Add pod cidr to cilium

use correct port
fix(thin): try to fix weird https issue by configuring cilium
2025-02-17 21:21:59 -05:00 · 2025-02-17 21:18:30 -05:00 · 2025-02-17 21:14:26 -05:00 · 2025-02-17 19:21:24 -05:00 · 2025-02-17 15:18:44 +00:00 · 2025-02-17 15:18:44 +00:00
479 changed files with 12086 additions and 1921 deletions
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@ -15,17 +15,17 @@
  //"schedule": ["on saturday"],
  "flux": {
    "fileMatch": [
-      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
    ]
  },
  "helm-values": {
    "fileMatch": [
-      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
    ]
  },
  "kubernetes": {
    "fileMatch": [
-      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
    ]
  },
  "kustomize": {
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1 @@
+.projectile
--- a/.taskfiles/Flux/Taskfile.yaml
+++ b/.taskfiles/Flux/Taskfile.yaml
@ -3,20 +3,20 @@
 version: "3"

 vars:
-  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/sops-key.sops.yaml"
-  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/forgejo-deploy-key.sops.yaml"
+  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/sops-key.sops.yaml"
+  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/forgejo-deploy-key.sops.yaml"

 tasks:
  bootstrap:
    desc: Bootstrap Flux into a Kubernetes cluster
    cmds:
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/bootstrap/flux
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/common/bootstrap/flux
      - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --server-side --filename -
      - sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --server-side --filename -
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/flux/config
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/{{.CLUSTER}}/flux/config
    preconditions:
      - { msg: "Missing cluster sops key", sh: "gpg -K 687802D4DFD8AA82EA55666CF7DADAC782D7663D" }

  reconcile:
-    desc: Force update Flux to pull in changes from your Git repository
+    desc: Force update Flux to pull in changes from the Git repository
    cmd: flux reconcile --namespace flux-system kustomization cluster --with-source
--- a/Taskfile.yaml
+++ b/Taskfile.yaml
@ -3,7 +3,7 @@
 version: "3"

 vars:
-  CLUSTER_DIR: "{{.ROOT_DIR}}/cluster"
+  CLUSTERS_DIR: "{{.ROOT_DIR}}/kubernetes"

 includes:
  flux: .taskfiles/Flux/Taskfile.yaml
@ -12,3 +12,7 @@ tasks:
  execPostgres:
    desc: Exec into the postgres pod as the postgres user
    cmd: kubectl -n database exec -it postgresql-0 -- psql -d postgres -U postgres
+
+  execMysql:
+    desc: Exec into the mysql pod as the mysql user
+    cmd: kubectl -n database exec -it mysql-0 -- mysql -u root -p
--- a/cluster/apps/database/postgresql/pgsql-pv.yaml
+++ b/cluster/apps/database/postgresql/pgsql-pv.yaml
@ -1,27 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: postgresql-pv
-  namespace: database
-spec:
-  storageClassName: hostpath
-  persistentVolumeReclaimPolicy: Retain
-  capacity:
-    storage: 12Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: "/mnt/MainPool/Kubernetes/databases/postgresql"
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: postgresql-pv-claim
-  namespace: database
-spec:
-  storageClassName: hostpath
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
--- a/cluster/apps/database/postgresql/pgsql.sops.yaml
+++ b/cluster/apps/database/postgresql/pgsql.sops.yaml
@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: pgsql-secrets
-    namespace: database
-stringData:
-    adminPassword: ENC[AES256_GCM,data:gJ7rl2V/VlbIIRvRHcwMaZKN87t5n8bVWZCj/tRv8Uw=,iv:b/5eEnOrHzJrtnO+E2IGwJLHy2AdJQwv9WfUR5fUHY4=,tag:nTtaDNHVfYpChQX9UWwdKA==,type:str]
-    userPassword: ENC[AES256_GCM,data:gR7q508lUaRDRJ/z5lH99JLJSS9zWfg0O+TAm2B9uvo=,iv:9DDQxwd/BGtLQDacAH/crfT+qU4Pn5sGkWuEtmMprUI=,tag:tK3WoUd7729LQDVqU7pckQ==,type:str]
-    replicationPassword: ENC[AES256_GCM,data:BSA5IfYhhvN445yp2i3BI5zlIXgdj+LejCPzvlTMnVo=,iv:Qku2NAQPLxt+NUnk2dSx1+WAoyx3aEuA3+piU2mubYk=,tag:MnI+atK6VLZUc3eGS1OE1w==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-10-22T16:25:15Z"
-    mac: ENC[AES256_GCM,data:uWVPfKwPpR212js7f2RnCzEsMnxk2JpGPcf2L5i4gJCddJCrRJkdhjWGyVVpp/ociP3JLRTI95+WSEUH0KkPZpY1ptQevCVsUemRytOCtBlR0yR4qsBwEisSu8m4B5dbAYsqlXAndrBNL2WGB7uBv+ILgNxkhlN58unseSWJBDM=,iv:e7QyZSlhpyQ+A8OmV4p1848itIUxyam6CJOI9/N7DDY=,tag:N28mfrAjUTTYkly1hu0OhA==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:35:15Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//aQdUERyq3G7V29F5rpY6LdDgo8+hqrrZvdI3JnON0VUM
-            Tj3AAYg+xvYh8aPQywF9fJvn6qNw8fqrb2GiuuNTa9ZPCFsD+WXbuYHmQ9z6tAtV
-            opXe3QLNBuo9zEtUfGPbaCp8EH7f1TxQsTJoe9iE/1B2S69cHNUdgXZtfQyhpmlG
-            iyAk/G04kPazweIuFNjOYaN/12J/s2Cf5AZUeROkMxg8/GTPO68LeEBz9v4vl/1z
-            JlxmZyXR/9IeoBlO63asDrR85fcvSDb31K4qE3WVkag20bXClv1lehLVKO4bxA/F
