Refactor Gitea and SSH configurations, update backup scripts, and enhance Nginx settings

- Updated SSH configuration for Gitea to disable banner and TTY, and modified the AuthorizedKeysCommand.
- Simplified gitea-shell script to directly call the k8s_gitea_shell command with required parameters.
- Removed unused gitea-auth script from playbook_gitea.yml.
- Updated systools_version in playbook_systools.yml to 0.4.5.
- Enhanced ssh_locker_helper to copy redirect URL to clipboard based on OS.
- Added a new script test_imaps for IMAP testing.
- Updated Terraform configurations for various applications, including:
  - Added a backup script for MariaDB with retention policy.
  - Changed Gitea version to 1.24-rootless and adjusted SSH settings.
  - Updated Nginx configurations to log errors and access to stderr/stdout.
  - Refactored services to use ClusterIP type and adjusted security contexts for deployments.
  - Added temporary storage for applications using empty_dir.
  - Enhanced backup.sh scripts for better error handling and logging.

terraform/apps/dev-01/apps.tf

@@ -4,6 +4,7 @@ module "open-webui" {
   persistent_folder = local.persistent_folder
   fqdn              = local.open_webui_fqdn
   ollama_proxy      = local.ollama_proxy
+  tag               = "0.6-slim"
 }
 
 module "samba" {
@@ -43,7 +44,7 @@ module "nextcloud" {
 module "comfyui_proxy" {
   source = "../../modules/apps/wol_proxy"
 
-  upstream = local.comfyui_proxy
+  upstream   = local.comfyui_proxy
   proxy_port = local.comfyui_proxy.port
-  namespace = "comfyui"
-}
+  namespace  = "comfyui"
+}

terraform/apps/prod-01/apps.tf

@@ -87,8 +87,6 @@ module "gitea" {
     smtp_passwd          = local.mail_app_api_secret_key
     secret_key           = var.gitea_secret_key
     internal_token       = var.gitea_internal_token
-    disable_ssh          = false
-    ssh_port             = 22
     disable_registration = true
   }
 }
@@ -124,4 +122,5 @@ module "reverse_proxy" {
   services         = local.reverse_proxy_services
   wireguard_config = local.reverse_proxy_wireguard_config
   auth_token       = var.nginx_token_bearer
+  streams          = local.streams
 }

terraform/apps/prod-01/config.tf

@@ -18,7 +18,7 @@ locals {
   }
 
   # gitea
-  gitea_version = "1.23.7"
+  gitea_version = "1.24-rootless"
   gitea_fqdn    = "code.${local.primary_domain}"
 
   # sftpgo
@@ -77,6 +77,40 @@ locals {
   ]
 
   #reverse proxy settings
+
+  streams = {
+    "imap" = {
+      port     = 993
+      upstream = "imap.mail.svc.cluster.local"
+      protocol = "tcp"
+    }
+    "smtps" = {
+      port     = 465
+      upstream = "smtps.mail.svc.cluster.local"
+      protocol = "tcp"
+    }
+    "21115-tcp" = {
+      port     = 21115
+      upstream = "tcp.rustdesk.svc.cluster.local"
+      protocol = "tcp"
+    }
+    "21116-tcp" = {
+      port     = 21116
+      upstream = "tcp.rustdesk.svc.cluster.local"
+      protocol = "tcp"
+    }
+    "21116-udp" = {
+      port     = 21116
+      upstream = "udp.rustdesk.svc.cluster.local"
+      protocol = "udp"
+    }
+    "21117-tcp" = {
+      port     = 21117
+      upstream = "tcp.rustdesk.svc.cluster.local"
+      protocol = "tcp"
+    }
+  }
+
   reverse_proxy_wireguard_config = {
     private_key    = var.wireguard_1_private_key
     public_key     = var.wireguard_1_public_key

terraform/apps/prod-01/resources/alexpires.me.conf

@@ -1,15 +1,5 @@
 resolver kube-dns.kube-system.svc.cluster.local valid=10s;
 
-location ^~ /config/dav {
-    proxy_pass https://web.sftpgo.svc.cluster.local/config/dav;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Forwarded-Host $host;
-    proxy_set_header X-Forwarded-Port $server_port;
-}
-
 location ^~ /api/ssh_locker/ {
     rewrite ^/api/ssh_locker/(.*)$ /$1 break;
     proxy_pass https://backend.ssh-locker-web.svc.cluster.local;