- Ya
- 7 Julai 2026, 20:28 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 9819693
Adds a full remote-desktop stack, GitOps-applied via the deploy workflow: - KubeVirt + CDI installed at deploy time (pinned-stable release URLs) - desktop-1: Kubuntu 24.04 VM, 8 vCPU / 16Gi / 500Gi Longhorn block disk, masquerade net (native cluster DNS), xrdp KDE session; cloud-init installs Chrome, VS Code, NetBeans, Temurin JDK 21+17, Headlamp, Kate, LibreOffice and removes Firefox - Apache Guacamole (guacamole + guacd + Postgres config DB) at desktop.kamocrm.com; guacd runs hostNetwork on k1m1 so it can WoL-broadcast and RDP directly onto the 192.168.4.0/22 LAN while still reaching the VM via ClusterFirstWithHostNet DNS - LAN Windows PC (192.168.4.44, MAC f4:4d:30:62:8a:68) added as a connection with Guacamole native Wake-on-LAN (magic packet on connect, 30s wait) - Edge hardening: Traefik TLS + tight desktop-rate-limit + security headers, plus Guacamole built-in per-IP brute-force ban - auto-cert: desktop.kamocrm.com added to STATIC_DOMAINS + cross-ns mirror so cert-manager issues/renews tls-desktop-kamocrm-com into the desktop ns - Credentials: user 'sage'; password injected from CI secret DESKTOP_PASSWORD at deploy time (envsubst/sed + imperative Secret) — never committed