FAForever · renovate · Nov 9, 2024 · Nov 9, 2024 · Mar 23, 2025 · Mar 23, 2025
diff --git a/apps/faf-icebreaker/templates/config.yaml b/apps/faf-icebreaker/templates/config.yaml
@@ -13,9 +13,9 @@ data:
   RABBITMQ_HOST: "rabbitmq"
   RABBITMQ_USER: "faf-icebreaker"
   RABBITMQ_PORT: "5672"
-  CLOUDFLARE_ENABLED: "false"
-  XIRSYS_ENABLED: "true"
-  XIRSYS_TURN_ENABLED: "true"
+  CLOUDFLARE_ENABLED: "true"
+  XIRSYS_ENABLED: "false"
+  XIRSYS_TURN_ENABLED: "false"
   GEOIPUPDATE_EDITION_IDS: "GeoLite2-City"
   LOKI_BASE_URL: "http://monitoring-loki-gateway.faf-ops.svc"
   QUARKUS_LOG_CATEGORY__COM_FAFOREVER__LEVEL: "DEBUG"
diff --git a/apps/faf-lobby-server/config/config.yaml b/apps/faf-lobby-server/config/config.yaml
@@ -40,6 +40,9 @@ NEWBIE_TIME_BONUS: .25
 MAXIMUM_NEWBIE_TIME_BONUS: 3.0
 MINORITY_BONUS: 1
 
+LADDER_TOP_PLAYER_SEARCH_EXPANSION_MAX: 1.0
+LADDER_TOP_PLAYER_SEARCH_EXPANSION_STEP: 1.0
+
 QUEUE_POP_TIME_MAX: 90
 
 LADDER_VIOLATIONS_ENABLED: false
diff --git a/apps/faf-replay-server/config/config.yaml b/apps/faf-replay-server/config/config.yaml
@@ -1,6 +1,7 @@
 # See faf-rust-replayserver repository, docs/usage.rst for documentation.
 server:
   port: 15000
+  websocket_port: 15001
   prometheus_port: 8011
   worker_threads: 4
   connection_accept_timeout_s: 21600
@@ -16,7 +17,7 @@ storage:
 replay:
   forced_timeout_s: 18000
   time_with_zero_writers_to_end_replay_s: 30
-  delay_s: 300
+  delay_s: 30
   update_interval_s: 1
   merge_quorum_size: 2
-  stream_comparison_distance_b: 4096
+  stream_comparison_distance_b: 4096
diff --git a/apps/faf-replay-server/templates/ingress.yaml b/apps/faf-replay-server/templates/ingress.yaml
@@ -10,3 +10,17 @@ spec:
       services:
         - name: faf-replay-server
           port: 15000
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: faf-replay-server
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`replay-ws.{{.Values.baseDomain}}`)
+      kind: Rule
+      services:
+        - name: faf-replay-server
+          port: 15001
diff --git a/apps/faf-replay-server/templates/service.yaml b/apps/faf-replay-server/templates/service.yaml
@@ -11,3 +11,6 @@ spec:
     - name: replay-stream
       port: 15000
       targetPort: 15000
+    - name: ws-replay-stream
+      port: 15001
+      targetPort: 15001
diff --git a/apps/faf-replay-server/templates/statefulset.yaml b/apps/faf-replay-server/templates/statefulset.yaml
@@ -21,7 +21,7 @@ spec:
         prometheus.io/path: '/'
     spec:
       containers:
-        - image: faforever/faf-rust-replayserver:0.3.2
+        - image: faforever/faf-rust-replayserver:0.4.0-RC1
           imagePullPolicy: Always
           name: faf-replay-server
           envFrom:

diff --git a/apps/faf-user-service/templates/config-hydra2.yaml b/apps/faf-user-service/templates/config-hydra2.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: faf-user-service-hydra2
+  labels:
+    app: faf-user-service-hydra2
+data:
+  # Only for testing environments
+  FAF_ENVIRONMENT: {{ eq .Values.environment "prod" | ternary "" .Values.environment }}
+  REAL_IP_HEADER: "Cf-Connecting-Ip"
+  PASSWORD_RESET_URL: "https://www.{{.Values.baseDomain}}/account/password/reset"
+  REGISTER_ACCOUNT_URL: "https://www.{{.Values.baseDomain}}/account/register"
+  ACTIVATION_URL_FORMAT: "https://user.{{.Values.baseDomain}}/register/activate?token=%s"
+  FAILED_LOGIN_ACCOUNT_THRESHOLD: "5"
+  FAILED_LOGIN_ATTEMPT_THRESHOLD: "10"
+  FAILED_LOGIN_THROTTLING_MINUTES: "5"
+  FAILED_LOGIN_DAYS_TO_CHECK: "1"
+  HYDRA_TOKEN_ISSUER: "https://login.{{.Values.baseDomain}}"
+  HYDRA_JWKS_URL: "https://login.{{.Values.baseDomain}}/.well-known/jwks.json"
+  HYDRA_BASE_ADMIN_URL: "http://ory-hydra2:4445"
+  DB_URL: "jdbc:mariadb://mariadb:3306/faf_lobby?ssl=false"
+  DB_USERNAME: "faf-user-service"
+  DB_DATABASE: "faf_lobby" # for mariadb init script
+  LOBBY_URL: "wss://ws.{{.Values.baseDomain}}"
+  IRC_TOKEN_TTL: "300"
+  JAVA_OPTS: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005"
diff --git a/apps/faf-user-service/templates/deployment-hydra2.yaml b/apps/faf-user-service/templates/deployment-hydra2.yaml
@@ -0,0 +1,56 @@
+# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: faf-user-service-hydra2
+  labels:
+    app: faf-user-service-hydra2
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: faf-user-service-hydra2
+  template:
+    metadata:
+      labels:
+        app: faf-user-service-hydra2
+      annotations:
+        prometheus.io/scrape: 'true'
+        prometheus.io/port: '8081'
+        prometheus.io/path: '/actuator/prometheus'
+    spec:
+      containers:
+        - image: faforever/faf-user-service:3.2.0-RC2
+          imagePullPolicy: Always
+          name: faf-user-service
+          envFrom:
+            - configMapRef:
+                name: faf-user-service-hydra2
+            - secretRef:
+                name: faf-user-service
+          volumeMounts:
+            - name: mail-templates
+              mountPath: /config/mail/
+              readOnly: true
+          ports:
+            - containerPort: 8080
+          startupProbe:
+            httpGet:
+              port: 8080
+              path: /q/health
+            failureThreshold: 10
+            periodSeconds: 3
+          livenessProbe:
+            httpGet:
+              port: 8080
+              path: /q/health
+            failureThreshold: 3
+            periodSeconds: 10
+      restartPolicy: Always
+      volumes:
+        - name: mail-templates
+          configMap:
+            name: faf-user-service-mail-templates
diff --git a/apps/faf-user-service/templates/ingress.yaml b/apps/faf-user-service/templates/ingress.yaml
@@ -11,3 +11,9 @@ spec:
       services:
         - name: faf-user-service
           port: 8080
+    # This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
+    - match: Host(`user-nx.{{.Values.baseDomain}}`)
+      kind: Rule
+      services:
+        - name: faf-user-service-hydra2
+          port: 8080
diff --git a/apps/faf-user-service/templates/service-hydra2.yaml b/apps/faf-user-service/templates/service-hydra2.yaml
@@ -0,0 +1,13 @@
+# This is for temporary running Ory Hydra 1.10 and 2.x in parallel.
+apiVersion: v1
+kind: Service
+metadata:
+  name: faf-user-service-hydra2
+  labels:
+    app: faf-user-service-hydra2
+spec:
+  selector:
+    app: faf-user-service-hydra2
+  ports:
+    - port: 8080
+      targetPort: 8080
diff --git a/apps/nodebb/templates/deployment.yaml b/apps/nodebb/templates/deployment.yaml
@@ -42,7 +42,7 @@ spec:
             - mountPath: /data/plugins
               name: plugins
       containers:
-        - image: ghcr.io/nodebb/nodebb:4.4
+        - image: ghcr.io/nodebb/nodebb:4.5
           imagePullPolicy: Always
           name: nodebb
           volumeMounts:

