PERF(applications): remove CPU limits for stability

- Remove CPU limits from docusaurus, headlamp, homer, mas
- Prevents CPU throttling issues

application.yaml

@@ -9,7 +9,7 @@ spec:
   project: default
 
   source:
-    repoURL: https://github.com/K3S-HOME/applications.git
+    repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     path: .
 

code-server/argocd.yaml

@@ -14,10 +14,10 @@ spec:
     helm:
       valueFiles:
       - $values/code-server/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     path: code-server
   destination:

code-server/helm-values.yaml

@@ -40,13 +40,13 @@ service:
   type: ClusterIP
   port: 8080
 
-# Resource limits
+# Resource settings (no CPU limit for stability)
 resources:
   requests:
     cpu: 15m
-    memory: 512Mi
+    memory: 225Mi
   limits:
-    memory: 512Mi
+    memory: 302Mi
 
 # Security context
 securityContext:

code-server/manifests/secret.yaml

@@ -14,5 +14,5 @@ spec:
   data:
     - secretKey: password
       remoteRef:
-        key: code-server
+        key: applications/code-server
         property: PASSWORD

docusaurus/argocd.yaml

@@ -9,19 +9,19 @@ metadata:
     argocd-image-updater.argoproj.io/image-list: docusaurus=zot0213.kro.kr/docusaurus:latest
     argocd-image-updater.argoproj.io/docusaurus.update-strategy: digest
     argocd-image-updater.argoproj.io/docusaurus.pull-secret: pullsecret:argocd/zot-creds
-    argocd-image-updater.argoproj.io/write-back-method: git:secret:argocd/github-creds
+    argocd-image-updater.argoproj.io/write-back-method: git:secret:argocd/gitea-creds
     argocd-image-updater.argoproj.io/git-branch: main
     argocd-image-updater.argoproj.io/docusaurus.helm.image-tag: image.tag
 spec:
   project: default
   sources:
-  - repoURL: https://github.com/K3S-HOME/web-apps.git
+  - repoURL: https://github0213.com/K3S-HOME/web-apps.git
     targetRevision: main
     path: charts/web-app
     helm:
       valueFiles:
       - $values/docusaurus/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     ref: values
   destination:

docusaurus/helm-values.yaml

@@ -11,7 +11,7 @@ image:
 imagePullSecrets:
   - name: zot-secret
 
-replicaCount: 2
+replicaCount: 1
 containerPort: 80  # nginx
 
 service:
@@ -34,12 +34,13 @@ ingress:
       hosts:
         - docusaurus0213.kro.kr
 
+# Resource settings (no CPU limit for stability)
 resources:
   requests:
-    memory: 100Mi
     cpu: 10m
+    memory: 50Mi
   limits:
-    memory: 100Mi
+    memory: 50Mi
 
 healthCheck:
   enabled: true

gitea/argocd.yaml

@@ -1,41 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: gitea
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  sources:
-  - repoURL: https://dl.gitea.com/charts/
-    chart: gitea
-    targetRevision: 12.4.0
-    helm:
-      valueFiles:
-      - $values/gitea/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/applications.git
-    targetRevision: main
-    ref: values
-  - repoURL: https://github.com/K3S-HOME/applications.git
-    targetRevision: main
-    path: gitea
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: gitea
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-    syncOptions:
-    - CreateNamespace=true
-    - PrunePropagationPolicy=foreground
-    - PruneLast=true
-    retry:
-      limit: 5
-      backoff:
-        duration: 5s
-        factor: 2
-        maxDuration: 3m
-  revisionHistoryLimit: 10

gitea/helm-values.yaml

@@ -1,125 +0,0 @@
-# Gitea Helm Chart Values
-# Self-contained deployment with SQLite and local-path storage
-
-# =============================================================================
-# DISABLE ALL EXTERNAL DEPENDENCIES
-# =============================================================================
-postgresql-ha:
-  enabled: false
-
-postgresql:
-  enabled: false
-
-valkey-cluster:
-  enabled: false
-
-valkey:
-  enabled: false
-
-# =============================================================================
-# PERSISTENCE - local-path StorageClass
-# =============================================================================
-persistence:
-  enabled: true
-  create: true
-  mount: true
-  size: 10Gi
-  accessModes:
-  - ReadWriteOnce
-  storageClass: local-path-retain
-  annotations:
-    helm.sh/resource-policy: keep
-
-# =============================================================================
-# ADMIN USER
-# =============================================================================
-gitea:
-  admin:
-    existingSecret: gitea-admin-secret
-    username: Mayne0213
-    email: bluemayne0213@icloud.com
-    passwordMode: keepUpdated
-
-  # Gitea configuration (app.ini)
-  config:
-    APP_NAME: Gitea - K3S-HOME
-
-    server:
-      DOMAIN: github0213.com
-      ROOT_URL: https://github0213.com
-      HTTP_PORT: 3000
-      SSH_DOMAIN: github0213.com
-      SSH_PORT: 22
-      SSH_LISTEN_PORT: 2222
-      LFS_START_SERVER: true
-
-    database:
-      DB_TYPE: sqlite3
-      PATH: /data/gitea/gitea.db
-      SQLITE_TIMEOUT: 500
-      SQLITE_JOURNAL_MODE: WAL
-
-    session:
-      PROVIDER: memory
-
-    cache:
-      ADAPTER: memory
-
-    queue:
-      TYPE: level
-
-    security:
-      INSTALL_LOCK: true
-
-    service:
-      DISABLE_REGISTRATION: false
-      REQUIRE_SIGNIN_VIEW: false
-      DEFAULT_KEEP_EMAIL_PRIVATE: true
-
-    log:
-      MODE: console
-      LEVEL: info
-
-# =============================================================================
-# INGRESS
-# =============================================================================
-ingress:
-  enabled: true
-  className: traefik
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-  hosts:
-  - host: github0213.com
-    paths:
-    - path: /
-      pathType: Prefix
-  tls:
-  - secretName: github-tls
-    hosts:
-    - github0213.com
-
-# =============================================================================
-# RESOURCES
-# =============================================================================
-resources:
-  requests:
-    cpu: 15m
-    memory: 200Mi
-  limits:
-    memory: 200Mi
-
-# =============================================================================
-# POD CONFIGURATION
-# =============================================================================
-tolerations:
-- key: node-role.kubernetes.io/control-plane
-  operator: Exists
-  effect: NoSchedule
-
-# =============================================================================
-# SSH SERVICE
-# =============================================================================
-service:
-  ssh:
-    type: ClusterIP
-    port: 22

gitea/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- redirect.yaml
-namespace: gitea

gitea/redirect.yaml

@@ -1,70 +0,0 @@
-# Traefik Middleware for GitHub redirect
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: redirect-to-github
-  namespace: gitea
-spec:
-  redirectRegex:
-    regex: ".*"
-    replacement: "https://github.com/mayne0213"
-    permanent: true
----
-# IngressRoute for HTTPS
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitea-redirect-https
-  namespace: gitea
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`gitea0213.kro.kr`) || Host(`www.gitea0213.kro.kr`)
-      kind: Rule
-      middlewares:
-        - name: redirect-to-github
-      services:
-        - name: noop@internal
-          kind: TraefikService
-  tls:
-    secretName: gitea-tls
-    domains:
-      - main: gitea0213.kro.kr
-        sans:
-          - www.gitea0213.kro.kr
----
-# IngressRoute for HTTP (redirect to HTTPS first, then to GitHub)
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitea-redirect-http
-  namespace: gitea
-spec:
-  entryPoints:
-    - web
-  routes:
-    - match: Host(`gitea0213.kro.kr`) || Host(`www.gitea0213.kro.kr`)
-      kind: Rule
-      middlewares:
-        - name: redirect-to-github
-      services:
-        - name: noop@internal
-          kind: TraefikService
----
-# Certificate for TLS
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: gitea-certificate
-  namespace: gitea
-spec:
-  secretName: gitea-tls
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
-  dnsNames:
-    - gitea0213.kro.kr
-    - www.gitea0213.kro.kr

headlamp/argocd.yaml

@@ -14,10 +14,10 @@ spec:
     helm:
       valueFiles:
       - $values/headlamp/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     path: headlamp
   destination:

headlamp/helm-values.yaml

@@ -1,6 +1,6 @@
 # Headlamp Helm Values
 
-replicaCount: 2
+replicaCount: 1
 
 image:
   registry: ghcr.io
@@ -19,6 +19,7 @@ service:
   type: ClusterIP
   port: 80
 
+# Resource settings (no CPU limit for stability)
 resources:
   requests:
     cpu: 15m

headlamp/manifests/external-secret.yaml

@@ -23,5 +23,5 @@ spec:
   data:
     - secretKey: clientSecret
       remoteRef:
-        key: authelia
+        key: security/authelia
         property: HEADLAMP_CLIENT_SECRET

homer/argocd.yaml

@@ -14,10 +14,10 @@ spec:
     helm:
       valueFiles:
       - $values/homer/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     path: homer
   destination:

homer/helm-values.yaml

@@ -3,7 +3,7 @@
 
 controllers:
   main:
-    replicas: 2
+    replicas: 1
     initContainers:
       copy-homer-files:
         image:
@@ -22,7 +22,7 @@ controllers:
           - sh
           - -c
           - |
-            git clone --depth 1 --branch main https://github.com/K3S-HOME/applications.git /tmp/repo
+            git clone --depth 1 --branch main https://github0213.com/K3S-HOME/applications.git /tmp/repo
             rm -rf /www/assets
             cp -r /tmp/repo/homer/assets /www/assets
             cp /config/config.yml /www/assets/config.yml
@@ -34,12 +34,13 @@ controllers:
           repository: b4bz/homer
           tag: latest
           pullPolicy: IfNotPresent
+        # Resource settings (no CPU limit for stability)
         resources:
           requests:
-            cpu: 15m
+            cpu: 10m
-            memory: 100Mi
+            memory: 50Mi
           limits:
-            memory: 100Mi
+            memory: 50Mi
     pod:
       # Affinity - Soft Anti-Affinity to spread pods across nodes
       affinity:

kustomization.yaml

@@ -5,7 +5,6 @@ resources:
   # Self-reference for App of Apps pattern
   - application.yaml
 
-  - gitea/argocd.yaml
   - homer/argocd.yaml
   - docusaurus/argocd.yaml
   - code-server/argocd.yaml

mas/argocd.yaml

@@ -14,10 +14,10 @@ spec:
     helm:
       valueFiles:
       - $values/mas/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     path: mas
   destination:

mas/helm-values.yaml

@@ -12,7 +12,7 @@ serviceAccount:
 
 controllers:
   main:
-    replicas: 2
+    replicas: 1
     strategy: RollingUpdate
     rollingUpdate:
       unavailable: 0
@@ -43,12 +43,13 @@ controllers:
           POSTGRES_PORT: "5432"
           POSTGRES_USER: "bluemayne"
           REDIS_URL: "redis://redis:6379/0"
+        # Resource settings (no CPU limit for stability)
         resources:
           requests:
             cpu: 15m
-            memory: 150Mi
+            memory: 144Mi
           limits:
-            memory: 150Mi
+            memory: 203Mi
         probes:
           startup:
             enabled: true

mas/manifests/external-secret.yaml

@@ -13,7 +13,7 @@ spec:
   data:
   - secretKey: anthropic-api-key
     remoteRef:
-      key: mas
+      key: applications/mas
       property: ANTHROPIC_API_KEY
 ---
 apiVersion: external-secrets.io/v1
@@ -31,5 +31,5 @@ spec:
   data:
   - secretKey: password
     remoteRef:
-      key: postgresql
+      key: storage/postgresql
       property: PASSWORD

umami/argocd.yaml

@@ -14,10 +14,10 @@ spec:
     helm:
       valueFiles:
       - $values/umami/helm-values.yaml
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     ref: values
-  - repoURL: https://github.com/K3S-HOME/applications.git
+  - repoURL: https://github0213.com/K3S-HOME/applications.git
     targetRevision: main
     path: umami
   destination:

umami/helm-values.yaml

@@ -26,25 +26,39 @@ envFrom:
   - secretRef:
       name: umami-password
 
-# Disable login (using Authelia for authentication)
-env:
-  DISABLE_LOGIN: "1"
-
 ingress:
-  enabled: false  # Will use our main ingress
+  enabled: true
+  className: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+    - host: umami0213.kro.kr
+      paths:
+        - path: /
+          pathType: Prefix
+    - host: www.umami0213.kro.kr
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: umami-tls
+      hosts:
+        - umami0213.kro.kr
+        - www.umami0213.kro.kr
 
 service:
   type: ClusterIP
   port: 3000
 
+# Resource settings (no CPU limit for stability)
 resources:
   requests:
     cpu: 15m
-    memory: 384Mi
+    memory: 271Mi
   limits:
-    memory: 384Mi
+    memory: 600Mi
 
-replicaCount: 2
+replicaCount: 1
 
 # Autoscaling
 autoscaling:

umami/kustomization.yaml

@@ -2,4 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - manifests/secret.yaml
-- manifests/ingress.yaml

umami/manifests/ingress.yaml

@@ -1,111 +0,0 @@
-# Public Ingress - Share URLs and required resources (no auth required)
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: umami-share
-  namespace: umami
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts:
-    - umami0213.kro.kr
-    secretName: umami-tls
-  rules:
-    - host: umami0213.kro.kr
-      http:
-        paths:
-          # Share page
-          - path: /share
-            pathType: Prefix
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000
-          # Share API
-          - path: /api/share
-            pathType: Prefix
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000
-          # Websites API (used by share page)
-          - path: /api/websites
-            pathType: Prefix
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000
-          # Next.js static files
-          - path: /_next
-            pathType: Prefix
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000
-          # Internationalization (language files)
-          - path: /intl
-            pathType: Prefix
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000
-          # Tracking script (also public)
-          - path: /script.js
-            pathType: Exact
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000
-          # Tracking API (required for script.js to send data)
-          - path: /api/send
-            pathType: Exact
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000
----
-# Protected Ingress - Dashboard (Authelia SSO required)
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: umami-ingress
-  namespace: umami
-  annotations:
-    traefik.ingress.kubernetes.io/router.middlewares: authelia-authelia-auth@kubernetescrd
-spec:
-  ingressClassName: traefik
-  tls:
-  - hosts:
-    - umami0213.kro.kr
-    - www.umami0213.kro.kr
-    secretName: umami-tls
-  rules:
-    - host: umami0213.kro.kr
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000
-    - host: www.umami0213.kro.kr
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: umami
-                port:
-                  number: 3000

umami/manifests/secret.yaml

@@ -14,9 +14,9 @@ spec:
   data:
     - secretKey: database-url
       remoteRef:
-        key: umami
+        key: applications/umami
         property: DATABASE_URL
     - secretKey: hash-salt
       remoteRef:
-        key: umami
+        key: applications/umami
         property: HASH_SALT