bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

game-stream: deploy Wolf foundation

Browse Source
This commit is contained in:
jenkins 2026-05-21 02:07:17 -03:00
parent 9f61cff34e
commit 1470cea862
15 changed files with 342 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
clusters/atlas/flux-system/applications/game-stream/kustomization.yaml Normal file
View File

@ -0,0 +1,29 @@
# clusters/atlas/flux-system/applications/game-stream/kustomization.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: game-stream
namespace: flux-system
annotations:
kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
spec:
interval: 10m
path: ./services/game-stream
targetNamespace: game-stream
prune: true
sourceRef:
kind: GitRepository
name: flux-system
namespace: flux-system
dependsOn:
- name: cert-manager
- name: keycloak
- name: traefik
- name: vault
healthChecks:
- apiVersion: apps/v1
kind: Deployment
name: oauth2-proxy-wolf
namespace: game-stream
wait: false
timeout: 10m

1
clusters/atlas/flux-system/applications/kustomization.yaml
View File

@ -27,6 +27,7 @@ resources:
- jenkins/kustomization.yaml
- ai-llm/kustomization.yaml
- openclaw/kustomization.yaml
- game-stream/kustomization.yaml
- typhon/kustomization.yaml
- nextcloud/kustomization.yaml
- nextcloud-mail-sync/kustomization.yaml

2
infrastructure/core/coredns-custom.yaml
View File

@ -29,6 +29,7 @@ data:
192.168.22.9 matrix.live.bstein.dev
192.168.22.9 metrics.bstein.dev
192.168.22.9 monero.bstein.dev
192.168.22.26 moonlight.bstein.dev
10.43.6.87 money.bstein.dev
192.168.22.9 notes.bstein.dev
192.168.22.9 office.bstein.dev
@ -41,6 +42,7 @@ data:
192.168.22.9 secret.bstein.dev
192.168.22.9 sso.bstein.dev
192.168.22.9 stream.bstein.dev
192.168.22.9 wolf.bstein.dev
192.168.22.9 tasks.bstein.dev
192.168.22.9 vault.bstein.dev
fallthrough

13
services/game-stream/certificate.yaml Normal file
View File

@ -0,0 +1,13 @@
# services/game-stream/certificate.yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: wolf-tls
namespace: game-stream
spec:
secretName: wolf-tls
issuerRef:
kind: ClusterIssuer
name: letsencrypt
dnsNames:
- wolf.bstein.dev

26
services/game-stream/ingress.yaml Normal file
View File

@ -0,0 +1,26 @@
# services/game-stream/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: wolf
namespace: game-stream
annotations:
cert-manager.io/cluster-issuer: letsencrypt
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
spec:
ingressClassName: traefik
tls:
- hosts: ["wolf.bstein.dev"]
secretName: wolf-tls
rules:
- host: wolf.bstein.dev
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: oauth2-proxy-wolf
port:
number: 80

11
services/game-stream/kustomization.yaml Normal file
View File

@ -0,0 +1,11 @@
# services/game-stream/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- vault-serviceaccount.yaml
- wolf-service.yaml
- wolf-statefulset.yaml
- oauth2-proxy-wolf.yaml
- certificate.yaml
- ingress.yaml

6
services/game-stream/namespace.yaml Normal file
View File

@ -0,0 +1,6 @@
# services/game-stream/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
name: game-stream

