chore(deps): update actions

.gitea/workflows/deploy-coredns.yaml

@@ -1,26 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'coredns/**'
-  workflow_dispatch:
-
-jobs:
-  deploy-coredns:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
-        with:
-          method: kubeconfig
-          kubeconfig: ${{ secrets.KUBECONFIG }}
-      - name: Deploy
-        run: |
-          kubectl apply -n kube-system -f coredns
-      - name: Restart coredns
-        run: |
-          kubectl -n kube-system rollout restart deployment coredns

.gitea/workflows/deploy-node-labels.yaml

@@ -1,23 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'node-labels/**'
-  workflow_dispatch:
-
-jobs:
-  deploy-node-labels:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
-        with:
-          method: kubeconfig
-          kubeconfig: ${{ secrets.KUBECONFIG }}
-      - name: Deploy
-        run: |
-          kubectl apply --server-side --field-manager=t000-n -f node-labels

.gitea/workflows/deploy-traefik.yaml

@@ -1,47 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'traefik/**'
-  workflow_dispatch:
-
-jobs:
-  deploy-traefik:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
-      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
-        with:
-          method: kubeconfig
-          kubeconfig: ${{ secrets.KUBECONFIG }}
-      - name: Set ionos api credentials
-        uses: azure/k8s-create-secret@ba774cded95cc0d795806a986fecd1205a6c2320 # v6.0.1
-        with:
-          namespace: kube-system
-          secret-name: ionos-api-credentials
-          secret-type: generic
-          data: |
-            {
-              "apiKey": "${{ secrets.IONOS_API_KEY }}"
-            }
-      - name: Set admin basic auth credentials
-        uses: azure/k8s-create-secret@ba774cded95cc0d795806a986fecd1205a6c2320 # v6.0.1
-        with:
-          namespace: kube-system
-          secret-name: admin-basic-auth-credentials
-          secret-type: Opaque
-          data: |
-            {
-              "auth": "${{ secrets.ADMIN_BASIC_AUTH_CREDENTIALS }}"
-            }
-      - name: Deploy
-        uses: azure/k8s-deploy@51ca02a8b7225fbd0924aac359c5b336a5f1e5b4 # v7.0.0
-        with:
-          action: deploy
-          manifests: "traefik/"
-          strategy: basic
-          namespace: kube-system

.gitea/workflows/deploy.yaml

@@ -7,6 +7,99 @@ on:
   workflow_dispatch:
 
 jobs:
+  check-changes:
+    runs-on: ubuntu-latest
+    outputs:
+      node-labels: ${{ steps.filter.outputs.node-labels }}
+      coredns: ${{ steps.filter.outputs.coredns }}
+      traefik: ${{ steps.filter.outputs.traefik }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        id: filter
+        with:
+          filters: |
+            node-labels:
+              - 'node-labels/**'
+            coredns:
+              - 'coredns/**'
+            traefik:
+              - 'traefik/**'
+
+  deploy-node-labels:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.node-labels == 'true' || github.event_name == 'workflow_dispatch' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
+      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Deploy
+        run: |
+          kubectl apply --server-side --field-manager=t000-n -f node-labels
+
+  deploy-coredns:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.coredns == 'true' || github.event_name == 'workflow_dispatch' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
+      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Deploy
+        run: |
+          kubectl apply -n kube-system -f coredns
+      - name: Restart coredns
+        run: |
+          kubectl -n kube-system rollout restart deployment coredns
+
+  deploy-traefik:
+    runs-on: ubuntu-latest
+    needs: check-changes
+    if: ${{ needs.check-changes.outputs.traefik == 'true' || github.event_name == 'workflow_dispatch' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
+      - uses: azure/k8s-set-context@8698eba2499e9012f0d5085f8798077cce4bc526 # v5.0.1
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - name: Set ionos api credentials
+        uses: azure/k8s-create-secret@ba774cded95cc0d795806a986fecd1205a6c2320 # v6.0.1
+        with:
+          namespace: kube-system
+          secret-name: ionos-api-credentials
+          secret-type: generic
+          data: |
+            {
+              "apiKey": "${{ secrets.IONOS_API_KEY }}"
+            }
+      - name: Set admin basic auth credentials
+        uses: azure/k8s-create-secret@ba774cded95cc0d795806a986fecd1205a6c2320 # v6.0.1
+        with:
+          namespace: kube-system
+          secret-name: admin-basic-auth-credentials
+          secret-type: Opaque
+          data: |
+            {
+              "auth": "${{ secrets.ADMIN_BASIC_AUTH_CREDENTIALS }}"
+            }
+      - name: Deploy
+        uses: azure/k8s-deploy@51ca02a8b7225fbd0924aac359c5b336a5f1e5b4 # v7.0.0
+        with:
+          action: deploy
+          manifests: "traefik/"
+          strategy: basic
+          namespace: kube-system
+
   deploy-docker-registry-secret:
     runs-on: ubuntu-latest
     needs: check-changes

coredns/coredns-config.yaml

@@ -43,4 +43,5 @@ data:
     import /etc/coredns/custom/*.server
   NodeHosts: |
     192.168.0.50 k3sh0
-    192.168.0.53 k3sh3
+    192.168.0.51 k3sh1
+    192.168.0.52 k3sh2

node-labels/11_labels_k3sh0.yaml

@@ -5,6 +5,3 @@ metadata:
   labels:
     de.t000-n.net.class: "fast"
     de.t000-n.net.bw: "10g"
-    de.t000-n.drive.mnt-syncthing: ""
-    de.t000-n.drive.mnt-torrent: ""
-    de.t000-n.sysctl.net.ipv4.conf.all.src_valid_mark: "1"

node-labels/12_labels_k3sh1.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Node
+metadata:
+  name: k3sh1
+  labels:
+    de.t000-n.net.class: "fast"
+    de.t000-n.net.bw: "10g"

node-labels/13_labels_k3sh2.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Node
+metadata:
+  name: k3sh2
+  labels:
+    de.t000-n.net.class: "fast"
+    de.t000-n.net.bw: "10g"
+    de.t000-n.drive.mnt-syncthing: ""
+    de.t000-n.drive.mnt-torrent: ""
+    de.t000-n.sysctl.net.ipv4.conf.all.src_valid_mark: "1"

traefik/middleware-crowdsec-bouncher.yaml

@@ -0,0 +1,13 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+    name: crowdsec-bouncer
+    namespace: kube-system
+spec:
+    plugin:
+        crowdsec-bouncer-traefik-plugin:
+            Enabled: true
+            CrowdsecMode: live
+            CrowdsecLapiUrl: "http://crowdsec-service.kube-system.svc.cluster.local:8080"
+            CrowdsecLapiKey: "${CROWDSEC_BOUNCER_API_KEY}"
+            UpdateIntervalSeconds: 10

traefik/traefik-config.yaml

@@ -54,6 +54,8 @@ spec:
         externalTrafficPolicy: Local
       externalIPs:
         - 192.168.0.50
+        - 192.168.0.51
+        - 192.168.0.52
         - 192.168.0.53
     persistence:
       enabled: true