-            lW1tXDR3odC9Ozme884Znd05L0NWkzYKYRta198IV6JuSCeMdjTscGGlMM9wqqKz
-            SZgs81FHXT16YCVupfI22CqMiD0EzQXrGEtJ4NqaBvhZu+MDxszNRzIl73b0HANc
-            8JQqQqOJh7ltrWnf39Xlv73yVC/pYbaV1LWGnMfqWvOcksa9QjOH9Ysfj/RxdaMw
-            VQhydU+21+xeuEQBL7OsiJQUzgJjFREnTRPXcorCtWxocCn5zwdct1SFchFzCOTp
-            H0ubpD+MP4RTWxuYbZRhE5ty6GJU9liRH7dUJtVaQiv8V+G1DungTqq36AbbnHzd
-            9cy+4cM3wZx2VYElL7DBom8nqqm7Xhffr0UaaY8VFuV5bBry3BmM5rOr8vDYqf7U
-            aAEJAhC/4yiBMuhEB+fwXIq/dBjMzW+p8SotK2QK03yaTFQchnBDknwVdqcKQxIZ
-            di3kupnjB+KllWOZhl121tT9L35ymL53BUu1FKCTFdIS2wXxy6UlIS98n0bvWJYN
-            c5WTfk81xmbT
-            =UE14
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:35:15Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ/9G2JDsJw6YJMjstWPrv07tnU0ErWZx5WGcNUGhw6T5tOJ
-            kXCAuaZax8NxoTtZnQ9Cd+WgJr7R0FuVPEPTc4G2RsfntSZq5rBgCpT0fgwyASFX
-            64b6YTbLcCL+G6sg/FwIi9SRqqCsaljATjoU685vrjaxYYfAdhyUoM3qSNjMMaMl
-            zVjn0kbWrQn4GqfuRMqcr+zCIQdHNTTJ12+c6UUo/zJp4zzjA68Yur9aiw1iHtR1
-            rYCPHX2/ZmQjADTHXqwpuMdb5j0VDcd5JcZabdcJkhn/6MRJiN+XryZN/Neq9UbF
-            5WrMaZz5v0iRnMUCr8HMw29P0ttu5Sma+RyCOZuWlpsXj+C84pJ8CjBbFhzSJzGP
-            cKI8Syn0CPLN3X6vKs+LJXEHg1jxJ9kuN+RgW+SQRctUX3A0JtFg2tWplkptNtLl
-            hN5rW+fWxk7BV9dP7wouwVJiKcW3Y/OMCF5H8YHwL/KVHvANBwNM+nmFPrHaqN2s
-            0RghznmZMVG+9IYedSM6d8ZJLnO/QsNTE0QTGM/3dmBAn9jcndCLTgcgThAtvcmw
-            lFJYaMN3W455Cccaif93xnb44yn47actgEuM6GOuP15GGJaHD2iBQ2atHcaQhNQR
-            mxhIIouu+Kaa6g34MA/VGDNoN0eNYI5RZIUSSBl7bgaOXs9/3j1Uvap9yesCaOTU
-            aAEJAhDDqjX7RUazeEByAiKjv5TxpQzsi8gR4zyrhf6tTx34jHzQNoVjYEtLMEVl
-            ZlAJ06RoxOj8O6+8RGYd/ZUE+TQPQ4jx+PgWrZPUQx8TSxevuduw5XZ1lKytUSCZ
-            GFDjOxp0lMGV
-            =LHSB
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.8.0
--- a/cluster/apps/default/cdn/helm-release.yaml
+++ b/cluster/apps/default/cdn/helm-release.yaml
@ -1,65 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: nginx-cdn
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: oci.seedno.de/seednode/nginx
-      tag: latest
-
-    args:
-    - -c
-    - /config/nginx.conf
-
-    service:
-      main:
-        ports:
-          http:
-            port: 6544
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "cdn.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            
-    persistence:
-      data:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/cdn/data
-        readOnly: true
-        mountPath: /data
-      config:
-        enabled: true
-        type: configMap
-        name: nginx-cdn-configmap
-
-    resources:
-      requests:
-        cpu: 1m
--- a/cluster/apps/default/fireflyiii/env-secret.sops.yaml
+++ b/cluster/apps/default/fireflyiii/env-secret.sops.yaml
@ -1,123 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: firefly-env-secret
-    namespace: default
-stringData:
-    ALLOW_WEBHOOKS: ENC[AES256_GCM,data:qdisaso=,iv:rT7WID3kRMPEGmWJepNmrj1tutxsT5Arw5AN9oVFoXE=,tag:jkYkRaGLEB3iBEjEVIAVCg==,type:str]
-    APP_DEBUG: ENC[AES256_GCM,data:Jyo8QmI=,iv:Gq2Ldh+H+oturcglphQb7ERHX8jD/5j01qtEJDRPAn4=,tag:m96oouPtT9J5zQHPs2QaVw==,type:str]
-    APP_ENV: ENC[AES256_GCM,data:19kiyms=,iv:KLwsQOsDvg/7f18FEsg+e2rgnXSbsxwSNbItmgLGy8M=,tag:mUX/UeXFi0eeZ68bsJpq8Q==,type:str]
-    APP_KEY: ENC[AES256_GCM,data:PI70apm/K8/1el4lW3KR6wLgBDgj0YAQ6KwngqxSv2Y=,iv:S7xrpAeY3wM3moCL/i5R045yst7Zz8ahXbLyNfvacZ0=,tag:hOXR1kKdxVoQxZyjZu+ajg==,type:str]
-    APP_LOG_LEVEL: ENC[AES256_GCM,data:ZwJTcn8y,iv:wk+jX9Zp1TTn1EHv0OLgt+0alm5JBHdWcEtIn1dTI6o=,tag:gR1Ls7dFGyt4hKGiwLU5wQ==,type:str]
-    APP_NAME: ENC[AES256_GCM,data:yfd2OQk6NvjKcA==,iv:jLL2Dt0YlWODwCKSnqR1yuSWJsKySQNZY/pEfxi5jJM=,tag:XoHlMsMuRG6S4Wm0PVjtBA==,type:str]
-    APP_URL: ENC[AES256_GCM,data:+bveNLjanPPMkoMrDO4KsA==,iv:xQWHzRKBMBumi2bFCUKoWLRiuNNV3HQLv1WGEiZ6RRg=,tag:h9IF4XwIK2P8sB4V1Su5Ug==,type:str]
-    AUDIT_LOG_LEVEL: ENC[AES256_GCM,data:OA7nqw==,iv:9BcE5Bf9QDf3kzA4Xbf0XkbkFjGAv6id7vdSI12wRm8=,tag:QN7o1eEbGSTvrGGBzzouSg==,type:str]
-    AUTHENTICATION_GUARD: ENC[AES256_GCM,data:wsQZSzAP0hE4o9DAwNtwSEM=,iv:U6513HaOzDDlCehFuSs8ey0KFWup9S8tAYiSX89EyNg=,tag:i5q9W6uglFZ9bKc2f4QPvQ==,type:str]
-    AUTHENTICATION_GUARD_HEADER: ENC[AES256_GCM,data:0GfWuR+1RhLsED/T5iEDYV3tkmx2wA==,iv:x/6xxFAv5+J8e55a9JnIZ49v/FJRL066rSf2bBxhHHU=,tag:hAhhsDDMeM29b8iMx3xwqA==,type:str]
-    BROADCAST_DRIVER: ENC[AES256_GCM,data:2iYs,iv:5oeuA+08uDRSJyLwwkdFC2q4LZKNs2OSoQjsnIX0aYY=,tag:m2ybfxtY98j39sBnax7IVA==,type:str]
-    CACHE_DRIVER: ENC[AES256_GCM,data:2lv9YGE=,iv:xuk6ih2wApMuWJIlm9clwYCnMR973lG7EOHDUZtlDvc=,tag:cdEh6/zAZ+7IcQMvHojgXQ==,type:str]
-    CACHE_PREFIX: ENC[AES256_GCM,data:OS/jr/Qo5A==,iv:wLeRO4uAo+HHB/1tK3m4MEeefmMRTc0+aTYuUGGrYyg=,tag:8cv8oxfwMkTeZ8+JsCoWVA==,type:str]
-    COOKIE_PATH: ENC[AES256_GCM,data:pQ==,iv:5QR02hlvi9n/gl6LLdSR2HSybzohlCisq51+QzUJv1k=,tag:hpwUD0ctU0pX7S+V6UNz/w==,type:str]
