints:
+      - websecure
+      tls:
+        certresolver: "myresolver"
+        domains:
+          - main: "wo-bisch.ch"
+            sans: "www.wo-bisch.ch"
+      rule: "Host(`wo-bisch.ch`) || Host(`www.wo-bisch.ch`)"
+      service: wobisch-web
+
+    wobisch-lorahandler:
+      entrypoints:
+      - websecure
+      tls:
+        certresolver: "myresolver"
+        domains:
+          - main: "wo-bisch.ch"
+            sans: "www.wo-bisch.ch"
+      rule: "Host(`wo-bisch.ch`) && PathPrefix(`/lorahandler`) || Host(`www.wo-bisch.ch`) && PathPrefix(`/lorahandler`)"
+      service: wobisch-lorahandler
+
+  services:
+    wobisch-web:
+      loadBalancer:
+        servers:
+        - url: http://127.0.0.1:9060/
+        passHostHeader: true
+    wobisch-lorahandler:
+      loadBalancer:
+        servers:
+        - url: http://127.0.0.1:9061/
+        passHostHeader: true

traefik/configuration/wordpressacmoag.yml

@@ -8,11 +8,11 @@ http:
         domains:
           - main: "www.acmoag.com"
             sans: "acmoag.com"
-      rule: "Host(`acmoag.com`,`www.acmoag.com`)"
+      rule: "Host(`acmoag.com`) || Host(`www.acmoag.com`)"
-      service: wordpresscmoag
+      service: wordpressacmoag
 
   services:
-    wordpresscmoag:
+    wordpressacmoag:
       loadBalancer:
         servers:
         - url: http://127.0.0.1:9030/

traefik/traefik.yaml

@@ -3,8 +3,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/home/containers/onyx_pods/traefik/configuration: z
-    bind-mount-options:/data/traefik/acme.json: z
     io.kubernetes.cri-o.TTY/traefik: "false"
     io.podman.annotations.autoremove/traefik: "FALSE"
     io.podman.annotations.init/traefik: "FALSE"

wobisch/telegraf.conf

@@ -0,0 +1,31 @@
+[global_tags]
+
+# Configuration for telegraf agent
+[agent]
+  interval = "10s"
+  round_interval = true
+  metric_batch_size = 1000
+  metric_buffer_limit = 100000
+  collection_jitter = "0s"
+  flush_interval = "10s"
+  flush_jitter = "0s"
+  precision = ""
+  debug = false
+  quiet = false
+  logfile = ""
+  hostname = ""
+  omit_hostname = false
+
+[[inputs.tail]]
+  files = ["/data/wo-bisch-lorahandler.log"]
+  from_beginning = false
+  pipe = false
+  tagexclude = ["path","host"]
+  data_format = "influx"
+
+# Configuration for sending metrics to InfluxDB 2.0
+[[outputs.influxdb_v2]]
+  urls = ["http://127.0.0.1:8086"]
+  token = "OMFWazmSYezw2vVw2cC6pbvMXKaQpzjgN7nemstXifQtQAINeBSXNR66Z6PB2CemTHUdbz5IBIbRdBpcPXZ4FQ=="
+  organization = "wobischorg"
+  bucket = "wobischbucket"

