From 3e45ddaf4a4e6291dce7d03b5d7ca14c4410b284 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Thu, 22 Oct 2026 09:06:52 +0200 Subject: [PATCH] Remove lingo lingo-api ran PHP 8.1.34 (php:8.1-apache) and was reachable at https://lingo.rubenhensen.nl/api/. PHP 8.1 is EOL and gets no fix for CVE-2026-109618 and CVE-2026-109619, so it was exposed to the PHP2Shell RCE. It is no longer used, so drop it entirely: the app, its Gatus check, the DNS record and the node001 tunnel entry. --- apps/templates/lingo-folder.yaml | 21 ------------ dns/domains/rubenhensen.nl.yaml | 4 --- gatus/config.yaml | 5 --- lingo/lingo-api-deployment.yaml | 32 ------------------ lingo/lingo-api-service.yaml | 13 -------- lingo/lingo-frontend-deployment.yaml | 32 ------------------ lingo/lingo-frontend-service.yaml | 13 -------- lingo/lingo-ingress.yaml | 50 ---------------------------- nix-infra-machine/nodes/node001.nix | 1 - 9 files changed, 171 deletions(-) delete mode 100644 apps/templates/lingo-folder.yaml delete mode 100644 lingo/lingo-api-deployment.yaml delete mode 100644 lingo/lingo-api-service.yaml delete mode 100644 lingo/lingo-frontend-deployment.yaml delete mode 100644 lingo/lingo-frontend-service.yaml delete mode 100644 lingo/lingo-ingress.yaml diff --git a/apps/templates/lingo-folder.yaml b/apps/templates/lingo-folder.yaml deleted file mode 100644 index e3002c3..0000000 --- a/apps/templates/lingo-folder.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: lingo - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: default - source: - repoURL: https://github.com/rubenhensen/k8scd.git - targetRevision: HEAD - path: lingo - destination: - server: https://kubernetes.default.svc - namespace: lingo - syncPolicy: - syncOptions: - - CreateNamespace=true - automated: - selfHeal: true diff --git a/dns/domains/rubenhensen.nl.yaml b/dns/domains/rubenhensen.nl.yaml index 244cdb3..cf7d93c 100644 --- a/dns/domains/rubenhensen.nl.yaml +++ b/dns/domains/rubenhensen.nl.yaml @@ -43,10 +43,6 @@ records: expire: 300 type: A content: "46.224.26.65" - - name: "lingo" - expire: 300 - type: A - content: "46.224.26.65" - name: "blog" expire: 300 type: A diff --git a/gatus/config.yaml b/gatus/config.yaml index 24b3078..7d74f4b 100644 --- a/gatus/config.yaml +++ b/gatus/config.yaml @@ -73,11 +73,6 @@ endpoints: conditions: - "[STATUS] == 401" - "[CERTIFICATE_EXPIRATION] > 168h" - - name: lingo - group: rubenhensen.nl - url: https://lingo.rubenhensen.nl - interval: 60s - conditions: *http-ok - name: blog group: rubenhensen.nl url: https://blog.rubenhensen.nl diff --git a/lingo/lingo-api-deployment.yaml b/lingo/lingo-api-deployment.yaml deleted file mode 100644 index 543621c..0000000 --- a/lingo/lingo-api-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: lingo-api - name: lingo-api -spec: - replicas: 1 - selector: - matchLabels: - app: lingo-api - strategy: - type: Recreate - template: - metadata: - labels: - app: lingo-api - spec: - containers: - - image: ghcr.io/rubenhensen/lingo-api:master-4404fe5 - name: lingo-api - ports: - - containerPort: 80 - protocol: TCP - resources: - requests: - memory: "128Mi" - cpu: "100m" - limits: - memory: "512Mi" - cpu: "500m" - restartPolicy: Always diff --git a/lingo/lingo-api-service.yaml b/lingo/lingo-api-service.yaml deleted file mode 100644 index 0912f7c..0000000 --- a/lingo/lingo-api-service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - app: lingo-api - name: lingo-api -spec: - ports: - - name: "api" - port: 8000 - targetPort: 80 - selector: - app: lingo-api diff --git a/lingo/lingo-frontend-deployment.yaml b/lingo/lingo-frontend-deployment.yaml deleted file mode 100644 index b1ae343..0000000 --- a/lingo/lingo-frontend-deployment.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: lingo-frontend - name: lingo-frontend -spec: - replicas: 1 - selector: - matchLabels: - app: lingo-frontend - strategy: - type: Recreate - template: - metadata: - labels: - app: lingo-frontend - spec: - containers: - - image: ghcr.io/rubenhensen/lingo-frontend:master-46bddb5 - name: lingo-frontend - ports: - - containerPort: 80 - protocol: TCP - resources: - requests: - memory: "128Mi" - cpu: "100m" - limits: - memory: "512Mi" - cpu: "500m" - restartPolicy: Always diff --git a/lingo/lingo-frontend-service.yaml b/lingo/lingo-frontend-service.yaml deleted file mode 100644 index 4c696d7..0000000 --- a/lingo/lingo-frontend-service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - labels: - app: lingo-frontend - name: lingo-frontend -spec: - ports: - - name: "frontend" - port: 8001 - targetPort: 80 - selector: - app: lingo-frontend diff --git a/lingo/lingo-ingress.yaml b/lingo/lingo-ingress.yaml deleted file mode 100644 index 6a56b9a..0000000 --- a/lingo/lingo-ingress.yaml +++ /dev/null @@ -1,50 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: lingo-api-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/ssl-passthrough: "false" - nginx.ingress.kubernetes.io/rewrite-target: /$2 -spec: - ingressClassName: nginx - rules: - - host: lingo.rubenhensen.nl - http: - paths: - - path: /api(/|$)(.*) - pathType: ImplementationSpecific - backend: - service: - name: lingo-api - port: - number: 8000 - tls: - - secretName: letsencrypt-prod - hosts: - - lingo.rubenhensen.nl ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: lingo-frontend-ingress - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/ssl-passthrough: "false" -spec: - ingressClassName: nginx - rules: - - host: lingo.rubenhensen.nl - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: lingo-frontend - port: - number: 8001 - tls: - - secretName: letsencrypt-prod - hosts: - - lingo.rubenhensen.nl diff --git a/nix-infra-machine/nodes/node001.nix b/nix-infra-machine/nodes/node001.nix index 279a225..f96c7d6 100644 --- a/nix-infra-machine/nodes/node001.nix +++ b/nix-infra-machine/nodes/node001.nix @@ -16,7 +16,6 @@ let "argocd.rubenhensen.nl" "ha.rubenhensen.nl" "longhorn.rubenhensen.nl" - "lingo.rubenhensen.nl" "blog.rubenhensen.nl" "serpbear.rubenhensen.nl" "git.rubenhensen.nl"