-    COOKIE_SAMESITE: ENC[AES256_GCM,data:HNlS,iv:f/kbAOVyWFEH6yKr+N3zM+9tNQQCpQA7/iKAg8ejFdk=,tag:g1rmzfnWSYIzxFJA0l/uUA==,type:str]
-    COOKIE_SECURE: ENC[AES256_GCM,data:fxJkE2M=,iv:0JXgzyybtMtIgxh6VSwAS5oehpVMFkLKvJFOBDcwhVM=,tag:RAhNUuJKOho6bvXJyNT6cg==,type:str]
-    DB_CONNECTION: ENC[AES256_GCM,data:Y7b+kts=,iv:1vZBNoO4O0Z8LPH3ZPSDpx49jtbQOEl6+BitbKyat4A=,tag:eOUpSlZGZKM0LPHdZMjb+Q==,type:str]
-    DB_DATABASE: ENC[AES256_GCM,data:1rRtAXfMaA==,iv:vErtoqpi1KsHVL0nQ6x2MVNe6JCKxjCxivXXjtUT6Uw=,tag:AYxHWADlGq4NHbcVx8QcHg==,type:str]
-    DB_HOST: ENC[AES256_GCM,data:sjYDEi8q4bAgpdnxin6yDBtNJw==,iv:6rxqBNvXSsE+2oxWbwiztmlxtKP8C0aeYMdmuGTyF/g=,tag:lRB3EwV4vwa64CI3xqi2lQ==,type:str]
-    DB_PASSWORD: ENC[AES256_GCM,data:PeysFTbHeZHTnkn0XlJ58AMZbS3EzANUQ8UnhQXRIoU=,iv:NM8c3dx8TlQkPVJGECnyg2L6JM7CQwlx/LQ59x15dY0=,tag:xuLow/AXp+yOUm4hO2527g==,type:str]
-    DB_PORT: ENC[AES256_GCM,data:yXp98w==,iv:a/jbQI7/3QMKaSJRiZGhdYBzdIzyNA0M3sL83bD/1is=,tag:PxauXvxyQlNo8EaFMzdjKg==,type:str]
-    DB_USERNAME: ENC[AES256_GCM,data:UOz2K8KusA==,iv:75KRLL7F0mtzESvfvVaIJiBqAz1i8JIcS2VwAMm3KVE=,tag:HmjzrLg4hLuAjQ88U3CDbw==,type:str]
-    DEFAULT_LANGUAGE: ENC[AES256_GCM,data:U2qo/Z0=,iv:duSb5g58hXy+BjmU51cWVc2APmz/THtQrmfKyWJL8Xs=,tag:3578FhaZxtyLXjFOJA7sVQ==,type:str]
-    DEFAULT_LOCALE: ENC[AES256_GCM,data:DX3VePo=,iv:d3P66DEPoI3yiZj00YaYVEsu9zCSQ+Nz0vCOxJjfkNk=,tag:JNeGcODHleBBOJrewOWq2w==,type:str]
-    DISABLE_CSP_HEADER: ENC[AES256_GCM,data:mS45ZNE=,iv:7twp7yAggJfGDKnoqoi4OY97uMQuOq1Y3y6LFst9qFY=,tag:mselnIDI/OzNplWsdq2YlA==,type:str]
-    DISABLE_FRAME_HEADER: ENC[AES256_GCM,data:lIO+3IU=,iv:/jCBrh9pxsNouU+glpvXqEXI3veHsqaHWkSDEJcJzHI=,tag:JHWUyPl6Ir+XczlkEm/xsw==,type:str]
-    DKR_BUILD_LOCALE: ENC[AES256_GCM,data:43nBSlc=,iv:pylnsBF4HORItmtHxLxaXjojdyazm1rseMtqgTwwX8k=,tag:mi7eWamr3l/H+foZUJYsJg==,type:str]
-    DKR_CHECK_SQLITE: ENC[AES256_GCM,data:TssvPA==,iv:N6kVxo9w7pjUy5PSt0nF3yPS7imaKaWbizPZdMv7rKQ=,tag:DpWzkfkFbFaQpuLTirsP1g==,type:str]
-    DKR_RUN_MIGRATION: ENC[AES256_GCM,data:6+nNEA==,iv:TxFrPKxoaN/neoRK09F5SJswfh+ULHw/tFQz+ouOOsU=,tag:UsMPAYDhgccBtBUAXxTNaQ==,type:str]
-    DKR_RUN_PASSPORT_INSTALL: ENC[AES256_GCM,data:rA1uHQ==,iv:TKV5pRA65C8FNHOrpzx90qA7maX5ld3aLCv/PrQamII=,tag:bqtT9pqHILiV1AEzkkYk5Q==,type:str]
-    DKR_RUN_REPORT: ENC[AES256_GCM,data:bqE/+A==,iv:PWlGji8/zVoosDeoWaTG4f9rDJwKOilwENI1JtzatPA=,tag:cHCeTgnB7c0TZ+9bSxFW4A==,type:str]
-    DKR_RUN_UPGRADE: ENC[AES256_GCM,data:76w+1w==,iv:XZwFW5WoWRBhfgM8Jf71IAEsWJxaWj6nmzh4arjV9IY=,tag:wm49cS3mMPPj0l7rNRm7nA==,type:str]
-    DKR_RUN_VERIFY: ENC[AES256_GCM,data:GE3u0A==,iv:hZc9+yCN781Hm/M6UrzAnFELJopG/m0PTaHCwJuK4Ic=,tag:SwJ/ujTY9VsrS8payg5FbA==,type:str]
-    ENABLE_EXTERNAL_MAP: ENC[AES256_GCM,data:jwbL3WE=,iv:EmuPlxlldYIK57w44oeiOUx4dNUx88avn/MXGw0khqk=,tag:6UqgxY3eTE/DQ4znx5NNzw==,type:str]
-    ENABLE_EXTERNAL_RATES: ENC[AES256_GCM,data://NWaSg=,iv:l1k7TLg2d4impHiGyHtVmXFBpHSK1X+MIIMEvqHmFCc=,tag:7FX96H6R+ez0corFjpzoWA==,type:str]
-    FIREFLY_III_LAYOUT: ENC[AES256_GCM,data:KGo=,iv:xvBorcd8fPvlGYeomuexZBtORPc7LJRII9pYP1ZNBsg=,tag:ibFX6k0a12rXElxRODc1YA==,type:str]
-    IS_HEROKU: ENC[AES256_GCM,data:Ffu4Sro=,iv:Q5txv1a/DcH+Utlr12zQJUBy4vlcdxcHFsNDWuWVOeU=,tag:NTay0IKz6s7a9dFpx1BZ+w==,type:str]
-    LOG_CHANNEL: ENC[AES256_GCM,data:Njfav/E=,iv:xwccazZYrtARU7xKooAnBKJcCDJH5xUSN0C+nIs8Pos=,tag:jI3pelMMZQQ37uuUmUmENQ==,type:str]
-    MAIL_FROM: ENC[AES256_GCM,data:ILVOrph55Ku8pIfsHtU8DjMuUjo=,iv:c4wzRvDugyRUbKZKq/fgQ2eP3CJ1wJzkQo89tBCZ0WU=,tag:tx2lUsnCBbYIk0h4gL/CBA==,type:str]
-    MAIL_MAILER: ENC[AES256_GCM,data:rdoZ,iv:NBi4YtbtTkDJHQmXBu9lGUfCWhfRgtYLI3UCayMpq2k=,tag:o+cXYLXlJ0bWVQAPr85CJA==,type:str]
-    MAIL_PORT: ENC[AES256_GCM,data:lffjiQ==,iv:GsZWiMZGuhpPJfX6vPcr3PKuq2YXS3oQ8v8NojufyKk=,tag:rHcfDoLZdU5wCQR4g/qV6A==,type:str]
-    MAILGUN_ENDPOINT: ENC[AES256_GCM,data:rrw7Rwjo//tdEyxN98pE,iv:3aeAQM4RV5hDFfZ08voXgk7IrejoM8YACluo75AmRrE=,tag:cAmTiI0vPAnY7NX+YlM6Og==,type:str]
-    MAP_DEFAULT_LAT: ENC[AES256_GCM,data:i8I6LaPPLFoi,iv:sG6dP5GS2G6kGXEsn8P3KJmyEThJ73WIN2gkMJwNDBA=,tag:uefjbg5pZdIIONBklcsSyw==,type:str]
-    MAP_DEFAULT_LONG: ENC[AES256_GCM,data:+ESO4h6cGSE=,iv:hAFNmDfc6XWnQbpLQXjUsdZSOwPu964MlFBXYsNr9O0=,tag:iXfs5Z+Ojojzp2H2u1kHxA==,type:str]
-    MAP_DEFAULT_ZOOM: ENC[AES256_GCM,data:zw==,iv:soYKokimSKxSS0x9nM7GcZfpXtwxjuXVls+KFh61w30=,tag:ryX2Rj1TakKRfynh7bFEtw==,type:str]
-    MYSQL_SSL_CAPATH: ENC[AES256_GCM,data:Mo68CXbhV7kK5ZGi5MS8,iv:pVKSl5Tu8xzZVk4FX0DIA3vpVYZ9V0RXtfkoUTYeAAU=,tag:bez1DYHFlOn5TZ/oz7F6fQ==,type:str]
-    MYSQL_SSL_VERIFY_SERVER_CERT: ENC[AES256_GCM,data:DT7Jow==,iv:ZEOzfc0IepdvDNo2vWanOsYAT4EGLvFnSpL8qiiOwes=,tag:eEilJ8cwgCer7H/8qpDPgg==,type:str]
-    MYSQL_USE_SSL: ENC[AES256_GCM,data:rsKgGpE=,iv:nEJbHiaqOvVauAtCyL6uvfmkAmgvjjSFb28L3/j1PmU=,tag:6d5whsZ30buXkc0W4+5JIg==,type:str]
-    PGSQL_SCHEMA: ENC[AES256_GCM,data:pmFdRyiy,iv:mYXXlj7R7T3RTuK7QNRKiY6HwCezQYaMpn6de0st+FA=,tag:xFs7kAnFuRjDVRjKyyrJOw==,type:str]
-    PGSQL_SSL_MODE: ENC[AES256_GCM,data:/spE//X3,iv:qCBP7fJVFixBrB1ApGti1Nq0S87RcVxpHqmPBW9GuWU=,tag:MyCEseplfPX9PNdoqGLvmw==,type:str]
-    QUEUE_DRIVER: ENC[AES256_GCM,data:tTmRSg==,iv:2KdDPsJ9PlyHsVsFdknC7A4cShE5bBBpRxWslF/0wgY=,tag:7QN0MlfyoDyukmAgmgQvxg==,type:str]
-    REDIS_CACHE_DB: ENC[AES256_GCM,data:9w==,iv:MKfWJO941vxlJ0VP/0ob9JeFnHkI+okOkd/ifxkbKTA=,tag:PyyjVTRCUSvZxpHekP9ENQ==,type:str]
-    REDIS_DB: ENC[AES256_GCM,data:Bw==,iv:h3v/+cO1W7eGDAGjVtgeDh8UekMg+ZvIRkNZx+iE/Es=,tag:nF143FAtE181ZJfAjtau7A==,type:str]
-    REDIS_HOST: ENC[AES256_GCM,data:7hVDI2P+443UGlw/jyBFmNTDBM2p,iv:sbLD+/wdDEiKYpR3ttrey6HTlI5n76trH3wZjU7s3uQ=,tag:qZP1nb9+tOr7Lm4i9HR4wg==,type:str]
-    REDIS_PASSWORD: ENC[AES256_GCM,data:/i9UM5Cx6h61xbDQ//ocmW1BtmT0LILnwwemOwaTTkw=,iv:FINFRW1006Ljnb1JSi+Ctae3Jw9xR5EW73Ut8FCNfHI=,tag:+6raDqY1TgQQgbkcCcbCLg==,type:str]
-    REDIS_PORT: ENC[AES256_GCM,data:ME1O4Q==,iv:FhqTqv645wnhhQdGW0IsemeXOlJuCKjbMa3tBw0kueI=,tag:b7TdkDklkFwE/X3lE6XZGA==,type:str]
-    REDIS_SCHEME: ENC[AES256_GCM,data:puE6,iv:XvOpz9QO7Fn14bbHT8L2p0HquNxIzxomN3Bg3K2NOQY=,tag:qerZcGVGKXW+YAyj6RK9Tg==,type:str]
-    SEND_ERROR_MESSAGE: ENC[AES256_GCM,data:9xoXVw==,iv:m20IvyDsNzw7v3U8Ai34MhhxrIUGnU3OK9LHwZAdlJo=,tag:BgrhqBiqc9RYo9EzOCvSsw==,type:str]
-    SEND_REPORT_JOURNALS: ENC[AES256_GCM,data:+ErZjA==,iv:dcrc2+U7MoSBQ3b7w2qe0wIb50AbLDQ8/N9TK03ub5o=,tag:ub6+5g77qZxq8IjxDmk7og==,type:str]
-    SESSION_DRIVER: ENC[AES256_GCM,data:QlF9bSQ=,iv:I1cjDE4EFVG166ISZaNuM0eFMs6U55y7LUl2cVIONrI=,tag:VxKEC67A3Y0IRNKJ/nZV0g==,type:str]
-    SITE_OWNER: ENC[AES256_GCM,data:KbzTQ/QdlMmxnSDr1mCo4EG9,iv:287MEAzZFE3+zp3bWWA5Y2u3w7iQH+7AAZ812I4Elx0=,tag:TlljmsgLww7EJIBMdDrKvA==,type:str]
-    TRUSTED_PROXIES: ENC[AES256_GCM,data:cAU=,iv:MBL/z8pmM2CxlDT1sY4my2gC3jsDo6O1NSa11w3en5U=,tag:zqzHOR69HT3+U7tQOFQQSw==,type:str]
-    TZ: ENC[AES256_GCM,data:45gLKxH0OsAfMPkgnjKgWQ==,iv:P9CUovVI4WSfZi1nyFHVzHJ7Oioai1FUZRcgBNhQb64=,tag:S7IF8Oxg7hYNcT0mcgkg7Q==,type:str]
-    STATIC_CRON_TOKEN: ENC[AES256_GCM,data:1xck+8s3ifQmregeKU6891pErxZy86fO0I6XPE83l3o=,iv:XSsCSJkkGwG12f2lhd6IDl07OLVCW8J/945acFP99lA=,tag:XNxSQGyHvR/6/A3EVT69gg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-06-17T19:05:29Z"
-    mac: ENC[AES256_GCM,data:GWtQz5/wKpk38ZYLwn+kGyCT8hFo2SmoaI9vuEFju6N9ipJW1MNQONqTx/Qa8Cje8pT7xIxdoTf+23PaFG91v/gcilMCYjE+OFnVBk80d6ZBTXiSmoQ0DYO3hWiXyMfXTJ1OPqExOkY09QSAfXOrN0JphnWpPNZnaVuxMJZS/Og=,iv:/QbEi6hhsPpeSa5bOxPObP8UUpAwA/I6wU8VXQ6NcOc=,tag:FYYj1y/zTl82SVva0oauuA==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:36:01Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//So248m5bmfJG0gp5ZIAK2dVhH44xEg/6yzZ6TC9W4px2
-            SPqB+gmwswX64NGcGZQ8LQZExyy2poxh7lfQHIdsv2QSTbf0vmOZqG9L7Fv/DSU0
-            EnUpt04K1yyVyW09tlcE/SIyMy9HhWyH0vZfwqHc/pHnaAhZKEuBH+kFiNPz4Bfd
-            xtXeieOGYV9ois2vM2NFNohEagrkbpMb8ZEOrWlB8+ZJZhkIeNc2kA+w0n0TEEtR
-            WefrBwear6YloK89hEfWRdJYksfKvOsU7U+L6MKpMxqGBIpLIV5kTifRAt8pdrNX
-            m7MY/laTWcqTp1VXUMZQUq+tCa/jjIh4MDvmzGcrRfhSLDvkFz8W43yHvy/hTKgc
-            nes55vhrWK9ABcZ5sZ3xdfH3ys3tODUsUkaLALaCbXUdg15cQRwvdNkgHou/oY26
-            jAc38EpeBEtIpkH+nBHLgbflFkElqOcpcS/5OR4mL0dGQ0EhhYTzxES+jcVYg9ka
-            Na163uPvhNnFNMUACKsDU/u2WngU8B5ISjlsiX9EkbKqDgHrLSJywKcoYESgnU/K
-            q+24HIFH8cmghRYJZ7SXDahsEw8VrcqQEWTSMM4YnwJeBZH9pjeUK6RySLHxK9F7
-            rK2djzc6so2Lk/AhYot9FNNwXWqrBKQq7kjFF8Mr6ALydZgst/tSBPtpTxpADZDU
-            aAEJAhDuDefWmaUMfyK+B21JoUTJtAp1icQZrIFg+mTH+qDWPXdpM1qsaci59aq/
-            vkML3TwjiytUNRMVORlLPv2z8adUuXIgPx8yEclTxCDKM3bqIfVs1xj2GAItyO4K
-            XYBV8oIdHegO
-            =GI4b
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:36:01Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAApwoZ01GS0soprXAf20Ye1XQVLIFvIuYjub01ibNZmb3m
-            uJiPyClzMqcjy6TKWvCc6sT1W5DQ3aY9E1ARhgwR/yaIZ31WvNcnLczaOACHPlaW
-            7e4o9tauN8CYpQqPmTxDyQehKe1EbWqq+63FRAUV0+9qEY/ACCwNtv1HCa2dgyto
-            0I6v/BmW+KJ10iGCsRv8g5IgPSjYT66a2fsDg24kjtqygHwZ5BPe6xUBJ7zxCmVT
-            z/3WKaNx5Rdv8l45QQcl2fe1qNNdljJNgowCq23uODcQPJPGEY4wOeYHOlGTKE+E
-            JojnysVUhILhZtTZ5/AcP36RCzMDGQX7wYtvwh6bgf4qf4InX8+O/WK3u+jOreUl
-            zbcy/lB7bsQ0usZNPsfy2Qh2LPlziBce9JtkPnWXBwS+lZUCXKDS8pizmj7DZnlo
-            +3L1f26rn21ye/iOyBArzVmqI4QLJzHJI7l6TZgvvv1dZKHyLW5jCHSq4f098roO
-            kIKxRThFvTZ9jqM7uDYGiAsGt1L7p+HJRY5WdAVGEaL8jWADW7jjF8qTF3BJ05A9
-            OgnRxIew6ofB5WeYSrU5dn5di6pTNI6bqHVHbZf3BTrGwdpqsAcniUtDM1FAdU/4
-            QtB7tXNAYV+ZTDez/MMm7l1xKS6FpPbM5ZUtrcv27I51e2HAyYSsj6FNWWyvXEbU
-            aAEJAhCfDkAnvink2rBria46BR0IPWSLaVEpnusa/OED/Xw4EEgiFq3XonPTHaqG
-            iXSfeD0XauMxpLan+YesEv9SRP3ef9iX5OGNwVPpIDlkOyUztBWtf3I7tP2LCf2p
-            /GKlxeQfAlpx
-            =zWYo
