mj-infra-flux

git

This is our Kubernetes Flux repository. It WILL(?) everything installed in my kubernetes cluster and keeps the cluster up to date with this repo.

I stole this from Activescott

NOTE: IN PROGRESS. Still converting my old repo containing kubernetes resources – https://github.com/jimwilleke/home-infra – to this one. It's great that this can be gradual and isn't an all-in moment on Flux. So far so good though!

• AGENTS.md - START HERE - Project context and instructions for all AI agents (Claude, Gemini, etc.)
• ARCHITECTURE.md - Complete architecture documentation
• DEPLOYMENT-GUIDELINES.md - Deployment best practices
• CODE_STANDARDS.md - Coding standards and best practices
• CONTRIBUTING.md - Contribution guidelines
• SETUP.md - Initial setup and bootstrapping instructions
• SECURITY-INCIDENT.md - Security lessons learned
• docker-migration.md - Migration strategy from Docker to Kubernetes

• Traefik (k3s bundled) - HelmChartConfig: client IP, access logs
• MariaDB Library - Shared MariaDB configuration

• Authentik - SSO/IdP for all protected services
• TeslaMate - Vehicle tracking
• Home Assistant - Home automation
• Home Assistant Proxy - Authentik-protected proxy for Home Assistant
• Hoarder - Bookmark and content management
• Landing Page - Public landing page
• Guest Services - Public guest services
• Monitoring - Grafana, Prometheus, Alertmanager
• jimsmcp - MCP server for managing infrastructure
• Database - Shared PostgreSQL database
• Messaging - Shared Mosquitto MQTT broker
• Shared Resources - CDN for static assets (icons, logos)

# force reconciliation to source:
flux reconcile kustomization flux-system --with-source

# Show all Flux objects that are not ready !
flux get all -A --status-selector ready=false

# watch flux events:
flux events -w

# Show flux warning events
kubectl get events -n flux-system --field-selector type=Warning

flux get kustomizations --watch

###############
#
# To fix something manually while flux won't constantly replace them do this:
flux suspend kustomization apps
# then make changes
# then resume:
flux resume kustomization apps
#
###############

flux reconcile kustomization apps

# I find it helpful to get logs directly from the kusotmization controller:
kubectl -n flux-system logs -f deployment/kustomize-controller


# Automated Image Updates:
# check the image repository (per https://fluxcd.io/flux/guides/image-update/)
flux get image repository -n tayle-prod repo-tayle-app

# list images flux is tracking:
flux get images all --all-namespaces

# list the image policies:
flux get images -A policy

# list all image repositories:
kubectl get -A imagerepository

# list the tags found in an image repository:
kubectl get -n tayle-prod -o=yaml imagerepository/repo-tayle-worker

# a handy way to do a drunrun on the kustomize (this prints a lot of warnings when it works but returns non-zero as long as there are no errors):
kubectl kustomize apps/production | kubectl apply --dry-run='server' -f -

├── apps
│   ├── base
│   ├── production
│   └── staging
├── infrastructure
│   ├── base
│   ├── production
│   └── staging
└── clusters
    ├── production
    └── staging

per https://fluxcd.io/flux/guides/repository-structure/ example at https://github.com/fluxcd/flux2-kustomize-helm-example

Using sops + age.

TLDR: put .env files in a dirctory and then run /scripts/encrypt-env-files.sh <dir> on the dir containing the .env file and it will save .env*.encrypted files that you can reference in kustomization files like:

secretGenerator:
  # db
  - name: db-creds
    envs:
      - .env.secret.db.encrypted

Per https://fluxcd.io/flux/guides/mozilla-sops/#encrypting-secrets-using-age

The flux+kustomize knows how to decrypt SOPS secrets via secret generator. So we just have to have a sops-age secret in the flux-system namespace in the cluster.

See /infrastructure/configs/create-sops-age-decryption-secret.sh

Per https://fluxcd.io/flux/guides/mozilla-sops/#encrypting-secrets-using-age

Image Pull Secrets (to Pull an Image from a Private Registry) using .dockerconfigjson secrets are kinda just like json secrets. Run:

./scripts/create-image-pull-secret-ghcr.sh

Per https://fluxcd.io/flux/components/kustomize/kustomizations/#kustomize-secretgenerator

Image scanning for one app setup at apps/production/tayle/image-scanning per https://fluxcd.io/flux/guides/image-update/

Removed 2026-10-14. The Flux Receiver (flux-webhook.nerdsbythehour.com) only refreshed the long-gone repo-tayle-* ImageRepositories, had no public DNS or Cloudflare Tunnel route, and never received a request. Image updates rely on each ImageRepository's polling interval (1m–1h). If a webhook is ever wanted again, publish it through the Cloudflare Tunnel and point the Receiver at existing ImageRepositories.

I prefer plain "kubectl yaml" and Kustomize over helm. Helm is great for packaging up an app into an opaque package and provide it to others, but IMHO not for managing a cluster directly. When consuming apps, I prefer consuming yaml if provided, but don't mind consuming Helm.

• Setup transmission with secrets
• Setup image updates for tayle: https://fluxcd.io/flux/guides/image-update/ & https://fluxcd.io/flux/components/image/imageupdateautomations/
• NOT DOING THIS [ ] Expose webhook receiver for tayle main events: https://fluxcd.io/flux/guides/webhook-receivers/
• NOT DOING THIS [ ] Setup transmission with image updates and

• Bootstrap See script for this in scripts dir. it was updated.

flux bootstrap github \
--token-auth \
--owner=jimwilleke \
--repository=home-infra-k8s-flux \
--branch=main \
--path=clusters/nas1 \
--personal