Adding yaml schemas, separating out valinor.social to khazadtube.tv nginx as well

kubernetes/apps/network/ingress-nginx/app/certificate.yaml

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -13,18 +14,3 @@ spec:
   dnsNames:
     - "valinor.social"
     - "*.valinor.social"
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: "khazadtube-tv"
-  namespace: network
-spec:
-  secretName: "khazadtube-tv-tls"
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "khazadtube.tv"
-  dnsNames:
-    - "khazadtube.tv"
-    - "*.khazadtube.tv"

kubernetes/apps/network/ingress-nginx/app/externalsecret.yaml

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://ks.hsn.dev/external-secrets.io/externalsecret_v1beta1.json
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:

kubernetes/apps/network/ingress-nginx/app/helmrelease.yaml

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
@@ -20,6 +21,7 @@ spec:
       updateStrategy:
         type: RollingUpdate
       allowSnippetAnnotations: true
+      enableAnnotationValidations: true
       service:
         enabled: true
         type: LoadBalancer

kubernetes/apps/network/ingress-nginx/app/kustomization.yaml

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: network

kubernetes/apps/network/ingress-nginx/ks.yaml

@@ -1,4 +1,24 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-ingress-nginx
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  interval: 10m
+  path: "./kubernetes/apps/network/ingress-nginx/app"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: valinor
+  wait: true
+  dependsOn:
+    - name: cluster-apps-cert-manager-issuers
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

kubernetes/apps/network/ingress-nginx/peertube/certificate.yaml

@@ -0,0 +1,16 @@
+---
+# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: "khazadtube-tv"
+  namespace: network
+spec:
+  secretName: "khazadtube-tv-tls"
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "khazadtube.tv"
+  dnsNames:
+    - "khazadtube.tv"
+    - "*.khazadtube.tv"

kubernetes/apps/network/ingress-nginx/peertube/helmrelease.yaml

@@ -0,0 +1,103 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2beta1.json
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: ingress-nginx-peertube
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: ingress-nginx
+      version: 4.8.3
+      sourceRef:
+        kind: HelmRepository
+        name: ingress-nginx
+        namespace: flux-system
+      interval: 30m
+  values:
+    controller:
+      replicaCount: 3
+      updateStrategy:
+        type: RollingUpdate
+      allowSnippetAnnotations: true
+      enableAnnotationValidations: true
+      service:
+        enabled: true
+        type: LoadBalancer
+        annotations:
+          load-balancer.hetzner.cloud/location: fsn1
+          load-balancer.hetzner.cloud/protocol: tcp
+          load-balancer.hetzner.cloud/name: peertube-nginx
+          load-balancer.hetzner.cloud/use-private-ip: true
+          load-balancer.hetzner.cloud/uses-proxyprotocol: true
+
+      publishService:
+        enabled: true
+
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+          namespace: network
+          namespaceSelector:
+            any: true
+
+      ingressClassResource:
+        name: peertube-nginx
+        default: false
+
+      config:
+        block-user-agents: "GPTBot,~*GPTBot*,ChatGPT-User,~*ChatGPT-User*,Google-Extended,~*Google-Extended*,CCBot,~*CCBot*,Omgilibot,~*Omgilibot*,FacebookBot,~*FacebookBot*" # taken from https://github.com/superseriousbusiness/gotosocial/blob/main/internal/web/robots.go
+        client-header-timeout: 120
+        client-body-buffer-size: "100M"
+        client-body-timeout: 120
+        enable-brotli: "true"
+        enable-ocsp: "true"
+        enable-real-ip: "true"
+        use-proxy-protocol: "true"
+        hide-headers: Server,X-Powered-By
+        hsts-max-age: "31449600"
+        keep-alive: 120
+        keep-alive-requests: 10000
+        proxy-body-size: 0
+        proxy-buffer-size: "16k"
+        ssl-protocols: "TLSv1.3 TLSv1.2"
+        use-forwarded-headers: "true"
+        server-snippet: |
+          resolver local=on ipv6=off;
+        ssl-echd-curve: "secp384r1"
+
+      extraArgs:
+        default-ssl-certificate: "network/khazadtube-tv-tls"
+
+      topologySpreadConstraints:
+        - maxSkew: 2
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: ingress-nginx-peertube
+              app.kubernetes.io/component: controller
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app.kubernetes.io/component
+                    operator: In
+                    values:
+                      - controller
+                  - key: app.kubernetes.io/instance
+                    operator: In
+                    values:
+                      - ingress-nginx-peertube
+              topologyKey: kubernetes.io/hostname
+
+      resources:
+        requests:
+          cpu: 23m
+          memory: 381M
+
+    defaultBackend:
+      enabled: false

kubernetes/apps/network/ingress-nginx/peertube/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: network
+resources:
+  - ./helmrelease.yaml
+  - ./certificate.yaml