atlas/atlas
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix(kontur): parametrize reality target to www.apple.com to bypass buffer limit

Browse source
This commit is contained in:
v 2026-10-31 09:07:07 +03:00
parent bb156a9153
commit 165662e971
31 changed files with 116 additions and 117 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ansible/host_vars/n2.srv.yml
View file

@ -2,7 +2,6 @@
perimeter_modules:
xray_reality: true
xray_reverse: true
reality_server_name: ng.w.svo88.space
reality_server_name: www.apple.com
router_vless_uuid: "6b2411ef-1ad4-42f0-91a5-8c76e289f022"
edge_traefik_vip: 10.0.30.200

6
ansible/playbooks/04_dns.yml
View file

@ -81,7 +81,7 @@
group: root
mode: "0644"
content: |
search svo88.space lan
search {{ root_domain }} lan
nameserver 10.0.10.11
nameserver 192.168.1.2
nameserver 192.168.1.1
@ -95,7 +95,7 @@
notify: Reload Proxmox sshd
- name: Apply DNS failover cascade to Tier-0 LXC configurations in Proxmox
ansible.builtin.command: >
pct set {{ item }} -nameserver "10.0.10.11 192.168.1.2 192.168.1.1" -searchdomain svo88.space
pct set {{ item }} -nameserver "10.0.10.11 192.168.1.2 192.168.1.1" -searchdomain {{ root_domain }}
loop:
- 102
- 103
@ -106,7 +106,7 @@
ansible.builtin.shell: |
STATUS=$(pct status {{ item }} 2>/dev/null | awk '{print $2}' || true)
if [ "$STATUS" = "running" ]; then
pct exec {{ item }} -- sh -c 'printf "search svo88.space\nnameserver 10.0.10.11\nnameserver 192.168.1.2\nnameserver 192.168.1.1\noptions timeout:1 attempts:1\n" > /etc/resolv.conf'
pct exec {{ item }} -- sh -c 'printf "search {{ root_domain }}\nnameserver 10.0.10.11\nnameserver 192.168.1.2\nnameserver 192.168.1.1\noptions timeout:1 attempts:1\n" > /etc/resolv.conf'
fi
loop:
- 102

4
ansible/playbooks/06_git.yml
View file

@ -64,8 +64,8 @@
DB_TYPE = sqlite3
PATH = /var/lib/forgejo/data/forgejo.db
[server]
DOMAIN = git.svo88.space
ROOT_URL = https://git.svo88.space/
DOMAIN = git.{{ root_domain }}
ROOT_URL = https://git.{{ root_domain }}/
HTTP_PORT = 3000
SSH_PORT = 2222
DISABLE_SSH = false

6
ansible/templates/perimeter/xray.json.j2
View file

@ -12,11 +12,11 @@
"clients": [
{
"id": "{{ node_secrets.vless_uuid }}",
"email": "mobile@svo88.space"
"email": "mobile@{{ root_domain }}"
},
{
"id": "{{ router_vless_uuid }}",
"email": "vyos@svo88.space",
"email": "vyos@{{ root_domain }}",
"reverse": {
"tag": "reverse-out"
}
@ -29,7 +29,7 @@
"security": "reality",
"realitySettings": {
"show": false,
"target": "127.0.0.1:4443",
"target": "{{ reality_server_name }}:443",
"serverNames": [
"{{ reality_server_name }}"
],

2
atlas.yaml
View file

@ -1,6 +1,6 @@
domain:
root: svoo.tech
reality: ng.w.svoo.tech
reality: www.apple.com
acme_email: atlas@svoo.tech
access:

6
kubernetes/apps/authentik/deployment.yaml
View file

@ -117,10 +117,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- auth.svo88.space
secretName: auth-svo88-tls
- auth.${ROOT_DOMAIN}
secretName: auth-tls
rules:
- host: auth.svo88.space
- host: auth.${ROOT_DOMAIN}
http:
paths:
- path: /