120
services/game-stream/oauth2-proxy-wolf.yaml Normal file
View File

@ -0,0 +1,120 @@
# services/game-stream/oauth2-proxy-wolf.yaml
apiVersion: v1
kind: Service
metadata:
name: oauth2-proxy-wolf
namespace: game-stream
labels:
app: oauth2-proxy-wolf
spec:
ports:
- name: http
port: 80
targetPort: 4180
selector:
app: oauth2-proxy-wolf
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: oauth2-proxy-wolf
namespace: game-stream
labels:
app: oauth2-proxy-wolf
spec:
replicas: 2
selector:
matchLabels:
app: oauth2-proxy-wolf
template:
metadata:
labels:
app: oauth2-proxy-wolf
annotations:
vault.hashicorp.com/agent-inject: "true"
vault.hashicorp.com/role: "game-stream"
vault.hashicorp.com/agent-inject-secret-oidc-config: "kv/data/atlas/game-stream/wolf-oidc"
vault.hashicorp.com/agent-inject-template-oidc-config: |
{{- with secret "kv/data/atlas/game-stream/wolf-oidc" -}}
client_id = "{{ .Data.data.client_id }}"
client_secret = "{{ .Data.data.client_secret }}"
cookie_secret = "{{ .Data.data.cookie_secret }}"
{{- end -}}
spec:
serviceAccountName: game-stream-vault
nodeSelector:
node-role.kubernetes.io/worker: "true"
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/arch
operator: In
values: ["amd64","arm64"]
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
preference:
matchExpressions:
- key: hardware
operator: In
values: ["rpi5"]
- weight: 80
preference:
matchExpressions:
- key: hardware
operator: In
values: ["rpi4"]
containers:
- name: oauth2-proxy
image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
imagePullPolicy: IfNotPresent
args:
- --provider=oidc
- --config=/vault/secrets/oidc-config
- --redirect-url=https://wolf.bstein.dev/oauth2/callback
- --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
- --scope=openid profile email groups
- --email-domain=*
- --allowed-group=game-stream-users
- --allowed-group=/game-stream-users
- --allowed-group=admin
- --allowed-group=/admin
- --set-xauthrequest=true
- --pass-access-token=true
- --set-authorization-header=true
- --cookie-secure=true
- --cookie-samesite=lax
- --cookie-refresh=20m
- --cookie-expire=24h
- --insecure-oidc-allow-unverified-email=true
- --upstream=http://ariadne.maintenance.svc.cluster.local:8080
- --http-address=0.0.0.0:4180
- --skip-provider-button=true
- --approval-prompt=auto
- --skip-jwt-bearer-tokens=true
- --oidc-groups-claim=groups
- --cookie-domain=wolf.bstein.dev
ports:
- containerPort: 4180
name: http
readinessProbe:
httpGet:
path: /ping
port: 4180
initialDelaySeconds: 5
periodSeconds: 10
livenessProbe:
httpGet:
path: /ping
port: 4180
initialDelaySeconds: 20
periodSeconds: 20
resources:
requests:
cpu: 25m
memory: 64Mi
limits:
cpu: 250m
memory: 256Mi

7
services/game-stream/vault-serviceaccount.yaml Normal file
View File

@ -0,0 +1,7 @@
# services/game-stream/vault-serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: game-stream-vault
namespace: game-stream

16
services/game-stream/wolf-service.yaml Normal file
View File

@ -0,0 +1,16 @@
# services/game-stream/wolf-service.yaml
apiVersion: v1
kind: Service
metadata:
name: wolf
namespace: game-stream
labels:
app: wolf
spec:
clusterIP: None
selector:
app: wolf
ports:
- name: placeholder
port: 47989
targetPort: 47989