diff --git a/apps/ory-hydra2/Chart.yaml b/apps/ory-hydra2/Chart.yaml
@@ -0,0 +1,3 @@
+apiVersion: v2
+name: ory-hydra2
+version: 1.0.0
diff --git a/apps/ory-hydra2/templates/config.yaml b/apps/ory-hydra2/templates/config.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ory-hydra2
+  namespace: faf-apps
+  labels:
+    app: ory-hydra2
+data:
+  URLS_SELF_ISSUER: "https://login.{{.Values.baseDomain}}"
+  URLS_LOGIN: "https://user-nx.{{.Values.baseDomain}}/oauth2/login"
+  URLS_CONSENT: "https://user-nx.{{.Values.baseDomain}}/oauth2/consent"
+  STRATEGIES_ACCESS_TOKEN: "jwt"
+  OAUTH2_CLIENT_CREDENTIALS_DEFAULT_GRANT_ALLOWED_SCOPE: "true"
+  # These are only used for postgres init script, it is redundant in the DSN secret! Don't forget to also create a secret for DB_PASSWORD
+  DB_USER: "hydra"
+  DB_NAME: "ory-hydra"
diff --git a/apps/ory-hydra2/templates/deployment.yaml b/apps/ory-hydra2/templates/deployment.yaml
@@ -0,0 +1,35 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ory-hydra2
+  namespace: faf-apps
+  labels:
+    app: ory-hydra2
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: ory-hydra2
+  template:
+    metadata:
+      labels:
+        app: ory-hydra2
+      annotations:
+        prometheus.io/scrape: 'false'
+    spec:
+      containers:
+        - image: oryd/hydra:v2.2.0
+          imagePullPolicy: Always
+          name: ory-hydra2
+          envFrom:
+            - configMapRef:
+                name: ory-hydra2
+            - secretRef:
+                name: ory-hydra2
+          ports:
+            - containerPort: 4444
+            - containerPort: 4445
+      restartPolicy: Always
diff --git a/apps/ory-hydra2/templates/ingress.yaml b/apps/ory-hydra2/templates/ingress.yaml
@@ -0,0 +1,13 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ory-hydra2
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`login.{{.Values.baseDomain}}`)
+      kind: Rule
+      services:
+        - name: ory-hydra2
+          port: 4444
diff --git a/apps/ory-hydra2/templates/migration-cronjob.yaml b/apps/ory-hydra2/templates/migration-cronjob.yaml
@@ -0,0 +1,35 @@
+kind: CronJob
+apiVersion: batch/v1
+metadata:
+  name: ory-hydra2-migration
+  namespace: faf-apps
+  labels:
+    app: ory-hydra-migration
+spec:
+  # Disabled because triggered manually
+  schedule: "0 0 31 2 *"
+  suspend: true
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    metadata:
+      labels:
+        app: ory-hydra2-migration
+      annotations:
+        prometheus.io/scrape: 'false'
+    spec:
+      template:
+        spec:
+          containers:
+            - image: oryd/hydra:v2.2.0
+              imagePullPolicy: Always
+              name: ory-hydra
+              envFrom:
+                - configMapRef:
+                    name: ory-hydra2
+                - secretRef:
+                    name: ory-hydra2
+              ports:
+                - containerPort: 4444
+                - containerPort: 4445
+              args: [ "migrate", "sql", "--read-from-env", "--yes"]
+          restartPolicy: Never
diff --git a/apps/ory-hydra2/templates/secret.yaml b/apps/ory-hydra2/templates/secret.yaml
@@ -0,0 +1,19 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: ory-hydra2
+  namespace: faf-apps
+spec:
+  authentication:
+    universalAuth:
+      credentialsRef:
+        secretName: infisical-machine-identity
+        secretNamespace: faf-ops
+      secretsScope:
+        projectSlug: {{.Values.infisical.projectSlug}}
+        envSlug: {{.Values.infisical.envSlug}}
+        secretsPath: "/ory-hydra2"
+  managedSecretReference:
+    secretName: ory-hydra2
+    secretNamespace: faf-apps
+    creationPolicy: "Owner"
diff --git a/apps/ory-hydra2/templates/service.yaml b/apps/ory-hydra2/templates/service.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ory-hydra2
+  namespace: faf-apps
+  labels:
+    app: ory-hydra2
+spec:
+  selector:
+    app: ory-hydra2
+  ports:
+    - name: public-port
+      port: 4444
+      targetPort: 4444
+    - name: admin-port
+      port: 4445
+      targetPort: 4445
diff --git a/cluster/storage/values.yaml b/cluster/storage/values.yaml
@@ -24,6 +24,12 @@ managedStorages:
       size: 500Gi
     pvc:
       namespace: faf-apps
+  - pv:
+      name: faf-replays-old
+      folderName: replays-old
+      size: 500Gi
+    pvc:
+      namespace: faf-apps
   - pv:
       name: faf-maps
       folderName: maps

diff --git a/cluster/telepresence/Chart.yaml b/cluster/telepresence/Chart.yaml
@@ -0,0 +1,7 @@
+apiVersion: v2
+name: telepresence
+version: 1.0.0
+dependencies:
+  - name: telepresence-oss
+    version: 2.21.3
+    repository: oci://ghcr.io/telepresenceio
diff --git a/cluster/telepresence/values.yaml b/cluster/telepresence/values.yaml
@@ -0,0 +1,3 @@
+namespace: telepresence
+telepresence:
+  releaseName: traffic-manager
diff --git a/cluster/traefik/Chart.yaml b/cluster/traefik/Chart.yaml
@@ -3,5 +3,5 @@ name: traefik
 version: 1.0.0
 dependencies:
 - name: traefik
-  version: 35.4.0
+  version: 34.5.0
   repository: https://traefik.github.io/charts
diff --git a/infra/mariadb/templates/statefulset.yaml b/infra/mariadb/templates/statefulset.yaml
@@ -17,7 +17,7 @@ spec:
         app: mariadb
     spec:
       containers:
-        - image: mariadb:11.6
+        - image: mariadb:11.7
           imagePullPolicy: Always
           name: mariadb
           ports:

diff --git a/infra/postgres/templates/statefulset.yaml b/infra/postgres/templates/statefulset.yaml
@@ -33,7 +33,7 @@ spec:
 
       restartPolicy: Always
       containers:
-        - image: postgres:17.4-bookworm
+        - image: postgres:17.6-bookworm
           imagePullPolicy: Always
           name: postgres
           ports: