Update docker.io/ollama/ollama Docker tag to v0.2.7

kubernetes/apps/ai/kustomization.yaml

@@ -7,3 +7,5 @@ resources:
   - ./namespace.yaml
   # Flux-Kustomizations
   - ./ollama/ks.yaml
+  - ./open-webui/ks.yaml
+  - ./stable-diffusion/ks.yaml

kubernetes/apps/ai/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: ai
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled
+    volsync.backube/privileged-movers: "true"

kubernetes/apps/ai/ollama/app/helmrelease.yaml

@@ -35,7 +35,7 @@ spec:
           app:
             image:
               repository: docker.io/ollama/ollama
-              tag: 0.2.5
+              tag: 0.2.7
             env:
               - name: OLLAMA_HOST
                 value: 0.0.0.0
@@ -43,6 +43,8 @@ spec:
                 value: "*"
               - name: OLLAMA_MODELS
                 value: &modelPath "/models"
+              - name: OLLAMA_KEEP_ALIVE
+                value: "24h"
             resources:
               requests:
                 nvidia.com/gpu: 1 # requesting 1 GPU

kubernetes/apps/ai/open-webui/app/helmrelease.yaml

@@ -0,0 +1,77 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app open-webui
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.2.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  dependsOn:
+    - name: ollama
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controllers:
+      open-webui:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/open-webui/open-webui
+              tag: git-82079e6
+            env:
+              - name: OLLAMA_BASE_URL
+                value: http://ollama.ai.svc.cluster.local:11434
+              - name: ENABLE_RAG_WEB_SEARCH
+                value: true
+              - name: RAG_WEB_SEARCH_ENGINE
+                value: searxng
+              - name: SEARXNG_QUERY_URL
+                value: http://searxng.default.svc.cluster.local:8080/search?q=<query>
+            resources:
+              requests:
+                cpu: 500m
+                memory: 2Gi
+              limits:
+                memory: 2Gi
+    service:
+      app:
+        controller: open-webui
+        ports:
+          http:
+            port: 8080
+    ingress:
+      app:
+        enabled: true
+        className: internal-nginx
+        hosts:
+          - host: &host "chat.jahanson.tech"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      config:
+        enabled: true
+        existingClaim: *app
+        globalMounts:
+          - path: /app/backend/data

kubernetes/apps/ai/open-webui/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ../../../../templates/volsync

kubernetes/apps/ai/open-webui/ks.yaml

@@ -0,0 +1,28 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app open-webui
+  namespace: flux-system
+spec:
+  targetNamespace: ai
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: volsync
+    - name: ollama
+  path: ./kubernetes/apps/ai/open-webui/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homelab
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
+      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/ai/stable-diffusion/comfyui/helmrelease.yaml

@@ -0,0 +1,82 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app comfyui
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.2.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controllers:
+      comfyui:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        pod:
+          nodeSelector:
+            nvidia.com/gpu.present: "true"
+          runtimeClassName: nvidia
+        containers:
+          app:
+            image:
+              repository: docker.io/jahanson/comfyui
+              tag: v0.0.1
+            resources:
+              requests:
+                nvidia.com/gpu: 1 # requesting 1 GPU
+                cpu: 500m
+                memory: 2Gi
+              limits:
+                memory: 60Gi
+                nvidia.com/gpu: 1 # requesting 1 GPU
+    service:
+      app:
+        controller: comfyui
+        ports:
+          http:
+            port: 7860
+    ingress:
+      app:
+        enabled: true
+        className: internal-nginx
+        hosts:
+          - host: &host "{{ .Release.Name }}.jahanson.tech"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      models:
+        enabled: true
+        existingClaim: stablediffusion-checkpoints
+        globalMounts:
+          - path: /data/models
+      config:
+        enabled: true
+        existingClaim: comfyui
+        globalMounts:
+          - path: /data/config
+      output:
+        enabled: true
+        type: emptyDir
+        globalMounts:
+          - path: /output

kubernetes/apps/ai/stable-diffusion/comfyui/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./pvc.yaml
+  - ../../../../templates/volsync

kubernetes/apps/ai/stable-diffusion/comfyui/pvc.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: stablediffusion-checkpoints
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 300Gi
+  storageClassName: openebs-hostpath

kubernetes/apps/ai/stable-diffusion/ks.yaml

@@ -0,0 +1,30 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app comfyui
+  namespace: flux-system
+spec:
+  targetNamespace: ai
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: nvidia-device-plugin
+    - name: node-feature-discovery
+    - name: volsync
+    - name: openebs
+  path: ./kubernetes/apps/ai/stable-diffusion/comfyui
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homelab
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
+      VOLSYNC_CAPACITY: 5Gi

kubernetes/apps/default/kustomization.yaml

@@ -13,6 +13,7 @@ resources:
   - ./radarr/ks.yaml
   - ./recyclarr/ks.yaml
   - ./sabnzbd/ks.yaml
+  - ./searxng/ks.yaml
   - ./sonarr/ks.yaml
   - ./tautulli/ks.yaml
   - ./unpackerr/ks.yaml

kubernetes/apps/default/searxng/app/externalsecret.yaml

@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: searxng
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: searxng-secret
+    template:
+      engineVersion: v2
+      data:
+        SEARXNG_SECRET: "{{ .SEARXNG_SECRET }}"
+  dataFrom:
+    - extract:
+        key: searxng