79
services/game-stream/wolf-statefulset.yaml Normal file
View File

@ -0,0 +1,79 @@
# services/game-stream/wolf-statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: wolf
namespace: game-stream
labels:
app: wolf
spec:
serviceName: wolf
replicas: 1
selector:
matchLabels:
app: wolf
template:
metadata:
labels:
app: wolf
atlas.bstein.dev/game-mode: wolf
spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
runtimeClassName: nvidia
nodeSelector:
kubernetes.io/hostname: titan-24
tolerations:
- key: nvidia.com/gpu
operator: Exists
effect: NoSchedule
containers:
- name: wolf
image: ghcr.io/games-on-whales/wolf:stable
imagePullPolicy: IfNotPresent
env:
- name: WOLF_LOG_LEVEL
value: INFO
- name: WOLF_DOCKER_SOCKET
value: /var/run/docker.sock
- name: NVIDIA_DRIVER_CAPABILITIES
value: all
- name: NVIDIA_VISIBLE_DEVICES
value: all
securityContext:
privileged: true
resources:
requests:
cpu: "2"
memory: 4Gi
nvidia.com/gpu.shared: 1
limits:
cpu: "12"
memory: 32Gi
nvidia.com/gpu.shared: 1
volumeMounts:
- name: wolf-state
mountPath: /etc/wolf
- name: docker-socket
mountPath: /var/run/docker.sock
- name: dev
mountPath: /dev
- name: udev
mountPath: /run/udev
volumes:
- name: wolf-state
hostPath:
path: /etc/wolf
type: DirectoryOrCreate
- name: docker-socket
hostPath:
path: /var/run/docker.sock
type: Socket
- name: dev
hostPath:
path: /dev
type: Directory
- name: udev
hostPath:
path: /run/udev
type: Directory

22
services/maintenance/ariadne-deployment.yaml
View File

@ -31,6 +31,9 @@ spec:
export ARIADNE_DATABASE_URL="{{ .Data.data.database_url }}"
export JENKINS_API_USER="{{ .Data.data.jenkins_api_user }}"
export JENKINS_API_TOKEN="{{ .Data.data.jenkins_api_token }}"
{{- if .Data.data.game_mode_hook_token }}
export GAME_MODE_HOOK_TOKEN="{{ .Data.data.game_mode_hook_token }}"
{{- end }}
{{ end }}
{{ with secret "kv/data/atlas/portal/atlas-portal-db" }}
export PORTAL_DATABASE_URL="{{ .Data.data.PORTAL_DATABASE_URL }}"
@ -277,6 +280,25 @@ spec:
value: vault-admin
- name: VAULT_K8S_ROLE_TTL
value: 1h
- name: GAME_MODE_NODE_NAME
value: titan-24
- name: GAME_MODE_DISPLACE_WORKLOADS
value: >-
[{"kind":"Deployment","namespace":"openclaw","name":"openclaw-ollama","restoreReplicas":1}]
- name: WOLF_OIDC_CLIENT_ID
value: wolf
- name: WOLF_OIDC_BASE_URL
value: https://wolf.bstein.dev
- name: WOLF_OIDC_VAULT_PATH
value: game-stream/wolf-oidc
- name: ARIADNE_SCHEDULE_WOLF_OIDC
value: "17 */6 * * *"
- name: GAME_STREAM_USER_GROUP
value: game-stream-users
- name: GAME_STREAM_ADMIN_GROUP
value: admin
- name: GAME_STREAM_PROFILE_GROUP_PREFIX
value: game-stream-profile-
- name: COMMS_NAMESPACE
value: comms
- name: COMMS_SYNAPSE_BASE

8
services/maintenance/ariadne-rbac.yaml
View File

@ -32,6 +32,14 @@ rules:
- list
- watch
- delete
- apiGroups: ["apps"]
resources:
- deployments/scale
- statefulsets/scale
verbs:
- get
- patch
- update
- apiGroups: [""]
resources:
- persistentvolumeclaims

1
services/openclaw/ollama-deployment.yaml
View File

@ -7,7 +7,6 @@ metadata:
labels:
app: openclaw-ollama
spec:
replicas: 1
revisionHistoryLimit: 2
strategy:
type: Recreate

2
services/vault/scripts/vault_k8s_auth_configure.sh
View File

@ -236,6 +236,8 @@ write_policy_and_role "crypto" "crypto" "crypto-vault-sync" \
"crypto/* shared/harbor-pull" ""
write_policy_and_role "health" "health" "health-vault-sync" \
"health/*" ""
write_policy_and_role "game-stream" "game-stream" "game-stream-vault" \
"game-stream/*" ""
write_policy_and_role "openclaw" "openclaw" "agent-vault" \
"openclaw/*" ""
write_policy_and_role "maintenance" "maintenance" "ariadne,maintenance-vault-sync,metis" \