42
kubernetes/apps/dashboard/deployment.yaml
View file

@ -103,22 +103,22 @@ data:
<div class="section" data-section>
<div class="section-title">01 // CORE & INFRA</div>
<div class="links">
<a href="https://pve.svo88.space" class="link-card" target="_blank">
<a href="https://pve.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Proxmox VE</div><div class="link-desc">Hypervisor Node (pve0)</div></div>
</a>
<a href="https://dns.svo88.space" class="link-card" target="_blank">
<a href="https://dns.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Technitium DNS</div><div class="link-desc">Authoritative / DoT DNS</div></div>
</a>
<a href="https://vault.svo88.space" class="link-card" target="_blank">
<a href="https://vault.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">OpenBao Vault</div><div class="link-desc">RAM Secrets Engine</div></div>
</a>
<a href="https://git.svo88.space" class="link-card" target="_blank">
<a href="https://git.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Forgejo GitOps</div><div class="link-desc">Source of Truth Repo</div></div>
</a>
<a href="https://zot.svo88.space" class="link-card" target="_blank">
<a href="https://zot.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Zot Registry</div><div class="link-desc">OCI Container Cache</div></div>
</a>
<a href="https://netbox.svo88.space" class="link-card" target="_blank">
<a href="https://netbox.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">NetBox DCIM</div><div class="link-desc">IPAM & Network Assets</div></div>
</a>
</div>
@ -127,31 +127,31 @@ data:
<div class="section" data-section>
<div class="section-title">02 // SERVICES & DATA</div>
<div class="links">
<a href="https://paperless.svo88.space" class="link-card" target="_blank">
<a href="https://paperless.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Paperless-ngx</div><div class="link-desc">OCR Document Archive</div></div>
</a>
<a href="https://opencloud.svo88.space" class="link-card" target="_blank">
<a href="https://opencloud.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">OpenCloud</div><div class="link-desc">Encrypted Cloud Storage</div></div>
</a>
<a href="https://vw.svo88.space" class="link-card" target="_blank">
<a href="https://vw.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Vaultwarden</div><div class="link-desc">Bitwarden Password Vault</div></div>
</a>
<a href="https://auth.svo88.space" class="link-card" target="_blank">
<a href="https://auth.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Authentik SSO</div><div class="link-desc">Identity & ForwardAuth</div></div>
</a>
<a href="https://finance.svo88.space" class="link-card" target="_blank">
<a href="https://finance.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Sure Finance</div><div class="link-desc">Personal Accounting</div></div>
</a>
<a href="https://search.svo88.space" class="link-card" target="_blank">
<a href="https://search.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">SearXNG</div><div class="link-desc">Private Meta-Search</div></div>
</a>
<a href="https://homebox.svo88.space" class="link-card" target="_blank">
<a href="https://homebox.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Homebox</div><div class="link-desc">Inventory & Asset Tracking</div></div>
</a>
<a href="https://spoolman.svo88.space" class="link-card" target="_blank">
<a href="https://spoolman.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Spoolman</div><div class="link-desc">3D Filament Manager</div></div>
</a>
<a href="https://printstash.svo88.space" class="link-card" target="_blank">
<a href="https://printstash.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Printstash</div><div class="link-desc">3D Model Stash</div></div>
</a>
</div>
@ -160,13 +160,13 @@ data:
<div class="section" data-section>
<div class="section-title">03 // MEDIA & ENTERTAINMENT</div>
<div class="links">
<a href="https://immich.svo88.space" class="link-card" target="_blank">
<a href="https://immich.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Immich Photos</div><div class="link-desc">Photo & Video Archive</div></div>
</a>
<a href="https://jellyfin.svo88.space" class="link-card" target="_blank">
<a href="https://jellyfin.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">Jellyfin</div><div class="link-desc">Courses & Media Stream</div></div>
</a>
<a href="https://mtube.svo88.space" class="link-card" target="_blank">
<a href="https://mtube.${ROOT_DOMAIN}" class="link-card" target="_blank">
<div><div class="link-name">MeTube</div><div class="link-desc">Video Course Downloader</div></div>
</a>
<a href="http://10.0.30.200:8080" class="link-card" target="_blank">
@ -296,10 +296,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- dash.svo88.space
secretName: dash-svo88-tls
- dash.${ROOT_DOMAIN}
secretName: dash-tls
rules:
- host: dash.svo88.space
- host: dash.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/devices/qidi.yaml
View file

