mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
3e45ddaf4a
lingo-api ran PHP 8.1.34 (php:8.1-apache) and was reachable at https://lingo.rubenhensen.nl/api/. PHP 8.1 is EOL and gets no fix for CVE-2026-109618 and CVE-2026-109619, so it was exposed to the PHP2Shell RCE. It is no longer used, so drop it entirely: the app, its Gatus check, the DNS record and the node001 tunnel entry.
142 lines
3.5 KiB
YAML
142 lines
3.5 KiB
YAML
# s2.rubenhensen.nl: Gatus on the home cluster.
|
|
# Its twin s1.rubenhensen.nl runs on the Hetzner box, see
|
|
# nix-infra-machine/nodes/node001.nix. Keep the endpoint lists in sync.
|
|
storage:
|
|
type: sqlite
|
|
path: /data/data.db
|
|
|
|
ui:
|
|
title: Status (homelab)
|
|
header: s2 · homelab
|
|
buttons:
|
|
- name: s1 (Hetzner)
|
|
link: https://s1.rubenhensen.nl
|
|
|
|
# NTFY_TOKEN comes from the gatus-ntfy secret (Vault kv/ntfy)
|
|
alerting:
|
|
ntfy:
|
|
url: http://ntfy.ntfy.svc.cluster.local
|
|
topic: alerts
|
|
token: ${NTFY_TOKEN}
|
|
priority: 4
|
|
click: https://s2.rubenhensen.nl
|
|
default-alert:
|
|
failure-threshold: 3
|
|
success-threshold: 2
|
|
send-on-resolved: true
|
|
|
|
# s2 is the outside view of Hetzner, so it alerts on mail and on s1. The
|
|
# home services are left to s1.
|
|
endpoints:
|
|
# Tunneled through Hetzner to the home cluster
|
|
- name: rss
|
|
group: rubenhensen.nl
|
|
url: https://rss.rubenhensen.nl
|
|
interval: 60s
|
|
# mod_auth_openidc answers 401 instead of redirecting to the login
|
|
# page unless the client asks for HTML
|
|
headers:
|
|
Accept: text/html
|
|
conditions: &http-ok
|
|
- "[STATUS] == 200"
|
|
- "[CERTIFICATE_EXPIRATION] > 168h"
|
|
- name: authentik
|
|
group: rubenhensen.nl
|
|
url: https://authentik.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: vault
|
|
group: rubenhensen.nl
|
|
url: https://vault.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: ynab
|
|
group: rubenhensen.nl
|
|
url: https://ynab.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: argocd
|
|
group: rubenhensen.nl
|
|
url: https://argocd.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: ha
|
|
group: rubenhensen.nl
|
|
url: https://ha.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: longhorn
|
|
group: rubenhensen.nl
|
|
url: https://longhorn.rubenhensen.nl
|
|
interval: 60s
|
|
# Behind basic auth, so 401 means it's up
|
|
conditions:
|
|
- "[STATUS] == 401"
|
|
- "[CERTIFICATE_EXPIRATION] > 168h"
|
|
- name: blog
|
|
group: rubenhensen.nl
|
|
url: https://blog.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: serpbear
|
|
group: rubenhensen.nl
|
|
url: https://serpbear.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: git
|
|
group: rubenhensen.nl
|
|
url: https://git.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: vic
|
|
group: rubenhensen.nl
|
|
url: https://vic.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
|
|
# Stalwart on Hetzner
|
|
- name: webmail
|
|
group: mail
|
|
url: https://mail.rubenhensen.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
alerts: &ntfy
|
|
- type: ntfy
|
|
- name: smtp
|
|
group: mail
|
|
url: tcp://mail.rubenhensen.nl:25
|
|
interval: 60s
|
|
conditions:
|
|
- "[CONNECTED] == true"
|
|
alerts: *ntfy
|
|
- name: imaps
|
|
group: mail
|
|
url: tls://mail.rubenhensen.nl:993
|
|
interval: 60s
|
|
conditions:
|
|
- "[CONNECTED] == true"
|
|
- "[CERTIFICATE_EXPIRATION] > 168h"
|
|
alerts: *ntfy
|
|
|
|
# Served straight from the home IP
|
|
- name: scoutingmbg.nl
|
|
group: Scouting MBG
|
|
url: https://scoutingmbg.nl
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
- name: foto.scoutingmbg.nl
|
|
group: Scouting MBG
|
|
url: https://foto.scoutingmbg.nl/_app
|
|
interval: 60s
|
|
conditions: *http-ok
|
|
|
|
# The other watcher
|
|
- name: s1 (Hetzner)
|
|
group: watchers
|
|
url: https://s1.rubenhensen.nl/health
|
|
interval: 60s
|
|
conditions:
|
|
- "[STATUS] == 200"
|
|
- "[BODY].status == UP"
|
|
alerts: *ntfy
|