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3
--- a/cluster/apps/default/huginn/env-secret.sops.yaml
+++ b/cluster/apps/default/huginn/env-secret.sops.yaml
@ -1,83 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: huginn-env
-    namespace: default
-stringData:
-    DATABASE_USERNAME: ENC[AES256_GCM,data:A6RuH7pB,iv:4z8M69BoZYgqR59yjkrGVd0AUOh6NOW5ZGFbfGpvosc=,tag:HRRKFI1+mmhMkvuG61pdaw==,type:str]
-    DATABASE_PASSWORD: ENC[AES256_GCM,data:TO7uqOTgfzgJYxN3nTEA4JOEvERxUxW76yOi6Z9VsRc=,iv:4bkvJ0vif3XCUVx3JzorINMEbqKQYBPtgtVv/OmalJY=,tag:5eaWjHnAYRvI7MHHPXBIQA==,type:str]
-    APP_SECRET_TOKEN: ENC[AES256_GCM,data:GA3wu5hzEi2r1+6wexoUvcUQthGY5k3Kd+Z2n+lzV2g=,iv:S8QuYptftRCQC/RPbmXszjj0qRNKUV6Y5D7DN8rJWdI=,tag:hUpJmiV3URY0UtOQSyeJmQ==,type:str]
-    INVITATION_CODE: ENC[AES256_GCM,data:ezN29tOtIk/OJQ==,iv:Z+AqXtnXpWt3+9/L11iqmm8sc4GTgRcTgKKTUF9IYwE=,tag:zUpOCmye9OHNawXXTqLD9Q==,type:str]
-    EMAIL_FROM_ADDRESS: ENC[AES256_GCM,data:aeK0qY4i3uIBhVuuYLedbvr38Q==,iv:ZyxfaPbKlfb07iEFSnCMY+F5AifoVL8X7HM7Dvu23Qw=,tag:e2kILALAxYxaKTNeH1MQMg==,type:str]
-    SMTP_DOMAIN: ENC[AES256_GCM,data:8AMaSW7m4bHMqwSz,iv:DaLYKjFM9oTgTii00GMVF2Rlh/P5SPqAQuY2C/XMzxk=,tag:iu0sDbNKdLrBhudyAX/7hg==,type:str]
-    SMTP_USER_NAME: ENC[AES256_GCM,data:x2/Wog==,iv:Fc+QRTP92p6HxiOAy3nBdeMKoDobqGiR75ItrzAf2Ko=,tag:IG1WGpV+cgGqHMGvKLmiGw==,type:str]
-    SMTP_PASSWORD: ENC[AES256_GCM,data:O+bq0g==,iv:xjsFSVHbAWuNUqnDT3kb1XT5s4vPE1zrYm9FmV7FU8Y=,tag:V/grs3E3Fx/5jok/lf+JZA==,type:str]
-    SMTP_SERVER: ENC[AES256_GCM,data:sLVY5gUk7oY58xJl,iv:J7gcsjoyxFiJ0n+G11Fio6joQdASwZrz9vwdoRvEjLY=,tag:4cosvns1L6/HpcjTODDNDg==,type:str]
-    SMTP_PORT: ENC[AES256_GCM,data:9ZLrpg==,iv:xIK1TtgDLYFjkbqSHOvdYKmI7GtiUmJPiWt1WUcp9RI=,tag:GG3iWUgSTCv6qbZYxwstoQ==,type:str]
-    SMTP_AUTHENTICATION: ENC[AES256_GCM,data:arhdhg==,iv:iZSNOELFLCMDyVxNPibC+SvBddDoWIxD9lA0o8LAe08=,tag:t0W13mTb5VL8Nq+9w2iX3Q==,type:str]
-    SMTP_ENABLE_STARTTLS_AUTO: ENC[AES256_GCM,data:DsRGQ8c=,iv:KwCJe1KvZlrAk1alRkgFF/OvXfYlBBbM58cbNVfqEWU=,tag:cinvnnNsUfzBpWXHsHG/IQ==,type:str]
-    SMTP_SSL: ENC[AES256_GCM,data:x6JRGMg=,iv:jeTOarB4M2OZ7iQ5U8JHJ+FzURZ2LIeWdkhpcvnUH50=,tag:qC41c2KDTuJ4Cj8E8jhNmw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2024-06-05T22:05:10Z"
-    mac: ENC[AES256_GCM,data:Rv4NKArcUuSRcQiMTjE9WXfBgbXn8U+wt67V1AZ4p9k794PKR15GW43Tint8niiglo93cicIy0+JrnEK50s7R8JQFqu5tqmOstzXevfkMuHpwFaD8kPZ0OceNaY2U5zZxQcGhQ4rV+9wC1OTvjUyer6jhsiKzdqIu2akaq6RJQI=,iv:Ulf6if09b/XMgiO3oLvms89X1WbuC+4BLu1P7QHxg50=,tag:wRgwk/rscGOrwjnzfJ5c+w==,type:str]
-    pgp:
-        - created_at: "2024-06-05T22:05:10Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovAQ/5AQCRpokmeZfbBorMK8LJfZure8BAaJlD/p59X/p3vIm8
-            kXwcCY1/6QZwUhZBRELCPnXLYO3BcNQ+SA2xGhLTgs6GyBpkl8dlpijGq+Ve5ltH
-            iJnst0CDUUTD9/Ah0iSZir3zbdI95DxVCoI0UjAlkVYmwiy3P4ItcsCVJsaFVaWy
-            iaHuGKHMAdLPgGxFI8iWu6vyVTxNbclplUEdgd9TvsXe841+yukhEtRjl9DH2OTy
-            ptN8T2645wJ18K8T62kHHCxwl2AiV+olasOQ8S8K1iQF5OEyIZqm/rmu3Nm/6PW6
-            ahl+o57OQjdjUpV795777mFu3jegUzfiy4kVhhIy9lRdaGYHSNbO8L/LmpM5s23J
-            1PCYWVMJ57AT1gWAWNsaSmVS/kueyrp2B4mYFA5BvAQ7imXxs9K0v2AZgt+MGtLv
-            2goLzZ27r2p7yEA15F9GP78aL7ifUjk1D923Vyf2+HC4KCWfoNshYSMiCQsNKeAR
-            dmFOD0mIBa60QNceJBceN9ps9cWvtPKryz3pNfsvfEGyQTJg2cf2I60Bw7CSjnFR
-            aeyQRuUS8Zev7y3h/dNF1Ve2GWywnJ/ZAhKhG/Q4jlM8FXYi/zgYtPHjV6o668W2
-            uFi3we3AhVrh+vUhTR/ZAIg7NVlLVR1MVlwK4IbJNEL5RgBwf8B6XhitQC7KewaF
-            AgwDXjg0p2IN1X8BD/9ZDBYQJsOk07krlTuxU+oF+gg9kQk3FxiM8G9kCbuhvR5u
-            9LZd7tMI/NXWEyS6WLP2QbyJiErQvyqzPqyn/zcW6c1MypRg2nTMh5OKGAfotM7d
-            Dsd1DVs2I/TzoQqX2dl92lRuAFcjmi9LlW+05+z6tLZjm5yaB4rhQLD9tdtGukMO
-            zdNPJHmbxEWFxwnfUR9JREyWFsNjV4fSgtm0/XFnCULSyqVpdWLRWERw3BLNsmzw
-            /wEOkDd/JP0C0/xuAqw3HGI2R+p1adBGwfkhENKmqgO4XgCp/pVbkfUePuXxWn/e
-            55ff0iZPC1NnLfOhAt1FFXXZUAKhSpDPl5VDriahSEqMv41JmiU2woeUiuP01mb/
-            PZlXpszjJTu56BUSUbbDOQ3FUyQKrpy5NUz+sYA7YIHvVzyWDEv4Jzztr5XvLZcn
-            VBUa4bAcl7G3eiTQjIu+QoySQIjCMzFhplvjK4iwsXUAXTclqgJUPvQ2iOhywSko
-            BHGCfxmd2MXbpO6NCa7kVCUTbm4ePIRGQJe2K3+3Xx7pd0bg+PJHS61VxE5A5kN8
-            jev+wxE+Bl3HxprrSFiB7DtwAutaF569xqtAEfMAt8cax+hfY9i5xV4LSpjOotnR
-            OQ3wD0LNlfx65bv3+YpC0xCdOyUCgXOIrHihJwbIeYl33K0Mad4Ngznu0fiRdtRo
-            AQkCEPZOW52judqMFZnDZPir6sdNdPmYhk1czq4+zGONslvtGBKVH7LXEIBILfWF
-            vKDcauOEB7q3CGw+Ulvxb7k5niGXd4wOQVyy3XsseC9d9ySTly7GqadBnDlnPNA3
-            EhMj5jiT3Bg=
-            =7JSg
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2024-06-05T22:05:10Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//dfQv+1InUlRtaU4PNYAHjy2rLWBlC3oo9+wGgbYkvs9K
-            +10hx4dP7MMExPnDnTz9DHmwUg0rcxA3BfuvN+tdOTOZ1E0mTuwP+UMBKEayB4Fm
-            kFjzUKqxqW2hDmxK9FSmQkGZlan/A/kw4+atqRTO5hcMMl+OdCw2IjEuEAAHwNsN
-            hEK19PNqyLSWQUOWq2m38KpoFGEth+ZbbryRZF1ToZxfgBxHo3tCxUYmJaF/pVAB
-            vbAOHLrbWGnoKbfo7yShod5KRrdRMKIx/9YMmgscoy0aWDwXnpc04eq1Bn3TbUPi
-            AIWfIiyMTGAlLAw0TNZIrIu1KSdWicWFbJbI5Z7R6lPfjTj74u663jSA4NyhgCCz
-            hNyCTq43VymVybJRKC6RSdTL0QG7enPfAZVFIkXlA6klnzYlQCrxfAKA9OzKQ0ie
-            TshNKl6DRC4eZoWceIqLK1GUP3pWxXwhFLDdyORLtpN9n4+F6yl8prU+ht7dmjqD
-            n3PbFq07514f/0OHWNMxKa9efOS2cb6/ZsWiCK4lVxqdfoxe47wKd1A1SVOZEfRM
-            wo2Gvm8DDdZ6a0gUQ7QdPd48VFbkS50iLrWOd97Oc41xr/fquZvyC1Iux3UjvaAO
-            p1OHEmYabJtSmPDB2YMs5t2TDZ9gIMFfWSc7bf5bd12LQpIwOMH3YlMgVcWkL57U
-            aAEJAhAh7LtGGwat1OsXyJKaTzPuOrx/kbmeSYRrqRyHvKmP5IDjKYybBGnbl1el
-            MHB3rGpe4xdxLQERuTBMLNbH8CBJYPV1wXdT070gokaXZQ01dWto+bEY6Hy+yVF8
-            Q+Wg5cFPTmqK
-            =qs2t
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.8.1
--- a/cluster/apps/default/trilium/helm-release.yaml
+++ b/cluster/apps/default/trilium/helm-release.yaml
@ -1,50 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: trilium
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/zadam/trilium
-      tag: 0.63.7
-
-    env:
-      TRILIUM_PORT: &port 8080
-
-    service:
-      main:
-        ports:
-          http:
-            port: *port
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "notes.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/trilium
-        mountPath: /home/node/trilium-data
--- a/cluster/apps/dev/forgejo-runner/reg-token.sops.yaml
+++ b/cluster/apps/dev/forgejo-runner/reg-token.sops.yaml
@ -1,71 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: forgejo-runner-token
-    namespace: dev
-stringData:
-    token: ENC[AES256_GCM,data:9jDgV6FWMe0l6AL84CxgJbYQaaHeoFp4YokCaLiemRWp0gWIchi+7w==,iv:TfxHPiwKavl03AOn3O9EUsdeTGTSfhAISG51RB3lAMg=,tag:YbJ1ZrB2GLzQNTHpev5Qog==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2024-06-14T01:48:50Z"
-    mac: ENC[AES256_GCM,data:iYIQUl8hcNDgjvusqdA7VctAiqEI9qc9rtRsvlYieQHqm0ZsnZNmp3Am0uiBtRpnKOhgMQVimfVGQSeUp92FudbCLgKGCvnaEyDN9ejCRleGOWsyAmtsQIjJoNlkfYA98als0sKdK3OXtwSejof4hTdX83zHa6oul7Yo5+BAXzg=,iv:sMrCEVEHoe0B7G92XPGzKRIA8YBkguVN/XjiyWjCZGE=,tag:UzqPr464PwfyT7yZ1DbUyQ==,type:str]
-    pgp:
-        - created_at: "2024-06-14T01:48:50Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovAQ/+NoUJHW5bR2CXAsW8RFEn44duKfCf2zvk8xvvxeTRPFpy
-            osXhr9dtph9dCO/DiD1fO04qfdpcwUARwT+iUHxhXCMhh3YxK2WX3DrccDswCpVW
-            wx/8GVhRnVgD16A/joanGyNhE11bXE+pwTN+TletEbXa3o3sktiiSKLfIAD+lfQU
-            pR66u9SkgZk0hINw3Ubjj/BF2/y6rGPKOOqZniRc4sgJ3c/PWfKjzQBUT/4WwbBx
-            BwJaAAxkmZJTL944iqaP4lSLgqE5hckmtXSMlZcRSVBLidgWqF6zf+JmXa3Bu96s
-            r4br8XO2AR9BPLhbpTl5CcbvEiIkho9s+DLQt97t0efOlv/fTs1C+9TT9W8I1HMx
-            kB8bJQtX5uWV/2FPhgzwwQmRHMU3cRlfdv5b0nQgatMRMsEPsL65RYmQvakeYjb1
-            4sMAuSmlGSHBnbN4BZX6Bakt47onELADTe+8ECx6JVNMPxltnx3Q0gaEqfWx6tRU
-            EG8YEN/veEmNl2kGwi5hH1WaQIlioKh82FwxqRMHET3U+ru4osfFh4nEyHfsz0YF
-            ckG8h5CKCUZJ+BDZXTarHsa/d7U7FxAlfw6WnhekM6hvJghs2OpHBdJCkO4gL+VH
-            e/uva4MJV+Hq32pRgj5QvH3CvVI/fPe0b9D7kdmSeVBpXrkBeqkqlWDK7CR05auF
-            AgwDXjg0p2IN1X8BD/49nRK47AEuhvSqblkXFm1f3GJ8/KK3fpiB/OUVmgrkqV6E
-            iR6SPTufcfGBJIeMZBC99TFZWllZcDGybA5aFinI6c4fOIbfZAAO0JC4IXrYqWKg
-            5kB5QBjIkXD/7pELwbgiDXU/MuYu/spICY+AwciOowk8JTXV4OU9omTatC85GDFW
-            R131Ids5n5IYIofxiHr3hCuAg8n/pFzTzn6TITtAdVgDlPCdfY+dw2Nm8s1cu4by
-            mElpoVljNv6+SX/pGGxDs46ECZ83zLwr7h49fW1OKfb2tVFq1PvFj6YclxfDcVPp
-            GwSTjy6jELEyGYAWTwyLo3WaZO/iO0UKin1sWHeoPIYgGE2De/KamAr4iqpWXYC6
-            n1EU9bso2omFgZqmPvRt+z+b8yEttOeRmvIH+pXkJgM+Hva+qHBuU1oeYVA+32hm
-            nbxwutIHMX2tA+jOcG+MTjCqTtk0/JmD37Ulr1+KvFnlvidY1Lt7oa755kkpOi/h
-            6il1hpPR0h7pJ1zJceI7GwaUvaX/RCam5pQnPeQ2INUUl3DNiMaC9mjZcqjV5Cgt
-            s4F2WJsIkkZszMM0VCBzwpXYOLkUtX5OprXohqunq+CxfE8jnbS4OPvrFxzqcn9X
-            d4a8GQSUoXT9tbGWt23F1zcrihZJKVZQ1DzL6OXVsZBK8hoi5k3ahkxKZaRNRtRm
-            AQkCEJT2L4bU/KWwQjUQBInUaWWsElNZwy3f5axWXGTpdn3ZoRjjr6cQWCM9Xs1r
-            02fGSMADhLp+RCUuEvhcp71FKjgq+h2kC+z4QS0JT17M0nnlijnXXE4M3819KpmV
-            QXawwt7Y
-            =Bh7C
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2024-06-14T01:48:50Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAp+DJIqWWFMWNaezrX85hHiuHZJjTWjnJIrQ0Bqvvv89d
-            hZENS3PbSN4gVz6NXmZ7obNcdFew2pcF8+zgZrM77DiPoKzpBrvJuy41fgSGYx3Z
-            QFE4w/FgzZ19Ad86AgvzALLNWH0bWZBZtkaPcsQBIdVp4xV9FzgnVOrE20OZgaVc
-            iucedMswCEPXHFbuBkeJZCmUNV06wQWANweZdJ/TC86PN+vKNML5dD7H6Mp6W9cK
-            97vznkxSgQALVWSkqV9KVQW3OuLn68xc2ewTy5ILDAUGrS+US9yz4EKwb6oBG8nF
-            EwEEbxV8sUHRfIp73ub4YD8IxDxdXGZFevZXggpTnZ0BcTyxHQmQ+ukKAn4W9ddI
-            VKq9oHOMgcn4IVvIsybCMoC1ieJSq+ZT+ebRQAgT9Z5f+OMndokBREhVHjBgRl7G
-            NQK/yGBsUTn04hvOW/6T+R4EC9HJCpASQBHfh+WYjBTRMl2icZburQPKZhDJOdzS