wobisch/wobisch.yaml

@@ -0,0 +1,124 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    io.kubernetes.cri-o.TTY/wobisch: "false"
+    io.podman.annotations.autoremove/wobisch: "FALSE"
+    io.podman.annotations.init/wobisch: "FALSE"
+    io.podman.annotations.label/wobisch: type:container_runtime_t
+    io.podman.annotations.privileged/wobisch: "FALSE"
+    io.podman.annotations.publish-all/wobisch: "FALSE"
+  labels:
+    app: wobisch-pod
+  name: wobisch-pod
+spec:
+  containers:
+  - name: wo-bisch-web
+    image: git.nbit.ch/drpuur/wo-bisch-web:2025051401
+    env:
+    - name: REDIS_CONNECTION_STRING
+      value: 127.0.0.1:6379
+    - name: INFLUX_URL
+      value: http://127.0.0.1:8086/api/v2/query?org=wobischorg
+    - name: INFLUX_RO_TOKEN
+      value: hVK-DQk3kQhrTndYCvv8T1c99nSdpUe2wPAzEMH77rpuDKLbEdsI-Ten6S09EPlgKBCPVypYohMNO9AYbt0MlQ==
+    - name: STRIPE_KEY
+      value: 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
+    - name: STRIPE_PK
+      value: pk_live_51Icq29K2XyHQRTs2oNQMPT75m7J96ajcKDADEE8FCSA3WWD98je6IZgN0E7Q2t5Vccdu1ar5kQZUIjbPhRluTkS500rgdMr0dF
+    - name: MAILSERVER_HOST
+      value: 127.0.0.1
+    ports:
+    - containerPort: 4000
+      hostPort: 9060
+    resources: {}
+    securityContext:
+      capabilities:
+        drop:
+        - CAP_MKNOD
+        - CAP_NET_RAW
+        - CAP_AUDIT_WRITE
+  - name: wo-bisch-lorahandler
+    image: git.nbit.ch/drpuur/wo-bisch-lorahandler:2022122801
+    env:
+    - name: REDIS_CONNECTION_STRING
+      value: 127.0.0.1:6379
+    - name: MAILSERVER_HOST
+      value: 127.0.0.1
+    ports:
+    - containerPort: 8080
+      hostPort: 9061
+    resources: {}
+    securityContext:
+      capabilities:
+        drop:
+        - CAP_MKNOD
+        - CAP_NET_RAW
+        - CAP_AUDIT_WRITE
+    volumeMounts:
+    - mountPath: /data
+      name: lorahandlerdata
+  - name: influxdb
+    image: docker.io/library/influxdb:2.7
+    ports:
+    - containerPort: 8086
+      hostPort: 9062
+    resources: {}
+    securityContext:
+      capabilities:
+        drop:
+        - CAP_MKNOD
+        - CAP_NET_RAW
+        - CAP_AUDIT_WRITE
+    volumeMounts:
+    - mountPath: /var/lib/influxdb2
+      name: influxdb
+  - name: redis
+    image: docker.io/library/redis:7
+    args: ["--save 60 1", "--loglevel warning"]
+    ports:
+    - containerPort: 5432
+      hostPort: 9063
+    resources: {}
+    securityContext:
+      capabilities:
+        drop:
+        - CAP_MKNOD
+        - CAP_NET_RAW
+        - CAP_AUDIT_WRITE
+    volumeMounts:
+    - mountPath: /data
+      name: redis
+  - name: telegraf
+    image: docker.io/library/telegraf:1.25
+    resources: {}
+    securityContext:
+      capabilities:
+        drop:
+        - CAP_MKNOD
+        - CAP_AUDIT_WRITE
+        add:
+        - CAP_NET_RAW
+    volumeMounts:
+    - mountPath: /data
+      name: lorahandlerdata
+    - mountPath: /etc/telegraf/telegraf.conf
+      name: telegrafconf
+  restartPolicy: Always
+  volumes:
+  - hostPath:
+      path: /data/wobisch/influxdb
+      type: Directory
+    name: influxdb
+  - hostPath:
+      path: /data/wobisch/redis
+      type: Directory
+    name: redis
+  - hostPath:
+      path: /data/wobisch/lorahandlerdata
+      type: Directory
+    name: lorahandlerdata
+  - hostPath:
+      path: /home/containers/onyx_pods/wobisch/telegraf.conf
+      type: File
+    name: telegrafconf

wordpressacmoag/wordpressacmoag.yaml

@@ -2,9 +2,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/wordpressacmoag/wp: z
-    bind-mount-options:/home/containers/onyx_pods/wordpressacmoag/uploads.ini: z
-    bind-mount-options:/data/wordpressacmoag/db: z
     io.kubernetes.cri-o.TTY/wordpressacmoag: "false"
     io.podman.annotations.autoremove/wordpressacmoag: "FALSE"
     io.podman.annotations.init/wordpressacmoag: "FALSE"
@@ -65,6 +62,8 @@ spec:
       name: data-wordpressacmoag-wp-0
     - mountPath: /usr/local/etc/php/conf.d/uploads.ini
       name: data-wordpressacmoag-wp-1
+    - mountPath: /var/log/apache2
+      name: data-wordpressacmoag-logs-0
   restartPolicy: Never
   volumes:
   - hostPath:
@@ -79,3 +78,7 @@ spec:
       path: /data/wordpressacmoag/db
       type: Directory
     name: data-wordpressacmoag-dp-0
+  - hostPath:
+      path: /data/wordpressacmoag/logs
+      type: Directory
+    name: data-wordpressacmoag-logs-0

wordpresscmoag/wordpresscmoag.yaml

@@ -2,9 +2,6 @@ apiVersion: v1
 kind: Pod
 metadata:
   annotations:
-    bind-mount-options:/data/wordpresscmoag/wp: z
-    bind-mount-options:/home/containers/onyx_pods/wordpresscmoag/uploads.ini: z
-    bind-mount-options:/data/wordpresscmoag/db: z
     io.kubernetes.cri-o.TTY/wordpresscmoag: "false"
     io.podman.annotations.autoremove/wordpresscmoag: "FALSE"
     io.podman.annotations.init/wordpresscmoag: "FALSE"
@@ -65,6 +62,8 @@ spec:
       name: data-wordpresscmoag-wp-0
     - mountPath: /usr/local/etc/php/conf.d/uploads.ini
       name: data-wordpresscmoag-wp-1
+    - mountPath: /var/log/apache2
+      name: data-wordpresscmoag-logs-0
   restartPolicy: Never
   volumes:
   - hostPath:
@@ -79,3 +78,7 @@ spec:
       path: /data/wordpresscmoag/db
       type: Directory
     name: data-wordpresscmoag-dp-0
+  - hostPath:
+      path: /data/wordpresscmoag/logs
+      type: Directory
+    name: data-wordpresscmoag-logs-0