@ -46,10 +46,10 @@ metadata:
spec:
ingressClassName: traefik
tls:
- hosts: [print.svo88.space]
secretName: print-svo88-tls
- hosts: [print.${ROOT_DOMAIN}]
secretName: print-tls
rules:
- host: print.svo88.space
- host: print.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/homebox/deployment.yaml
View file

@ -94,10 +94,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- homebox.svo88.space
secretName: homebox-svo88-tls
- homebox.${ROOT_DOMAIN}
secretName: homebox-tls
rules:
- host: homebox.svo88.space
- host: homebox.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/immich/deployment.yaml
View file

@ -214,10 +214,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- immich.svo88.space
secretName: immich-svo88-tls
- immich.${ROOT_DOMAIN}
secretName: immich-tls
rules:
- host: immich.svo88.space
- host: immich.${ROOT_DOMAIN}
http:
paths:
- path: /

8
kubernetes/apps/invidious/deployment.yaml
View file

@ -78,7 +78,7 @@ spec:
host: postgres-core.databases.svc.cluster.local
port: 5432
check_tables: true
domain: yt.svo88.space
domain: yt.${ROOT_DOMAIN}
external_port: 443
https_only: true
port: 3000
@ -142,10 +142,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- yt.svo88.space
secretName: yt-svo88-tls
- yt.${ROOT_DOMAIN}
secretName: yt-tls
rules:
- host: yt.svo88.space
- host: yt.${ROOT_DOMAIN}
http:
paths:
- path: /

8
kubernetes/apps/jellyfin/deployment.yaml
View file

@ -66,7 +66,7 @@ spec:
name: http
env:
- name: JELLYFIN_PublishedServerUrl
value: "https://jellyfin.svo88.space"
value: "https://jellyfin.${ROOT_DOMAIN}"
resources:
requests:
cpu: 100m
@ -123,10 +123,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- jellyfin.svo88.space
secretName: jellyfin-svo88-tls
- jellyfin.${ROOT_DOMAIN}
secretName: jellyfin-tls
rules:
- host: jellyfin.svo88.space
- host: jellyfin.${ROOT_DOMAIN}
http:
paths:
- path: /

8
kubernetes/apps/karakeep/deployment.yaml
View file

@ -74,7 +74,7 @@ spec:
- name: DATA_DIR
value: "/data"
- name: NEXTAUTH_URL
value: "https://keep.svo88.space"
value: "https://keep.${ROOT_DOMAIN}"
- name: MEILI_ADDR
value: "http://127.0.0.1:7700"
- name: BROWSER_WEB_URL
@ -173,10 +173,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- keep.svo88.space
secretName: keep-svo88-tls
- keep.${ROOT_DOMAIN}
secretName: keep-tls
rules:
- host: keep.svo88.space
- host: keep.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/metube/deployment.yaml
View file

@ -71,10 +71,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- metube.svo88.space
secretName: metube-svo88-tls
- metube.${ROOT_DOMAIN}
secretName: metube-tls
rules:
- host: metube.svo88.space
- host: metube.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/netbox/deployment.yaml
View file

@ -92,10 +92,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- netbox.svo88.space
secretName: netbox-svo88-tls
- netbox.${ROOT_DOMAIN}
secretName: netbox-tls
rules:
- host: netbox.svo88.space
- host: netbox.${ROOT_DOMAIN}
http:
paths:
- path: /

14
kubernetes/apps/opencloud/deployment.yaml
View file

@ -14,12 +14,12 @@ data:
connect-src:
- "'self'"
- "blob:"
- "https://auth.svo88.space"
- "https://auth.${ROOT_DOMAIN}"
- "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
- "https://update.opencloud.eu/"
frame-src:
- "'self'"
- "https://auth.svo88.space"
- "https://auth.${ROOT_DOMAIN}"
---
apiVersion: v1
kind: PersistentVolume
@ -124,7 +124,7 @@ spec:
- containerPort: 9200
env:
- name: OC_URL
value: "https://opencloud.svo88.space"
value: "https://opencloud.${ROOT_DOMAIN}"
- name: OC_INSECURE
value: "false"
- name: OC_CONFIG_DIR
@ -148,7 +148,7 @@ spec:
- name: PROXY_CSP_CONFIG_FILE_LOCATION
value: "/etc/opencloud-config/csp.yaml"
- name: OC_OIDC_ISSUER
value: "https://auth.svo88.space/application/o/opencloud/"
value: "https://auth.${ROOT_DOMAIN}/application/o/opencloud/"
- name: WEB_OIDC_CLIENT_ID
value: "web"
- name: WEBFINGER_ANDROID_OIDC_CLIENT_ID
@ -222,10 +222,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- opencloud.svo88.space
secretName: opencloud-svo88-tls
- opencloud.${ROOT_DOMAIN}
secretName: opencloud-tls
rules:
- host: opencloud.svo88.space
- host: opencloud.${ROOT_DOMAIN}
http:
paths:
- path: /

8
kubernetes/apps/pacoloco/ingress.yaml
View file

@ -21,10 +21,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- pkg.svo88.space
secretName: pkg-svo88-tls
- pkg.${ROOT_DOMAIN}
secretName: pkg-tls
rules:
- host: pkg.svo88.space
- host: pkg.${ROOT_DOMAIN}
http:
paths:
- path: /repo
@ -45,7 +45,7 @@ metadata:
spec:
ingressClassName: traefik
rules:
- host: pkg.svo88.space
- host: pkg.${ROOT_DOMAIN}
http:
paths:
- path: /custom

10
kubernetes/apps/paperless/deployment.yaml
View file

@ -50,9 +50,9 @@ spec:
- name: PAPERLESS_PORT
value: "8000"
- name: PAPERLESS_URL
value: "https://docs.svo88.space"
value: "https://docs.${ROOT_DOMAIN}"
- name: PAPERLESS_CSRF_TRUSTED_ORIGINS
value: "https://docs.svo88.space"
value: "https://docs.${ROOT_DOMAIN}"
- name: PAPERLESS_TRUSTED_PROXIES
value: "10.0.0.0/8,10.244.0.0/16"
- name: PAPERLESS_REDIS
@ -120,10 +120,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- paperless.svo88.space
secretName: paperless-svo88-tls
- paperless.${ROOT_DOMAIN}
secretName: paperless-tls
rules:
- host: paperless.svo88.space
- host: paperless.${ROOT_DOMAIN}
http:
paths:
- path: /

8
kubernetes/apps/printstash/deployment.yaml
View file

@ -57,7 +57,7 @@ spec:
- name: VAULT_SETUP_MODE
value: "trusted_network"
- name: VAULT_SETUP_ALLOWED_HOSTS
value: "printstash.svo88.space"
value: "printstash.${ROOT_DOMAIN}"
- name: VAULT_SESSION_COOKIE_SECURE
value: "true"
- name: FORWARDED_ALLOW_IPS
@ -109,10 +109,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- printstash.svo88.space
secretName: printstash-svo88-tls
- printstash.${ROOT_DOMAIN}
secretName: printstash-tls
rules:
- host: printstash.svo88.space
- host: printstash.${ROOT_DOMAIN}
http:
paths:
- path: /

8
kubernetes/apps/searxng/deployment.yaml
View file

@ -41,7 +41,7 @@ spec:
- name: INSTANCE_NAME
value: "Sovereign Search"
- name: BASE_URL
value: "https://search.svo88.space"
value: "https://search.${ROOT_DOMAIN}"
- name: SEARXNG_SECRET
valueFrom:
secretKeyRef:
@ -74,10 +74,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- search.svo88.space
secretName: search-svo88-tls
- search.${ROOT_DOMAIN}
secretName: search-tls
rules:
- host: search.svo88.space
- host: search.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/spoolman/deployment.yaml
View file

@ -68,10 +68,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- spoolman.svo88.space
secretName: spoolman-svo88-tls
- spoolman.${ROOT_DOMAIN}
secretName: spoolman-tls
rules:
- host: spoolman.svo88.space
- host: spoolman.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/sub-store/deployment.yaml
View file

@ -88,10 +88,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- sub-store.svo88.space
secretName: sub-store-svo88-tls
- sub-store.${ROOT_DOMAIN}
secretName: sub-store-tls
rules:
- host: sub-store.svo88.space
- host: sub-store.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/sure-finance/deployment.yaml
View file

@ -93,10 +93,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- finance.svo88.space
secretName: finance-svo88-tls
- finance.${ROOT_DOMAIN}
secretName: finance-tls
rules:
- host: finance.svo88.space
- host: finance.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/tier0/dns.yaml
View file

@ -34,10 +34,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- dns.svo88.space
secretName: dns-svo88-tls
- dns.${ROOT_DOMAIN}
secretName: dns-tls
rules:
- host: dns.svo88.space
- host: dns.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/tier0/forgejo.yaml
View file

@ -33,10 +33,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- git.svo88.space
secretName: git-svo88-tls
- git.${ROOT_DOMAIN}
secretName: git-tls
rules:
- host: git.svo88.space
- host: git.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/tier0/pve.yaml
View file

@ -37,10 +37,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- pve.svo88.space
secretName: pve-svo88-tls
- pve.${ROOT_DOMAIN}
secretName: pve-tls
rules:
- host: pve.svo88.space
- host: pve.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/tier0/vault.yaml
View file

@ -34,10 +34,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- vault.svo88.space
secretName: vault-svo88-tls
- vault.${ROOT_DOMAIN}
secretName: vault-tls
rules:
- host: vault.svo88.space
- host: vault.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/tier0/zot.yaml
View file

@ -34,10 +34,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- zot.svo88.space
secretName: zot-svo88-tls
- zot.${ROOT_DOMAIN}
secretName: zot-tls
rules:
- host: zot.svo88.space
- host: zot.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/trilium/deployment.yaml
View file

@ -84,10 +84,10 @@ spec:
ingressClassName: traefik
tls:
- hosts:
- trilium.svo88.space
secretName: trilium-svo88-tls
- trilium.${ROOT_DOMAIN}
secretName: trilium-tls
rules:
- host: trilium.svo88.space
- host: trilium.${ROOT_DOMAIN}
http:
paths:
- path: /

6
kubernetes/apps/vaultwarden/deployment.yaml
View file

@ -88,10 +88,10 @@ metadata:
spec:
tls:
- hosts:
- vw.svo88.space
secretName: vw-svo88-tls
- vw.${ROOT_DOMAIN}
secretName: vw-tls
rules:
- host: vw.svo88.space
- host: vw.${ROOT_DOMAIN}
http:
paths:
- path: /

2
kubernetes/infrastructure/cert-manager/cluster-issuer.yaml
View file

@ -6,7 +6,7 @@ metadata:
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory
email: atlas@svo88.space
email: atlas@svoo.tech
privateKeySecretRef:
name: letsencrypt-prod-account-key
solvers: