added adguard and agrocd self management

services/adguard/app.yaml

@@ -0,0 +1,78 @@
+# services/<naam>/app.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: adguard
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: adguard-config
+  namespace: adguard
+spec:
+  storageClassName: nfs-client        # NFS vanaf Proxmox — Bijlage A
+  accessModes: [ReadWriteMany]
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguard
+  namespace: adguard
+spec:
+  selector:
+    matchLabels: {app: adguard}
+  template:
+    metadata:
+      labels: {app: adguard}
+    spec:
+      containers:
+      - name: adguard
+        image: adguard/adguardhome:v0.107.79          # pin de tag! (Renovate houdt ze bij)
+        ports: [{containerPort: 80}]
+        volumeMounts: [{name: config, mountPath: /config}]
+      volumes:
+      - name: config
+        persistentVolumeClaim: {claimName: adguard-config}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard
+  namespace: adguard
+spec:
+  selector: {app: adguard}
+  ports: [{port: 80, targetPort: 80}]   # intern op 80 zetten is handig
+---
+# toevoegen in service.yaml — DNS op de node zelf
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-dns
+  namespace: adguard
+spec:
+  type: LoadBalancer                # klipper bindt poort 53 op de node(s)
+  selector: {app: adguard}
+  ports:
+  - {name: dns-tcp, port: 53, targetPort: 53, protocol: TCP}
+  - {name: dns-udp, port: 53, targetPort: 53, protocol: UDP}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: adguard
+  namespace: adguard
+spec:
+  rules:
+  - host: adguard-cluster.zb-kw.duckdns.org
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service: {name: adguard, port: {number: 80}}
+  tls:
+  - hosts: [adguard-cluster.zb-kw.duckdns.org]
+    secretName: zb-kw-wildcard-tls

services/adguard/cert.yaml

@@ -0,0 +1,10 @@
+# services/<naam>/cert.yaml
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: zb-kw-wildcard
+  namespace: adguard
+spec:
+  secretName: zb-kw-wildcard-tls
+  dnsNames: ["adguard-cluster.zb-kw.duckdns.org"]
+  issuerRef: {name: duckdns, kind: ClusterIssuer}