From 207aa84670e706b8c8c17de141f951dd9d40e3a0 Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Thu, 20 Aug 2026 22:31:57 +0200 Subject: [PATCH] network: allocate new ips on final segment --- kubernetes/infrastructure/caddy/release.yaml | 2 +- .../infrastructure/mail/stalwart/values.yaml | 42 +++++++++---------- .../infrastructure/network/blocky/values.yaml | 36 ++++++++-------- kubernetes/system/cilium/pool.yaml | 8 ++-- 4 files changed, 44 insertions(+), 44 deletions(-) diff --git a/kubernetes/infrastructure/caddy/release.yaml b/kubernetes/infrastructure/caddy/release.yaml index ca504d7..19bcdb8 100644 --- a/kubernetes/infrastructure/caddy/release.yaml +++ b/kubernetes/infrastructure/caddy/release.yaml @@ -27,4 +27,4 @@ spec: patch: | - op: add path: /spec/loadBalancerIP - value: "10.2.1.211" + value: "10.2.1.4" diff --git a/kubernetes/infrastructure/mail/stalwart/values.yaml b/kubernetes/infrastructure/mail/stalwart/values.yaml index 3f848d3..d3640c4 100644 --- a/kubernetes/infrastructure/mail/stalwart/values.yaml +++ b/kubernetes/infrastructure/mail/stalwart/values.yaml @@ -19,9 +19,9 @@ pushShard: "" # with these credentials on every cert-manager renewal. recoveryAdmin: enabled: true - username: ENC[AES256_GCM,data:XUlqQoM=,iv:WFaWS6MjuQ+jTAj15NCpnFjr1B5XwJexwc4k9qU0n5g=,tag:mcO8w9Ud9j1HbHgoLIJBoA==,type:str] + username: ENC[AES256_GCM,data:ssWcS9c=,iv:K0cpea1wPDM9tEHcsP2N5rxDegzGWir+Nkh3Vnz7Ejg=,tag:mSoy5nCqTwQSj+tg8MZDFg==,type:str] password: "" - existingSecret: ENC[AES256_GCM,data:XPR9CS3tqLkbjyunmZjLE4pq/Z5ldRo=,iv:B0Dh9vktXOpYCOVVWS31fqw1+OtsaST8dzXbygd4HxA=,tag:F4d0JVfaut8NvJY/HXPurA==,type:str] + existingSecret: ENC[AES256_GCM,data:IMPTLHBqnk1/xkxykOi2Sxgfocdogn0=,iv:kJz4DMVb95w/2px0UjzhtReUK6tjZ3qILPKyqlNdpV4=,tag:dME8/hiUM+XVbwDovDSxeA==,type:str] usernameKey: username passwordKey: password # Recovery mode suspends mail services and exposes only the management listener. @@ -40,7 +40,7 @@ bootstrap: # certificate.yaml (letsencrypt-production, Cloudflare DNS-01). mailTls: enabled: true - existingSecret: ENC[AES256_GCM,data:tKhTXL1MFZni+gTTbDMpbZugg7HJ6w==,iv:ye0/5M51TWI2m+YfnwJoQPBCBmb/iWiWZv+aDQGE4hM=,tag:EEbcAagl8UOMR0iW8UvIDA==,type:str] + existingSecret: ENC[AES256_GCM,data:RyFkt8p//R+qkc3UIG9v7BEXlrVlvA==,iv:S2dOLr8fKPyv5ke++zrajv0UFKJSTx1oa5jv7TZ/+hk=,tag:q1SHST/5aLa+4iNs2TSUVg==,type:str] certKey: tls.crt privateKeyKey: tls.key mountPath: /etc/stalwart/tls/ingress @@ -77,7 +77,7 @@ mailService: enabled: true name: stalwart-mail type: LoadBalancer - loadBalancerIP: 10.2.1.212 + loadBalancerIP: 10.2.1.5 annotations: {} # WebUI ingress. TLS is terminated by Caddy at the edge (wildcard cert), so the # path is: public -> Caddy (TLS) -> Traefik (HTTP) -> this Ingress -> mgmt:8080. @@ -120,27 +120,27 @@ podSecurityContext: type: RuntimeDefault containerSecurityContext: {} sops: - lastmodified: "2026-08-17T18:27:09Z" - mac: ENC[AES256_GCM,data:haYZBrQ0FMB6yc8FjeP2gRxr1FUmlnxFUdPU3itqATqBGopPCE2Nbpesx9wvlDCYn+GrtTiFTMXHuc6IhtRV5ujnEs6sjRgGgON18OIpJ6A6RiWU7u58zz4/JKBmR0EMIJ6dJGpt0aHL9Bogoola2O6TNZ85N720CTvOjoS2/HU=,iv:Gb5s52EB4gX2njF/aRxFwrzL3xmOaPmMW0zAmZgdyY8=,tag:+3oyVoQ+yL99/T+YFuHIIA==,type:str] + lastmodified: "2026-08-20T20:31:57Z" + mac: ENC[AES256_GCM,data:QjvWqFfWs1WiGwpjRG7yeyO4fMlfTk8WwUlTGhNAR/4MP2fyHV31VOgj0Dpamf3zHEOfVG4CQuADWQUbcwFbArdotn9sdsGrTheDWSikjM79AC2rhh/vCeREDyYR4nKm8aZISvGlwF6SQVoYO8VomVDJkNhK9ceWLaDyxrMJIxs=,iv:lQ+Zv4H7O8R8aOwPkru6iBYFR9ODpGwIdZdTQzQ8aJE=,tag:y1MRdyTltz6c9UWOQ3tWBQ==,type:str] pgp: - - created_at: "2026-08-17T18:27:09Z" + - created_at: "2026-08-20T20:31:57Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ/9GXV5Z9zMj5q6Zn/Ria1dU/1WrUKl48ruJhFLwUH0owt5 - PezZ4Kz2PS9hdgfHJfXwPn1/dywxjrLibnLPNOf9hYxVzxJgtgobFdt4EDPC1Ki4 - bj8Sw9EwWCE8ki0YCqXTDrkcWlgFhatZHLSE+MSEWaIB/i4dujQbRXI3g6CI5Shr - qLo6prhLS2zrZIfWVlwFfibXIjSnX+WGeor57D4ilBqP8qRAO++7dC3jKyYiwY4W - kyO+eb5I5VLfepSGyKGD1WljMEEjPi2LMmTlPfPJp2/gV+aWxO8eRJLjJ4PVyjs6 - 1iFmLFnxNiI3lOLrWU0wX11LhOvaUFCOafJ4kFyECquAYLjcjFCFqAYhrzj4yNPi - UXCg2nv5eyZ5ohDgTU6/q3FPPvKrY60VPV8H1H6u0zOKPjlzko/1UPM9bRBRkJHj - n6/MQEMpsVAijBD8L2JNewj1DxCmmekTqev4g1M/VymciTPLRRLt1tU2IEZ2cCOw - O9EA26LnKnCU8h/grkihp3ScCLeiY++y3neh8umkpsnqF2yBlWr9/s26ZW54hybo - OuoohRSwYTVb4Lu+g98czNp01riv8dAMdYEaPSRS68RqaBdpDnxGDEYcNiaXpHwn - 7pYfnGV9oNQSN9Zo1EfolLc+XWzJbkBA8Sltma8eZtWKffpAAqt5BKz97k6JX8XS - UQEM021guipXzgmhgpYOdWrOM4KDgsLhzIlsu3gGRZjegjg/1UYfv63zh3kWTAPp - wS25gS1e619KJuTyvBv7hHUWC6HwEJ6JrkT+0bX7nNBq/w== - =kkTl + hQIMA7uy4qQr71wiAQ/9EUc3vJ3fVYZm4KQ2owVf9IKdpt2rPgaAgZMqwFqNXIi+ + ZA4/iiFv0BctD6pgx/Dwe5cHa5Wq3z6NDcO9g/wlZMRBLPIuGXcOey4AwBBvYlgt + +A6VxeCHimczImogGHUkJRlM39hdZh32hs8olzkVLk/nYdh6sKeGLm2dphP+kPJg + hnfgGA0pc5lSsz2gMHZiOy85mOpoFbj3c4Ndr1mKvSz4PbRAwIXn5idsASCZO/Dv + xqzmftrmahaNwfHvmKdYHApyIbb0kxRuWKiwpXFUuwpOOJDlC4QH5XuZc3mslLeb + vxI+l2o0ojMImgwXCreCxqGkKQN4osa/AdoqMSafGNgSjhLdkiw+XhG+Wy5EEh0V + eOyaLsW/OCxKhGOWPgGd570BSgGZaf9JjB9tKBmlocu/D8vhaREblziNE3/PkfZV + YjnrxktJsbT1sEOblfPulUwmkDQOfG1QBC4zxrJPzYnUxd0Klf5bkLFoHLBEK+KE + +ZOLW9TDWnccPm1ZdiIpR2CepUILRus3lVNxQUk4NKhssg3YYFH1FJy5t9cDP9eJ + hXSE5kq1kTL4W4+o7B6oDAljWe9UGW7OU3M18o8CQJ5nFLdv+gm9Xtzo8I4FTY/J + ATz77c/tILUl/TXkXvJNwzxqD4EAlq5ci5MiVFpdO0Fg2roK4fAGE4gzZZsG8FDS + XAH+UpKRFmQ43TdB7//yy0Qdziv8xu/FC8nWnYaYYsm6xVkMsGujnyKQ2x/j6eMH + 4+Hh8gQocaZm5UKzKf8XFgZhupWKSNjjPivdWeoF/pHyhlzSGG0/bHjpmCpz + =/TCV -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ diff --git a/kubernetes/infrastructure/network/blocky/values.yaml b/kubernetes/infrastructure/network/blocky/values.yaml index c821abd..1416097 100644 --- a/kubernetes/infrastructure/network/blocky/values.yaml +++ b/kubernetes/infrastructure/network/blocky/values.yaml @@ -20,7 +20,7 @@ service: dns-udp: enabled: true type: LoadBalancer - loadBalancerIP: 10.2.1.210 + loadBalancerIP: 10.2.2.3 # Cluster (not Local) so any node can forward to pods on any other node. # Required for Cilium L2 announcement failover externalTrafficPolicy: Cluster @@ -69,27 +69,27 @@ resources: # Full list of options https://github.com/0xERR0R/blocky/blob/main/docs/config.yml config: "upstreams:\n groups:\n default:\n - 1.1.1.1\n - 1.0.0.1\n lan:\n - 10.101.207.1\n\nconditional:\n mapping:\n lan: 10.101.207.1\n cluster.local: 10.96.0.10\n\nblocking:\n allowlists:\n ads:\n - |\n dealabs.digidip.net\n s.click.aliexpress.com\n fonts.googleapis.com\n fonts.gstatic.com\n wl.spotify.com\n www.googleadservices.com\n \n denylists:\n ads:\n - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts\n - https://adaway.org/hosts.txt\n \n clientGroupsBlock:\n default:\n - ads\n \n blockType: zeroIp\n blockTTL: 1m\n loading:\n refreshPeriod: 4h\n downloads:\n timeout: 60s\n\ncaching:\n minTime: 5m\n maxTime: 30m\n # Disable negative caching (NXDOMAIN responses) for dynamic DNS\n cacheTimeNegative: 0\n prefetching: true\n prefetchExpires: 2h\n prefetchThreshold: 5\n\nprometheus:\n enable: true\n path: /metrics\n\nports:\n dns: 53\n http: 4000\n\nbootstrapDns: tcp+udp:1.1.1.1\n\nlog:\n level: info\n format: text\n timestamp: true\n" sops: - lastmodified: "2026-08-17T18:27:09Z" - mac: ENC[AES256_GCM,data:IiJLNZlcsOrMpV3Sv9488k+Vmcin0AKV2L6wbTQDHyMmtJK5a8nt4ZTjmrbpD3xlgSNLSPt1EWAGetl0Z8MiLNkpOkv1AQQJdV3SZy+31nzqBXWn8kPP0p9AS7fcRNKR2sDPUNuXdh7GuKm/+j01y7Wetc8aC2MVdMS3fxf719U=,iv:qmigYfzVeraHiAkMGg7T29WhUDDfEur6yphAXsz0JqE=,tag:v7dbMfHVIA+pk0q4jGA9Cg==,type:str] + lastmodified: "2026-08-20T20:31:57Z" + mac: ENC[AES256_GCM,data:RsGI3l+9aiCChJLDS3HLY5V5AvHVBMPo9HZg37gNmAql2r237fBYT1D6W1i21VZtno/ylckkNPB2wcxJfHG6uh/R4SFbFcZsjCda8wgeqGDPvaTR29n0xUs/XBHxEHbOF223xLhS8x6iShX56EVJ6QPcKG47azk+/1v0TYyLs9E=,iv:RBkV4gYoecejjmVyvIX3f34ol9WFtpIiPRezVv7NfIo=,tag:nCZKJpl/T3jaFuUmhp0fzQ==,type:str] pgp: - - created_at: "2026-08-17T18:27:09Z" + - created_at: "2026-08-20T20:31:57Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ//VZ3zkweb4y8UwdjKJVFYT6DSfacL32lzfF+inY6B8IJ3 - ogi5afk8MzPK1PoUTVfpeAzwm+3q5vS4D+XQn5XTVS3+RTaVjryHHuX3Bbwe1ZKa - Ovi03BwxjKH8qyCmqKpBqqVkbqIoNRk7i1JMbOFRTjc+5fw5EmQSEjIy4SR96Qx6 - Df0Ul3ahdbd761EMvTOeZb2JvQBLMY+rHOEg6pkL4Tlpdd6pmMUTwGRUzUZ6QLXA - RQ/qO2gecBbAJb7wjSnJrS8WQXXVuj9YK5+6HZNzWoFhyUpTMfyzT4CiONaMuwPv - OYCHXJ+o1317zuna91ch1y8A2/+p84HvlhWCPBlzF7YzTYU/eUaH+JvG/SA+irw8 - QuNKZYOaNYEQq7vVaheeanD2/w09l6wpA5piXSa7QdoESeYkRfZRVigh93jeRoG8 - XdjIuQD06TV4JHIW/+MMOUuxzp/TzChrYqEO5BJ6gttZXnUjN7IZVA73i+/PhPz9 - RIRx/CYECTFEce64Haw+utCQRAvKielnyWf07ka1ERvvptdYOQWrIb6jIB60VCIf - YfIy4GiPF8T5aPuSpFjNjDGiJWDusq8Jd3fL9qWPQeKZBUufxVhlFFJSeCOYolE0 - AJajQP5PIipUiHbuRQIZ6MbFbauB0Vy+SBAOe0UkqVUZ40y/D/muTpWK4w2UZhvS - XAGmFHhh7f6qm/223unREbK9oBxyoTAEAa4HR4dn8mUnl3WGEMOwkySAbUPZKcyK - Pi8s+SHzvQ5Lbzv+NbgM90ljuUE9ekcsUsqsUT9cmDs4XiH3IGd8feSoyM8I - =j9Pp + hQIMA7uy4qQr71wiARAAkJkQQV3jR/0IYHZ0jgyvcLPV9EJQN85j5aNprps+uhRb + BDXf7tYR3jZiPDEBvg0pL2eYlP/Bh9a1fpTZ7NcCJWizI15PJXsIKzaJ2mDn776M + KaMAj0hy3kOKrmfH/Ajof9gjupJblvyQY6nqd1AlQapfdqVR4r5W6fq0iX1wuq4n + RLzTQ4zQaYfH76dRYQFrxCwleh5C2A16Z6drQukNTKjH79IDjVLJQT+7toLH3ws3 + lgRUJnXCkpYY2vr8lbtmjfHI6i0g9bJFMkGlZRZ58BYhHJYcjO4JGwvZGCzgrzi8 + U9Q7gIVS4Ccdog4H5pflgOUZB36Kc5pCAxE6puttEcvXV4KJnQCB2TrBpVZxswdG + /aoPKU+IYFUcxXeKKBTXtdoVWQlppqNR7aobbDhPU576SUnozV1wag4LcbZcWIt9 + DLoJwX8A2bSBjNxC+XSYgK8p6r9SKeq8JucBD9dbwDK+4e1iHYhRNQNIXtEPuRFm + rAE0poTNdMeMirut4WSKy38cnb2V5lZqK9QdLk3dcs4wPxdohfUYVWmnSBzuAM/B + qePVPzfKod9Szp7uTAWWXVdbIXKt58Qn52GAkYQofjPamcumGksnQJ819v5TYo/Z + CtUMGtfi44SRPLR0vPoGgLTiYnu6jt8BUxqaRrzbv959XW8LCfm/NzY1MABuZaHS + XAGa3Zsq2bZHP2BpQuyCoL9QKYLTOtPxgxzcF3xyLuku/Qd7oo3/5NXY6ET3w4R4 + aPrOhRlhOLQ00HVESc9FYjy41GT+pE/s+aa2ZXzsG3fDQb4+OTtl+b9kG9L1 + =2k/e -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ diff --git a/kubernetes/system/cilium/pool.yaml b/kubernetes/system/cilium/pool.yaml index 5ab53dd..e00b27c 100644 --- a/kubernetes/system/cilium/pool.yaml +++ b/kubernetes/system/cilium/pool.yaml @@ -4,7 +4,7 @@ metadata: name: "local-pool" spec: blocks: - - cidr: "10.2.1.210/32" - - cidr: "10.2.1.211/32" - - cidr: "10.2.1.212/32" - - cidr: "10.2.1.213/32" + - cidr: "10.2.2.3/32" + - cidr: "10.2.2.4/32" + - cidr: "10.2.2.5/32" + - cidr: "10.2.2.6/32"