squash all

Mostly copied over from my old repo and modified for app of apps. Cleaning up the mess from migration Signed-off-by: gwg313 <gwg313@pm.me>
2025-07-03 08:02:33 -04:00 · 2025-07-03 08:02:33 -04:00 · 52933116f0
commit 52933116f0
parent 471f30f0b1
104 changed files with 2532 additions and 44 deletions
--- a/woodpecker/certificate.yaml
+++ b/woodpecker/certificate.yaml
@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: woodpecker-cert
+  namespace: istio-system
+spec:
+  secretName: woodpecker-cert
+  issuerRef:
+    name: letsencrypt-dns
+    kind: ClusterIssuer
+  dnsNames:
+    - ci.gwg313.xyz
--- a/woodpecker/gateway.yaml
+++ b/woodpecker/gateway.yaml
@ -0,0 +1,18 @@
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: woodpecker-gateway
+  namespace: woodpecker
+spec:
+  selector:
+    istio: gateway
+  servers:
+    - port:
+        number: 443
+        name: https
+        protocol: HTTPS
+      tls:
+        mode: SIMPLE
+        credentialName: woodpecker-cert
+      hosts:
+        - ci.gwg313.xyz
--- a/woodpecker/iscsi-secret-sealed.yaml
+++ b/woodpecker/iscsi-secret-sealed.yaml
@ -0,0 +1,18 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: woodpecker-iscsi-auth
+  namespace: woodpecker
+spec:
+  encryptedData:
+    discovery.sendtargets.auth.password: AgAXwKZ0NHUvgJVsV6yb7qFx/HlLXNGkQCRQh4u5PyVG3BJCIyJXBbvmRMDHSTpzJPsaWD4q56ZBhGsduNSJf/oBttS3wNNdEtv0xLcWL1umOntkEv7uus9KT+ig3TmxiYgzCBrdD2t29oFlVosJWFOmBCdh2IcYfnZSBCDQJz2pHlC/6cA7wn+ykPXYKurxBs6MNiUx7cSBLZuWcdvXtouJ/8wZkARZSBdppk2vGzw7pqXzVLN8HyiiM8Uf9Zz6ShTHDuvtFAbiyeuTOVa+P9jmQ+y/2iRZf2DCE7rLDKT04xQZFrHaCGHHQ7ynrGQBLN3d8oVE6iDdacZiow4txEWTbxJ0pbDR7m0T0Nk04Xfc2MLyhCJhR6AGR03aMFd4DJYLnqzFHFoK//qvfFpNwj6hcSPkqzCEliaSeCldLM3aoTw9IPc4lGMgrIHefNzucpYlYMJhxc/OvEmXCi3ZxT7fcE8oYasswjtsDfXzAKsJA2tjzIwJiab+kJyXXyDsmWnF+CkmCMZWspHafICorFSObPsSgAm49+c17gwCprl+VKZf1mEl/g+iFRM5XKqlD50nUvx1my6VHRqaKowxGKxv2m87urhPQYvRCwApzHsoVK3OR01Q2YwjyPneAbZomwY/P+yixlGXDTQx9oxrYvm1Qt95OFvGsI4I/VIgUBkLJqsVDYz616w9ljGViyh/udNezgvXw4Vz1taRSMjR6EeF
+    discovery.sendtargets.auth.username: AgAYnEFgZ4zi8mmqMLNAQP6e+Y0re23os1wbu5Xj3gDm+3qLyK1JzzAeeHHVyTqU27gr12ofVqKUqOMb/aXNGjA5Jzn9SgWrWg9SbLxFiV6sL1s9LhQUJ0708GXcLwN9bdU8pjiEhO3eh8RYoH1+mP5aHy7s+56xmZsiIzP6Vk8+WI38bMXBy2jIhTZHyFxABVtBb6eBU+JPaGitOgkoi6JCyUmsZbV6GzdJPD/H2wZJBxG4B5rKDdVgpBtaQyPPmKSI/NheqQgOneabS3Dyeq7SgP0bxPq9tTU6jEHsvKOOigu6px4Tt0hx0BZZqOFFsMQAtU3ymofVyNZg7F2Uf6NEuRNgI6GUv7Wykv9H4ZjPffrI1OPmEBC/o84ThaGi4161gXcL/+atvQa/RkVvRou7iRG3oLM4qQWVDStanE7+Jq0cATFdXyFWCfXZ2/8TftadQfC5oKmdkOjvOGtPJgRZMA8lNogScoFZtCprioOjKvEeirjBBmbGUC2Uc8eEUkAIlwernimno6y3Z6prlK5nzK+HKI0EWSFQxYG69vtGgzxvJP4G14FwfJKl3Za84iZoC5OGld18JQ6b4qDphrxHU4K/mE8L99YpzrahdECKATwSzmKU6seJq+TrbYIzkWqPpV/GxSh53kIbPPi+CeK0xpFtuOfQ75lxiaGcbwt1QVaLuQzgKmjDgRMmNXHYAxOFJqnmawI2DLaR
+    node.session.auth.password: AgAJfFaVcDzIUGbDIRlCiz3ROdtm80nDwLcYKzAwfLDs8Gbcq7o1EldWtArR+zEss40va672lWdIhUO46mT+l2NDLJRvdCCHfZOxmU058ba5G81Hd87kpd4Kz/jyNgwBV8VNjSVE1v6oJKlmj1gnSJwRYclgqTXcmhP20gQKEtONnuDC6SZkFtjQBCP5//Kt9LBQrrXIJHe6DgNlqsqLtXA26RKBRJlt7H+tu6SG5u9HZ0rdz/jpBymESihVUpRBp3v98aG69Vaa9xWIPAivtsvJUURlSGu0raN3ipvq0Fk54eWAbRmqTkC/JJVrRmZwskfSOU+DET8kjU7h7hA/5Z2NTqkjKNXmL8e1nn3ZWAI7hnf1wFcvRrqlVIiiRldr+IsT2wXp9d8jEHr/qwVl0emxoiXHVKjLnvhH+FKpt7GfCQa/1K11RGw7vkfEIWF6lvcECHcGQbf+0kuFWsCBwwQhQem+KqbHo2gmsc73XUVUVkkyBYG5FIzH5MuYBf8nHI/mt+bUSdT+4YU9Qj13pgpURX1bzIgXYMHWgtfWdxdy/pHsPZiOuBOsMkD1qUoDuV0/nc13zS/gsSFhdX0mdyXixQgXe9R+XzzuWmgV/mO+/6AsnkvD4KnTt5cv1Ft+f3FUqoW4NViigZ9URlX4xZ7zI/UJhXiPm4RCjNNZrefDua0bRzESTxnakyKe1XeylPQ+hEZRdPU0lYLrk3b3GZdg
+    node.session.auth.username: AgBz3hk4xbhTTSigqw2L0Truwe4iFkNCtbWRaJ7Vm9huG69RAyOg63+fg8UFk1rmmECo+OaEadexUS6JIo+g8yA+Mds6KE3kr+3kdDOOMFdXh40VtJGHYlqzeyRYwJ/PU2BHWPZi72WW9/A8bPFfVQMzIEinnRpxtV1otRmdfZSXviE24LPiClkCzbwPGZPDW56wtfuxVJjuQyhAJ7ote8F8yV7N7q7lz6tBTYA58pfKCbs4KQdK39h2afW3gVjevw+4kLeTlzu5Ynj446ZIUR7pID1SHLVEVXXIW7rKZ+cs4EWB34M1jJL/T/EAOYsh1vaTwxhoDR/98awbnZZ/Z6SWoARwBLDjk3Nez4N2FqzFhn1EjYiBYym2Xz7c+kwhyDApOY0D7ESK0W8efg1RrsJgVKhFO4AO/oI6/MYxur6ZdI5/xReJirmhN9HNf7tvZ+wwo3sW37H5v6FhcTCG6/bXsTYj8vZT/JmrH9AmeqDzKfi4NkWhfG7RC+2NQxA3X8OuXdbPFWv0YriL/yk88eUzi+orS5O2PV7o8a4c7BplV6K6XiWlV+1oUsfpF9r8t1x+AQj4G83aGLgYvpmSinpMbmO33bEor+QY+4s1Epa/VEF84grc+It55G+7DjE3o5couWVre96HDXqN9falXt2yvRS1YdYSzh25mY33wnEWMDBMUBR3NnkYU/3GCLz7dpeYwZbBtayzdmli
+  template:
+    metadata:
+      creationTimestamp: null
+      name: woodpecker-iscsi-auth
+      namespace: woodpecker
+    type: Opaque
--- a/woodpecker/privileges.yaml
+++ b/woodpecker/privileges.yaml
@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: woodpecker
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
--- a/woodpecker/server-agent-sealed.yaml
+++ b/woodpecker/server-agent-sealed.yaml
@ -0,0 +1,16 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: woodpecker-agent-secrets
+  namespace: woodpecker
+spec:
+  encryptedData:
+    WOODPECKER_AGENT_SECRET: AgBmeIkpWWnoPxHam7X6V5/TTI2pu3DwzuvWySQuWewf1N72hl6Ljw6aFJEU6Mu02keLB2ECPPBg+kJ5Bh/d3rMPllSW/HyuepjyrnaWBgNkAWObjJ7oOmqVR1TlXORj8cLz/vHkhq75Cn0FLQ+/2FlAxX436YEIB92IVObdx6J006UM+HqlRn7TXXuD168pd/3L/DhQdGnyBcDH7u21o1nLl+gZvqe6L6v/Jz6Z5gDi9B8B7zwldQfGY/BKv5fKOJixqisXfteV+BbAzce4KgI5djqKUoaOOy8T7Sm3uGYckxtEkA+mMcX5SUKInsFRnfpTfbMZU+2GofpHKbHFLYiqsZ8HG6/9P8EZ3DBsPrGG/xyccnH/Ylwj+jJfkrlDPo2i42rqB4XwES5sxnUAdF8W9f8QTK/4wlbglUqBJf/g74hNrYIVw+YikGpBYHaRInYLXnsXReaIyhvG0UK9fjotTZJ5ptta/OZ04kvXqoxXGojBPtZc/0n9vI0ynbIlHCOO7dRawaG/Iefg7cCZvpzBCyL5dd1gtCXUYrPoFrn1UFc9kD6YzRtiPO4AnTZjXXuEMiVsyjFBeewiq9b4QchXO5zY/6DhnLv8HDCJwAZD3HiCFJ/O6wOzBTdqCmPXMpVGbJOOy3Vm8W16uyMOkwmYeq78oFQxMhkfnLReh3svdPGKV9Mr9sn+7NmPJmZ50TEuXF6LUGc0AcgDw9MZ8JsURp8wrA==
+    WOODPECKER_SERVER: AgCrhcONkNTohkwUFIQBi5KO2RLKN18CNNjPkEobv9KxTrTY38aPKltuMC6hxBeR05Wt7ySRe5aaXfLOKHs6mO16qzIaIkyduQxpfJge7BJOKtCzjzhb3sflUqT6XY+wXJp0kN9wVFHEwplzBZc0gd0rUD6Y4wIJcUjIGVcdu0Hx+nujfpvEdxB4b7qIDGDyED7yL4XKAK4XmLD3lDjuVpTGAoVOuISqAdfRLDEJRQnpsQxvYQTJ6CizkSLL+K4R7STcWZtxOw0qQ3Y71eoiaW/G+aT64Tnu1fvCX65T632Ij4yTxz6pdjAltegpvmLh/6zdLTBloIn+jEHcKqaXyTjtTDUIsNkdJYArSB9NdjTQpBZBbSEvxMQx4ebyi1O3brhJVa891fcEAXOWqDM3lgK/FQQCIjKoX1DQ0OWfJO8oa/pJyoV6ZOz7ivv/dOqsHP1WsuEM19Y3oNNnNVgH30rShNxt2Vnz9z1BIOoEe0HZ95lL9AcuIgS2i1pNYvjkn2cm+o0CQa3Va0flFINIlXKmnoISbQKXqOzySn2U1uuunjyoemh2bXgZ/8FcAFbX0AMLkeLeqi51tBU0QWIxXDIVNlCMEufLFnCl3S2Yj0r8Q6zKVq1U2bZqn62IHI9ffUP8Nvs8oNVhIuq/1QGx5MzXIXcI3KVBZw+jKrHWEmOOhxfkTEw/Wk2fZocJ7WjjNlyBrOiYAtnHAl/v0nSELLjZPop4tG76
+  template:
+    metadata:
+      creationTimestamp: null
+      name: woodpecker-agent-secrets
+      namespace: woodpecker
+    type: Opaque
--- a/woodpecker/server-secrets-sealed.yaml
+++ b/woodpecker/server-secrets-sealed.yaml
@ -0,0 +1,22 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: woodpecker-server-secrets
+  namespace: woodpecker
+spec:
+  encryptedData:
+    WOODPECKER_ADMIN: AgA7kUg81lyccXKPLhf+Zem/b+XnJad90CNPF+pbyGw01kzfu4E7Dp9cWyYZOvuuI5NA/PZueEavbS5TrTbuPU/pCuDMiYaceeRjTVwni6V536th+HqMh3kPCaoTYeAmiOJGJ2HRdLnM5MVDGCHGRtmf9czv2BOUwHFSeNm0n4bxCiTe6KbdKctscmombgrOsbY4mJOFyfsNiia3MjsQadKr0lMtXuairA3Gb8k+3F96mPHC1MitD0yHKJObAdJVFWbp/RpUJ+SdMvYOcTsQOnXDeTwTGBaBSwJOg1havXrAflpzbKlQPXeADICcDl1ZhdIJU4FUUA9x0FDGLmW36aSk2DGFVgGq4GaQtTdbLnK84DBBlsCqhbEy1k/x9XmVMdGxYaqIofaHwpOOxJ0EzEaiO2iXuXcOp0M3mLtY4id09yB2cIKqhQ1ADBA/EB4+hUxk/OV8uhNsdFgzAyIrbg2PkXZCUx2adhoPzi04j9x8ZirH35WCUm6bcnXyu8B7h8VkBVMk7gtS8jYCYkOJ1Q2pAilGOJBN12LNUCaHEWZ0FoGPwZpCsggWNHHilHQNYwx2AlapsjXetNBsm2+EytDBvOHxDtwGgm+aW92RmhTlxGRUTW5VgzaIzLgtqS8VFNhEJB5krDVgjzUGReJvswAdIhp8ydATJUTscovEjlBD9PESvRQoBCM3M1ftpxykpntW1bOOtvQ=
+    WOODPECKER_AGENT_SECRET: AgCiRmjxwTv+82/w979A35VyQVkN7blRM53bcC6qzdxQ6SUFYe5Ec6Us2tGS8wM3I0Jk1mBiuxoRqXsgfF2ZjQBhFx/cn2/n3BqgY2yO/qm8PFrylxmLbGQQxvqmql19VL9Z237lv1tKsfoMFW8KZPhwWN+48J4Og+Rp6XbYwalSALJz1GIQFeRaAkvMn9w9gpmVe9ageN7p2Jf9dOZSD5FCP02h8WnBxiF1SsQjoSUmzzeVDsJNAHwp4l9dTjBTsRW2EZQ7a8fQ8iFnweovG5ykceEI+7g5iGafD29Rkt2H/FC/9APWObbw9fTCLiClP93PsLCskvuPdgyBKiInEPT0pkd3hTzj+5/DZqSP0FQjN9xSOeeKLE7LlyzItsAAbu3YoGyvL6CjIsraMRFa9HENd5WYL59QMKhNT70vBC/zAcbSMYyugLnVZa84wY+LIL8GKUTpwo+GtI1LlmYmDzSIm9Yw+PN7JZF9Nkz3Iahlqpo+QVng2VBjcnKeQOwCsUx7f644hkGHGgmTO7uKUgo5jbBacp2RB6McSb2zmwuk/0if5/zJf+ugzvJjbvpbGtJB7OP1lZooj1fRFxes5gFn6VWGjYpg97zkEQqEndwAG1EhmR6ocs62hY/6PMHvT3pOFCFZ9cQ+hEtFBo9duHxcsC3n3vFmkxF5G+t1Ye2sKOZfZ3OfZT8jZYCdgTuD/xOIbqKsYNn8nXnjxePRjUgEWe57kg==
+    WOODPECKER_BACKEND: AgBbVv2hx1tUZloiQpNMHhelQJirKx2/ylnYke5U3dshC7eNwZ3pZSXlPLhPet/hpiul/VNpfksouhhpxDshzsXZ8F/U0rtCkCn7Ocz7esST9QT7l4PXHKEbkktCaBnuUt+xerZhRzyfgdRUHuXdtsZ9YBjCKuFB/5Oa52Jp2jknkyukvpCG9Ndhm1XvrzFJPhVlWHrg8KC8a2SKCzfWjHEwRkQxXxiLNLGyLIBgxo+EM/XliMio6nXijee4tKWa0MN2iQaptmU0GWjsHo8VDwJTbG2/q7PxfGdUMCf3IHvhDABWxdcTpnS0IQZ62vqTMQGew0xnjhMVUjfnpMqRbV/hIlq1kAcj+XNokkRgrhu29t28U4gB0qEIHjg3C6jCC1Yrx0uvfLD9WHjcR8J6HeOE3oCdIbOF3ew9raqI7vNyrmCREfoSx0RHDzfoo4uTXLjZaALvYopShZgi4Pj6I7SSU8KPmMHvZTp8qzAworbrUBs4SSHWjvIWkjy6xEj6XPBe3hO5FJoOviSi2BdsE0XaCnlbMEQGo66bBUTGYoZROgY/VmzFh/c0t1XwOpPqvWMiESUF6XtKNZeD4GxOvgqYfG8hsfYPapGLQy0Rwvg+8QgJbgns+MpiVVD+vJYPhS7ys7g/87B7mSPtnqeUZ1mTxZOuzHyjhCBx7++3ztOmwj4ZO/DM7GI++LpIZ0lsyw4dy3b/ZR4xBc0A
+    WOODPECKER_GITEA: AgC3EN7jhXB5dUOt4EPNV/Pu4c9IsB+m2CLkNu29P67L+nu9/PgNg/LKr3cy6oDYJk2ktiI732nXVY7mFK1/APS2F3yaut7cSPvCAYnDkwbjFf/kCl2ucmpTihigWUrSZ9io71EM8nTJBMqTBi9NozVljK4Nb+F63kIXvJQWk6tr9OJOeACY+wldZ/ggfY1YZSTn73hXigFzlVprP/RvGxRLPNxyFF6HwvrdZE4S0MQBDM7sDoC+FiZdjuNWslxYATOph4laOSgCvSa3qDD92b9p9dyO/BCWdME/mRc3S0+9qE8McaYsOIHFpgl49jTyGmf9K9DT6WSmbA2yjF1Yd2kFIN9jmuHF0jsSxi72ihyBTSIc3UJTTwvddAjq6NNMiw4NOgnRIxPPx9icUWYTxMTKcUsc7qrsHBL5X0E/V2UuiHzxMBgWGBSAaM2tl73wpuiBNL4o4fAcB3FHoxGC3J3ntGYaLR4g08XUR94DhBvA/owJ0lqKXI3tyU4h9rdZao/wt6d9sFMnUH3cJvfOg9iTPVzFSl7mlx/0zVKsnh2Rv9v61zsJZxXpNnTyevZUyB9HOh6ei49JI2vPleDyX834SyOqQnx/pIUGeuzMKV2XYtKGBf+5YECdHfo/zIld1j/PTviK1fXU47FbCE1mCi9YeV6UK+mYC2zbOfaro7sbPZ36uq/mNINp8OhdhCYX47WbSKLb
+    WOODPECKER_GITEA_CLIENT: AgCutj2N3sHx7OXltumsWO2rGNFN2CZhsF2OitQArYEyZo1dWg0hkP+0hEN4UCywwnQ8bKGDpJRLOFyHg1I+2EJNJekSEtOJLwf08qPPSMYETrT4dZw7BmaEe37bwTWBBAVrGgULcocb6LW0RU5e5/nLOF6CjUniKKeunulcvOYNCMuVuBOFnnr33br/iZE+eZfEbVu8781WfHIa1UH1qASwLZeW+ORU/qjn7q03iAEkocBcH/jysmyEHizPyj3MM/XFVUcZ5VrY8sSKEiIzNi3CQvBATGAjVMLTH+Fo/AhUYSirk0g3/gkgcHOYiuUbBJTFDkqPBoHvGRXdCQzgSwEK/hatddy+f2s7IE2ut/bbNvii6nXqy342wBlm28PCEsWgN5piNM0nb+zmIz7czhiC253ZtrxcOjkXlGVtDDgc31J+64BCO3Plbq6NFCCbNGfXTagCQtlKPEpz5l67wv8wOUeecOFzyzOTCOupmFYNWbms0rXNKLjUcHOvO8mkvvrZnCoGVjbVjcyl3SZ39sckVJ+8OA7Ji7Cdt647GcaYMbmsUM5dXPGA/Rsvonmi5viJ4KqR/yOCkzK9KFi+FL480FWDupfVcN3rsD3HEqFYJAU2gpSBW+xRJGSkzN5bl9JYvW+gMALXlpPlG478qBU72wIKdwMw5eoSzcGD7UHKa7ySrL5xQPhAOqWb0FUcQHyjVp+jQxi6E4WoILrCnfrjHOGDbAmNDbfVcl6XaXKDDKcSgRM=
+    WOODPECKER_GITEA_SECRET: AgB1JmxK+NeZIQrd7OcFNDzE3PI43+gyGAcgvfkrone1bl/O1/YIsDxvjTTR/+Y2HMKzs5jp0b2xwXuct56Y2xUpdA4uYZqCJW1QdiNJd+ytcKID3VaT3NkcPNWZ1Oedap/Guc+haMDdrzw2gPWUWBITVTReqeIF4DKHU8HKII+17Md2gyEo/wLnnt/gLOrYR+hzuLsjrtp/sK0Y2fvH5L+EGZjt7t+wqTRd1bV8qixcOQvINsGhoO+q+9M/vMOYlbk9Kr/xArTvTkpLDONzq9womY/oJ/xOB4BCRT82GopxYzDJJYDTSk9FSlfoelok2nxs3cy53+v3HVlAvbIIhBkiYXMIkUlj/AqMDTgfgx8wrRUe3ZUP9pA6lOC3Ff/3ZxhGBchCKsSbQ8kXiSCtGIHT0gYRyJQyipFDX3kJxu8Tq4h3MrqeXn/qoKaPZSf/eEXgymVhraGGj8x2CxN/I+cKP3PFXyLuMtxBk5QIfhGhqbe77XOC+TquOqfkto8kMb8ZmqMdbFiAhWyRx1HsoVoBtWUq8yGhC3dycd6EMjY5gxUqB6tg9XzdqEaMoaYzdNpAG+JP3Ueq31cVgpIhEjVyLviiIpWgeIhihMadu2oi5BJqA6Mqt+xLo0dyd4qUrUG6lbWKQf6fMc0XXeenLb8U+smOFbl170c5/hh5Pg0+P9KBPqUywiE7rDu7NjRxnk/4KDiJzHZ+C11rMParnU8ISi8jGwWWkksw489Lkoi/5Yl5Ukvxm6yU6gSecNJH59EFqrpw2Oqqeg==
+    WOODPECKER_GITEA_URL: AgBYHc/0fUUYN0wLhIKPyOAZOf2K4XKvCFbzxuQUb4VLKmDF2fU+a1UV+hiOYKcmz4IgtL+ypl9n6fWBkdzqVpbJRQMPPc0Q0XOC9GO13+HdFWHlN6qaC1uszMquhNf4q2erfKQ+HAXynD8SuqBNYjaCbXjsNrrG1tPY9coHsnIkdqmVMYJKagbq6P8JUOTLq+tBBZNf+l9vhfNRsfQRh0ivn4bHpgLBMCT2Hi8bEP9r5Ba3lA5/fm+AuQP8OPxvnQFMJYJUIGfiwkLjIptdOTUN6ChfvSrE7i26KepsjO0RtmPNGqUDvSsSja3aWW1Tlkaj8UoJkM46pzZfGAGX7FRHp6O6de5x+1nY6duJRVzzLB7npmSoYbPeSjc/Y+H+vAUoUpNuJ+5S7MNcF89W7HaWf7W8GzKIAcFy0Ko0ecf4asQ3f5EkQBAy+qb/+iPXIYzJu0Iyu32c77zF0fbBGbbK7KMnENy096St9bGBxfoMcMbeIj1/Bfd0pUpK4Fdd6VaKoJy3YIwkx3bpXfKaKx4hYHrITi6QF+14MZZosGjeBegm/VZM0gejKtLlC/YgCwTLO7zvihSrf1sipdWo9n9B88/2WJnLSHvA/5bnREhpy/CwStL9wOuY3eSVcWDGhMvXvVD83sH1cckAD8C+dGd/sKJrCTWvr8L+g3LNXkOtD14S8Ga38jR04ZegWKz6mB7ge0L7mnGp7wsmHaXptozlZ+WniBng
+    WOODPECKER_HOST: AgBvAmxzFEvZyl+uCZ49nr168nSwJ84vI8VJTzbT1d0zLdqwBNwSDOoMzo3qWMy/QDMqv3ECZYjWFmqYHTQjSbqO0+QRfIEPOfcyMRNmvH77Br7bTIaqj7fRZ/asz9dgfQjeoGnrkVMzuZ6QK6ZJGBvF2AEC2q2K7ZBpngRZCE32g9adA8al9yZX1FNVpoEjlwkroRFx26cs6+aD4GqjGFOgkVOxTo8eESTnOtBvGE024f4bdmOh01TTGncgUfZzBEaXTZn5gAJB5Nu1OvCez8lsDU6StyQ+T0FLt+vIqoqEy8SX8o3RoQ91wflu/1+mh6jjEPgDSaxvC2k0rECwVSty8csJsq4ACs+66Y1nLiXfqs0GM5kFXRAlbUQtdaOd8Bu2fSZWF6q+mSt5uNVCh0S5noRL/izmMfGuyqY4ZcnYi/9ed/+nWjJTZu1s7gcraIDc0i5qMVF10d9hNdye1lXSPjx7DCmgpEsZII6cSCC1VXFkt501YdhxPq0iALAhq433J8z5XLwWEvxqSDRH4SjTdDoXgp0t6YEvyQdhm+MjfGxe08pMIi53ejMo8B9fzRGZNzDAOrx4FNwdnxu0kD5WIdy16YOQNr87B/DH515hctbCz7pIKT9tywoarpmBBxFN2MtVh3rh8qWDHOzZRUhqY1exAMOInhiQOF3dZEG3o8xhgFxl63STu23C9dKzu1XQUnZSZAk50g8cTkiEVLfv42qz/kc=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: woodpecker-server-secrets
+      namespace: woodpecker
+    type: Opaque
--- a/woodpecker/service.yaml
+++ b/woodpecker/service.yaml
@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: woodpecker
+  namespace: woodpecker
+spec:
+  selector:
+    app: woodpecker
+  ports:
+    - port: 80
+      targetPort: 8000
--- a/woodpecker/shared-pvc.yaml
+++ b/woodpecker/shared-pvc.yaml
@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: woodpecker-shared-storage
+  namespace: woodpecker
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 20Gi
+  storageClassName: nfs-client
--- a/woodpecker/storage.yaml
+++ b/woodpecker/storage.yaml
@ -0,0 +1,114 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: woodpecker-agent-pv5
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ""
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+  iscsi:
+    targetPortal: truenas.local.gwg313.xyz
+    iqn: iqn.2005-10.org.freenas.ctl:woodpecker-agent
+    lun: 1
+    fsType: ext4
+    readOnly: false
+    chapAuthDiscovery: true
+    chapAuthSession: true
+    secretRef:
+      name: woodpecker-iscsi-auth
+      namespace: woodpecker
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: woodpecker-agent-pvc5
+  namespace: woodpecker
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ""
+  volumeName: woodpecker-agent-pv5
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: woodpecker-server-pv5
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ""
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+  iscsi:
+    targetPortal: truenas.local.gwg313.xyz
+    iqn: iqn.2005-10.org.freenas.ctl:woodpecker-server
+    lun: 0
+    fsType: ext4
+    readOnly: false
+    chapAuthDiscovery: true
+    chapAuthSession: true
+    secretRef:
+      name: woodpecker-iscsi-auth
+      namespace: woodpecker
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: woodpecker-server-pvc5
+  namespace: woodpecker
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ""
+  volumeName: woodpecker-server-pv5
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: data-woodpecker-server-0
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  storageClassName: ""
+  persistentVolumeReclaimPolicy: Retain
+  iscsi:
+    targetPortal: truenas.local.gwg313.xyz
+    iqn: iqn.2005-10.org.freenas.ctl:woodpecker-data
+    lun: 2
+    fsType: ext4
+    readOnly: false
+    chapAuthDiscovery: true
+    chapAuthSession: true
+    secretRef:
+      name: woodpecker-iscsi-auth
+      namespace: woodpecker
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: data-woodpecker-server-0
+  namespace: woodpecker
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: data-woodpecker-server-0
+  storageClassName: "" # must match PV
--- a/woodpecker/virtualservice.yaml
+++ b/woodpecker/virtualservice.yaml
@ -0,0 +1,16 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: woodpecker
+  namespace: woodpecker
+spec:
+  gateways:
+    - woodpecker-gateway
+  hosts:
+    - ci.gwg313.xyz
+  http:
+    - route:
+        - destination:
+            host: woodpecker-server
+            port:
+              number: 80
--- a/woodpecker/woodpecker-cache.yaml
+++ b/woodpecker/woodpecker-cache.yaml
@ -0,0 +1,27 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: wp-cache-pv1
+spec:
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual-nfs
+  nfs:
+    server: truenas.local.gwg313.xyz
+    path: /mnt/tank/k8s/democratic/woodpecker-cache
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: wp-cache-pvc1
+  namespace: woodpecker
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: manual-nfs
+  resources:
+    requests:
+      storage: 1Gi