kubernetes/apps/default/searxng/app/helmrelease.yaml

@@ -0,0 +1,112 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: searxng
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.2.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controllers:
+      searxng:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: docker.io/searxng/searxng
+              tag: 2024.7.7-ef103ba80
+            envFrom:
+              - secretRef:
+                  name: searxng-secret
+            env:
+              TZ: America/Chicago
+              SEARXNG_BASE_URL: https://search.jahanson.tech
+              SEARXNG_URL: https://search.jahanson.tech
+              SEARXNG_PORT: &port 8080
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /stats
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+                add:
+                  - CHOWN
+                  - SETGID
+                  - SETUID
+                  - DAC_OVERRIDE
+            resources:
+              requests:
+                cpu: 10m
+              limits:
+                memory: 3Gi
+    service:
+      app:
+        controller: searxng
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal-nginx
+        hosts:
+          - host: &host "search.jahanson.tech"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+    persistence:
+      config:
+        type: configMap
+        name: searxng-configmap
+        advancedMounts:
+          searxng:
+            app:
+              - path: /etc/searxng/settings.yml
+                subPath: settings.yml
+                readOnly: true
+              - path: /etc/searxng/limiter.toml
+                subPath: limiter.toml
+                readOnly: true
+      tmp:
+        type: emptyDir
+        advancedMounts:
+          searxng:
+            app:
+              - path: /etc/searxng

kubernetes/apps/default/searxng/app/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: searxng-configmap
+    files:
+      - settings.yml=./resources/settings.yml
+      - limiter.toml=./resources/limiter.toml
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/default/searxng/app/resources/limiter.toml

@@ -0,0 +1,6 @@
+# This configuration file updates the default configuration file
+# See https://github.com/searxng/searxng/blob/master/searx/limiter.toml
+
+[botdetection.ip_limit]
+# activate link_token method in the ip_limit method
+link_token = true

kubernetes/apps/default/searxng/app/resources/settings.yml

@@ -0,0 +1,51 @@
+---
+use_default_settings: true
+
+server:
+  limiter: false
+  image_proxy: true
+
+redis:
+  url: redis://dragonfly.database.svc.cluster.local:6379?db=10
+
+search:
+  safe_search: 0
+  autocomplete: brave
+  formats:
+    - html
+    - json
+
+general:
+  instance_name: HansonSearch
+
+ui:
+  static_use_hash: true
+  default_theme: simple
+  theme_args:
+    simple_style: dark
+  infinite_scroll: true
+  results_on_new_tab: true
+
+enabled_plugins:
+  - Basic Calculator
+  - Hash plugin
+  - Hostnames plugin
+  - Open Access DOI rewrite
+  - Self Informations
+  - Tracker URL remover
+  - Unit converter plugin
+
+hostnames:
+  high_priority:
+    - (.*)\/blog\/(.*)
+    - (.*\.)?wikipedia.org$
+    - (.*\.)?github.com$
+    - (.*\.)?reddit.com$
+    - (.*\.)?linuxserver.io$
+    - (.*\.)?docker.com$
+    - (.*\.)?archlinux.org$
+    - (.*\.)?stackoverflow.com$
+    - (.*\.)?askubuntu.com$
+    - (.*\.)?superuser.com$
+  # replace:
+    # (www\.)?reddit\.com$: redlib.rostvik.site

kubernetes/apps/default/searxng/ks.yaml

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app searxng
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: dragonfly
+    - name: external-secrets-stores
+  path: ./kubernetes/apps/default/searxng/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homelab
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/kube-system/nvidia-device-plugin/app/helmrelease.yaml

@@ -14,6 +14,9 @@ spec:
         kind: HelmRepository
         name: nvdp
         namespace: flux-system
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
   install:
     remediation:
       retries: 3
@@ -22,6 +25,18 @@ spec:
     remediation:
       retries: 3
       strategy: rollback
-  valuesFrom:
+  values:
-    - kind: ConfigMap
+    podAnnotations:
+      configmap.reloader.stakater.com/reload: nvidia-helm-values
+    config:
       name: nvidia-helm-values
+    runtimeClassName: "nvidia"
+    gfd:
+      enabled: true
+    nfd:
+      enabled: false
+    resources:
+      requests:
+        cpu: 100m
+      limits:
+        memory: 512Mi

kubernetes/apps/kube-system/nvidia-device-plugin/app/resources/values.yml

@@ -1,10 +1,12 @@
-runtimeClassName: "nvidia"
+---
-gfd:
+version: v1
-  enabled: false
+flags:
-nfd:
+  migStrategy: "single"
-  enabled: false
+  plugin:
-resources:
+    deviceListStrategy: "envvar"
-  requests:
+    deviceIDStrategy: "uuid"
-    cpu: 100m
+sharing:
-  limits:
+  timeSlicing:
-    memory: 512Mi
+    resources:
+      - name: nvidia.com/gpu
+        replicas: 3

kubernetes/apps/qbittorrent/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: qbittorrent
   labels:
     kustomize.toolkit.fluxcd.io/prune: disabled
+    volsync.backube/privileged-movers: "true"