diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a67aa09..4397cbc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -57,6 +57,7 @@ updates: - "/kubernetes/personal/notes/notesnook" - "/kubernetes/personal/notes/obsidian-livesync" - "/kubernetes/personal/paperless" + - "/kubernetes/personal/radicale" - "/kubernetes/production/buildpath" - "/kubernetes/production/semery-fr" - "/kubernetes/production/umami" diff --git a/kubernetes/kustomization.yaml b/kubernetes/kustomization.yaml index dad9c97..26968ad 100644 --- a/kubernetes/kustomization.yaml +++ b/kubernetes/kustomization.yaml @@ -33,6 +33,7 @@ resources: - home/zigbee2mqtt # Personal (apps storing my own content, grouped by content type) - personal/paperless + - personal/radicale - personal/media/photoprism - personal/notes/notesnook - personal/notes/obsidian-livesync diff --git a/kubernetes/personal/radicale/kustomization.yaml b/kubernetes/personal/radicale/kustomization.yaml new file mode 100644 index 0000000..4933eba --- /dev/null +++ b/kubernetes/personal/radicale/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: radicale +resources: + - namespace.yaml + - repository.yaml + - release.yaml +secretGenerator: + - name: radicale-values + files: + - values.yaml=values.yaml +configurations: + - kustomizeconfig.yaml diff --git a/kubernetes/personal/radicale/kustomizeconfig.yaml b/kubernetes/personal/radicale/kustomizeconfig.yaml new file mode 100644 index 0000000..4ea8252 --- /dev/null +++ b/kubernetes/personal/radicale/kustomizeconfig.yaml @@ -0,0 +1,6 @@ +nameReference: + - kind: Secret + version: v1 + fieldSpecs: + - path: spec/valuesFrom/name + kind: HelmRelease diff --git a/kubernetes/personal/radicale/namespace.yaml b/kubernetes/personal/radicale/namespace.yaml new file mode 100644 index 0000000..19642bb --- /dev/null +++ b/kubernetes/personal/radicale/namespace.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: radicale + labels: + app.kubernetes.io/name: radicale + app.kubernetes.io/component: caldav-carddav diff --git a/kubernetes/personal/radicale/release.yaml b/kubernetes/personal/radicale/release.yaml new file mode 100644 index 0000000..bee3437 --- /dev/null +++ b/kubernetes/personal/radicale/release.yaml @@ -0,0 +1,19 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: radicale + namespace: radicale +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: derwitt + namespace: radicale + chart: radicale + version: "2.1.0" + interval: 1m + valuesFrom: + - kind: Secret + name: radicale-values diff --git a/kubernetes/personal/radicale/repository.yaml b/kubernetes/personal/radicale/repository.yaml new file mode 100644 index 0000000..537a0b9 --- /dev/null +++ b/kubernetes/personal/radicale/repository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: derwitt + namespace: radicale +spec: + interval: 1h + url: https://charts.derwitt.dev diff --git a/kubernetes/personal/radicale/values.yaml b/kubernetes/personal/radicale/values.yaml new file mode 100644 index 0000000..0f37c56 --- /dev/null +++ b/kubernetes/personal/radicale/values.yaml @@ -0,0 +1,60 @@ +# Radicale CalDAV/CardDAV server +# The chart uses the official rootless ghcr.io/kozea/radicale image with a +# hardened securityContext by default (non-root, read-only rootfs, all caps dropped). +replicaCount: 1 +env: + - name: TZ + value: ENC[AES256_GCM,data:aOeUzoi3PC8rjf8A,iv:xJpXljsxr61EhJvy6YiZU5mFXdWij6LCsQE8FIOgGZw=,tag:QMV8RzHlOilzTG45smv0yg==,type:str] +config: + # No authentication, LAN-only exposure behind Traefik. + auth: + type: none +ingress: + enabled: true + className: traefik + annotations: + external-dns.alpha.kubernetes.io/enabled: "true" + hosts: + - host: radicale.lan + paths: + - path: / + pathType: Prefix +persistence: + data: + enabled: true + className: longhorn + size: 5Gi + accessMode: ReadWriteOnce +resources: + requests: + cpu: 50m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi +sops: + lastmodified: "2026-08-24T19:16:53Z" + mac: ENC[AES256_GCM,data:o9/Kj3saNHqymzpAgJH+vpA5YiiHxE/XW4QUbG5mdndGgxqsLqTTp2vRdzwE11tj0hGxe3dHKv/DgMhcHllMcvBnJk30JZcj5UqK3LioCfozXNpveL56vsq61ZvjZf71sfgXqQT0CfzMRxqj9DG5WhEUGcKmwTbI4RZFFNWsOSM=,iv:msO8/hPrfzVm3Pp4CJswmTQX6uiAsOBN2hF5JKMxKTs=,tag:0PlvpRQpkXYx+WP+IZwh2w==,type:str] + pgp: + - created_at: "2026-08-24T19:16:53Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiARAAvad1UZD+8o8EnpkOIAEcYMhJPbS0c8rAZHC7vHJdK1gn + Q5UZOSmRuGffXeD1oUOADM4ozDmKqq4wRl6doomky4MCXLb5FojgOoaUwzm/Sx+9 + YeqWob1DQCSnlF/Dksj5wFnm1amAK8XXIJc5nelwoYSMH8Xby2ZnyzTEmfWcPFul + 8IVrSEv2/JrJfmSU1ogXrKvVe+hrQ+Qixi5JTpmMYtUD8LiZMGCsK4VRVN3N7ie+ + CgTx+OTb8G53h9DwVbVh8ct1rTlBB4EJBzN7bRDPrgu/mTtw2h/Rb9YfGfJ/tDDH + TFfgpVaeYkhTOxZwGosRztaD/qLBoSoiRZc3ZDU/fyD677PtkX6KHyxpNLSZThH6 + XbSi2n6LTpDXFQbo6OtHtOMdn7B/wXAE+IErWeRx2RbO0MF3bM7p9x/ahXl+0BTm + U6q3+bsDmkdNN2TWUXuCPcIhtu9dwNZLewbxVcus3zrOmiEpR8jZWcOzp42QJeE4 + kcXptlPNzSlGyjB3Oll/uIhaKiKKonIQq7W3w+LHuJi1bO5qDbQjb1L89Rm/hlW4 + h4OssMz4pkeqsEcDyo2vCXYJ4cyrnUSeOTgiS6NOeVxHe+deVbTsW+ScLh55CGmh + ANiG7cJO7Dp8soIvaw6hpj6RiIA5Ifi6mGp2SCoXtOk06JPuskUKzdHFeZejobzS + XgEqYjYCIJY+/R2eiC+n8eGrCrGTZ1kQrbCTQnoZjdEJe0vKbIY89o6I/oMvxqSl + X+qzUG+vbdTboV3svUqjNBv2vX/hMr1OSvrfyEnncaqc2Gmika5eaDtl0bPYy7k= + =TQys + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ + version: 3.10.2 diff --git a/kubernetes/system/coredns/zone-configmap.yaml b/kubernetes/system/coredns/zone-configmap.yaml index f7c0b4a..08d660d 100644 --- a/kubernetes/system/coredns/zone-configmap.yaml +++ b/kubernetes/system/coredns/zone-configmap.yaml @@ -39,7 +39,6 @@ data: n8n IN A 10.1.2.212 proxy IN A 10.1.2.212 radarr IN A 10.1.2.212 - radicale IN A 10.1.2.212 sonarr IN A 10.1.2.212 stirling-pdf IN A 10.1.2.212 syncthing-valentin IN A 10.1.2.212