-            5YEMToYewqYhJ87/e1++vHsUE2PwAjT1R0zC0h4mpXQliyeYJ5jl3AAJR8YYtRui
-            q1fMgr1a4ZDDJk6abXObzHpEcUanxxD75GedCdmq4JOLdaI2m5c8pdpN3ecx0QbS
-            39jOJW/eAiWsnjWe2Rq9gucB0qRQmUG3338DtRh5W8JC722G20A5E6Txa40nI0fU
-            ZgEJAhA9ZwSEEY2K4+aIZb1+s6ZOQ++a6rC6ymIJRs/gmusw0rO5pfDwpq+8kQU3
-            oGF9VrmwGgSF3zO2Y9iWlPp58sEsNS54PJygBOabgD88W0SqTg490TXxtjIj6HLL
-            JACfvy57bQ==
-            =wTij
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.8.1
--- a/cluster/apps/dev/forgejo-runner/runner.yaml
+++ b/cluster/apps/dev/forgejo-runner/runner.yaml
@ -1,77 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.29.4/statefulset.json
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: forgejo-runner
-  namespace: dev
-spec:
-  serviceName: forgejo-runner
-  replicas: 5
-  revisionHistoryLimit: 0
-
-  volumeClaimTemplates:
-    - metadata:
-        name: runner-work
-      spec:
-        storageClassName: mainpool-hostpath
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 5Gi
-  
-  persistentVolumeClaimRetentionPolicy:
-    whenScaled: Delete
-    whenDeleted: Delete
-
-  selector:
-    matchLabels:
-      app: forgejo-runner
-
-  template:
-    metadata:
-      labels:
-        app: forgejo-runner
-
-    spec:
-      serviceAccountName: forgejo-runner
-
-      containers:
-        - name: runner
-          image: ghcr.io/christopherhx/gitea-actions-runner:v0.0.12
-          imagePullPolicy: Always
-          
-          env:
-            - name: ACTIONS_RUNNER_POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: ACTIONS_RUNNER_CLAIM_NAME
-              value: runner-work-$(ACTIONS_RUNNER_POD_NAME)
-            - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
-              value: "true"
-            - name: ACTIONS_RUNNER_CONTAINER_HOOKS
-              value: /home/runner/k8s/index.js
-            - name: GITEA_INSTANCE_URL
-              value: https://git.${SECRET_NEW_DOMAIN}
-            - name: GITEA_RUNNER_REGISTRATION_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: forgejo-runner-token
-                  key: token
-            - name: GITEA_RUNNER_LABELS
-              value: docker,cluster
-            - name: GITEA_RUNNER_NAME
-              value: cluster-$(ACTIONS_RUNNER_POD_NAME)
-          
-          volumeMounts:
-            - mountPath: /home/runner/_work
-              name: runner-work
-
-          resources:
-            requests:
-              cpu: "10m"
-              memory: "500Mi"
-            limits:
-              cpu: "1"
-              memory: "1Gi"
--- a/cluster/apps/dev/forgejo-runner/service-account.yaml
+++ b/cluster/apps/dev/forgejo-runner/service-account.yaml
@ -1,43 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.29.4/role.json
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: forgejo-runner
-  namespace: dev
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "create", "delete"]
-  - apiGroups: [""]
-    resources: ["pods/exec"]
-    verbs: ["get", "create"]
-  - apiGroups: [""]
-    resources: ["pods/log"]
-    verbs: ["get", "list", "watch",]
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["get", "list", "create", "delete"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list", "create", "delete"]
---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.29.4/rolebinding.json
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: forgejo-runner
-  namespace: dev
-subjects:
-  - kind: ServiceAccount
-    name: forgejo-runner
-roleRef:
-  kind: Role
-  name: forgejo-runner
-  apiGroup: rbac.authorization.k8s.io
---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.29.4/serviceaccount.json
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: forgejo-runner
-  namespace: dev
--- a/cluster/apps/dev/forgejo-runner/service.yaml
+++ b/cluster/apps/dev/forgejo-runner/service.yaml
@ -1,11 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.29.4/service.json
-kind: Service
-apiVersion: v1
-metadata:
-  name: forgejo-runner
-  namespace: dev
-spec:
-  type: ClusterIP
-  clusterIP: None
-  selector:
-    app: forgejo-runner
--- a/cluster/apps/dev/woodpecker/helm-release.yaml
+++ b/cluster/apps/dev/woodpecker/helm-release.yaml
@ -1,83 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: woodpecker
-  namespace: dev
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: woodpecker
-      version: "1.5.0"
-      sourceRef:
-        kind: HelmRepository
-        name: woodpecker-charts
-        namespace: flux-system
-
-  values:
-    agent:
-      enabled: true
-      replicaCount: 4
-
-      extraSecretNamesForEnvFrom:
-      - woodpecker
-
-      # https://github.com/woodpecker-ci/helm/issues/154
-      secrets: {}
-
-      env:
-        WOODPECKER_BACKEND: kubernetes
-        WOODPECKER_SERVER: woodpecker-server.dev.svc.cluster.local:9000
-        WOODPECKER_BACKEND_K8S_NAMESPACE: dev
-        WOODPECKER_BACKEND_K8S_STORAGE_CLASS: mainpool-hostpath
-        WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 5G
-        WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
-        WOODPECKER_BACKEND_K8S_POD_LABELS: ""
-        WOODPECKER_BACKEND_K8S_POD_ANNOTATIONS: ""
-        WOODPECKER_CONNECT_RETRY_COUNT: "1"
-
-    server:
-      enabled: true
-
-      env:
-        WOODPECKER_HOST: https://ci.${SECRET_NEW_DOMAIN}
-        WOODPECKER_BACKEND_K8S_NAMESPACE: dev
-
-      extraSecretNamesForEnvFrom:
-      - woodpecker
-
-      # https://github.com/woodpecker-ci/helm/issues/154
-      secrets: {}
-
-      persistentVolume:
-        enabled: true
-        size: 10Gi
-        mountPath: '/var/lib/woodpecker'
-        storageClass: mainpool-hostpath
-
-      prometheus:
-        podmonitor:
-          enabled: true
-          interval: 15s
-          labels:
-            release: kube-prometheus-stack
-        rules:
-          enabled: true
-          labels:
-            release: kube-prometheus-stack
-
-      ingress:
-        enabled: true
-        
-        annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-
-        hosts:
-          - host: &host ci.${SECRET_NEW_DOMAIN}
-            paths:
-              - path: /
-                pathType: Prefix
-        
-        tls:
-          - hosts:
-              - *host
--- a/cluster/apps/dev/woodpecker/secret.sops.yaml
+++ b/cluster/apps/dev/woodpecker/secret.sops.yaml
@ -1,77 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: woodpecker
-    namespace: dev
-stringData:
-    WOODPECKER_ADMIN: ENC[AES256_GCM,data:xWrKbuFDdfI5AzEOqck=,iv:YgZku7F+agkzv7omfBdusHzK7hhwhsI3t6nuDxoz/i4=,tag:z/w/iBphuCwAEaKhQU22/Q==,type:str]
-    WOODPECKER_OPEN: ENC[AES256_GCM,data:qcSw8w==,iv:weQQxyIXn13EiVQmmm1wRBh9n5JQsPQAtGUVlaeGp3M=,tag:h20PUnyRXFMRw+duA70r9A==,type:str]
-    WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:pEKvYUdSIMHevkYWua4MEmK5wZcvR83heTkPLaEoUmR/TMz1uPSUGiHMFIlvI4SPjjK2ydM2zBK2YA/Qo50Xjg==,iv:B05Sc5/f/+pTeK07ch3aNi/B3JmKB6lett8EA1l0qpA=,tag:6rGKCPI5+D72sl40iZQKPA==,type:str]
-    WOODPECKER_GITEA: ENC[AES256_GCM,data:U+Xbdg==,iv:J/HN/XNJJhI3MLqSmlOS/TQ+vK55BuMY733WegKGV5g=,tag:WshRFIEQXBqY/wPHu+EvIg==,type:str]
-    WOODPECKER_GITEA_URL: ENC[AES256_GCM,data:wzf1qN/3bkBg/hP+b9Mz0AgaPrd2NmMpAA==,iv:MVxeEf8bPdP3LAwf5KUXAsIo0eKckQ9q1PkFBcNR3oc=,tag:F2YGLkMrDw34DlG/K0QX9Q==,type:str]
-    WOODPECKER_GITEA_CLIENT: ENC[AES256_GCM,data:mbIyNWL3Cqm0Cj7Zuu47r2HWe38bwMrl0domJC0jlG4Lp+7b,iv:hbRRhqSDfU1lb43VXb2hh+Gvdc5kZfl2BFVzgb8wjaM=,tag:RQl84DALRWy6WdioNyFEAg==,type:str]
-    WOODPECKER_GITEA_SECRET: ENC[AES256_GCM,data:oQieT/aEaZTVyBkj4nVmpfUSqcJ2wwCH6B3+Gz8TcyCWYRDLZ0jtEO3XnEzQTS6k9nmSd0YoJqo=,iv:p0y+qp4592k2+UKTIeuC2l9+JdjciCkYZXGghoBK9Fo=,tag:xYSNxS2m1+L3ynpTSlQIDg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2024-05-23T00:59:04Z"
-    mac: ENC[AES256_GCM,data:YSuq3l6X98ck/VD6jFyuL/wKxpTj5m7nDcRGMov0TNVVo6nIHHwnIAoOUvP1nnDwbgszJO+DDC0Db+33mNpZ6YqUiZCdJ6iwIqeldherUIjwqBkGCZLtNZ76SlJQnMulqcFt3nMG5UiVyw5TUbLDxPEGIau1bXzCRF2j6Q51Fu4=,iv:lnJTWIqbh0l2POWkv773mUUy5sMIunvfs+ztBwus3Lk=,tag:p5KkaHWgRHDG1LVZxbxx8Q==,type:str]
-    pgp:
-        - created_at: "2024-05-23T00:59:04Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovAQ//Qi52py5A39dcBIHoz9VvM8mjUiRPbRroyURpG3KE+aT6
-            HbGyzo7OT2xTRKM+RLrV/nGBJHkdykvyTAv22M1qnH1GqeUzPKcPE9RKKppMmW07
-            EDMkyJtbXSZrO2/gRQ9XuLN9NRzniboetZPqIWx9iTuYZCUH7Vehm5i5KNHZO2ID
-            i/JkHJ4K6uJ3PwCEbxrYgE+ERj0IWCt1slythfrRuGx9zHPhYeHuNZBRGpqtjpeq
-            eMld88EZYNG8uwuuvYbArxdFTNg0RUBgi+sOYjH7ZiDfs1GKZgGZXWxq2JvpgzA9
-            vr4ssbASKY3NYcwBc9k/g8/n4QsRoYPzIwtTtOIStgfwz0COHXgBLhITZLEfs0TB
-            BzH0JJ++KZBCW+I4NUm6RDNdU2Ps80vxN2JGdRmXYvqtM8XPHSaKhZrbQkudAK7p
-            QdwFx5xJ/kIuGkepEwwLrZHhT9XTN6yGnkmb2yNiWHO2EfD3IcByNi2/DpDpvWL2
-            dQjfRGlTJC+XG3u2drSivYjfJT4JqEaukk3OJV+4Kt/zjPh46W/oQVfub/zv12cJ
-            R+Y4ynQyrlMkroYLDB4A9MzHRWxyvWxpuP59KlU4nVIKgQnQKiGLbn+xxo/TuiIV
-            KA4e9FnYKxXciOJ3egvX2gd4uv/XG/FmyRr+I+vjU4p60KYmP+tIODS8cZusTY+F
-            AgwDXjg0p2IN1X8BD/99maUVaC+WIw28AZ535oOkA/ommMGM0+y0E3pkqhGyp4fU
-            Yra0WsVMcGXVFokrs0lUMagu9htV/S6BtIERw6V3MappAm/+COVwZwuXGavNah1u
-            telD2URybiaB39DGx4tH+YSXtv5ejIj86j7xLsYqZlyPwRQikX8YxGG/lBJoVAy3
-            6l6Z3wDGNAZWMynebJGCAhTEpMO3FvSI/M5vyoupHT4MY580VDitK7379HlfSniu
-            a1sLsc8TxiC7zOkBy08Rix/7NYO1/PKXHxNX+3l7gtpncH87D58c9iLnIH1ozIst
-            CLgvV15BiiHHoHOIIvhYlZKu86fiLNgGQNx1fAS6ZWG8dLwU1+NPDcVJt36j2rcd
-            JQwCNsDloL5s2cdzIC6dtehNbK/zP1wRIL1+W3CCcZRjMPSHFrBb7Du1whhagcxI
-            /j9cV9kGpzSVyEp5xai+IAaIxasiM0Yk2pjgBC1PfoFjvCa0ZMe/L7dq/CTi5t29
-            YJBQNFhJosFuQIQk3zrwI7o41zsvH5aBAc3qL5L+57qLWB7urnzoDO1TSVCS0lBm
-            hH/e/1wNcX5/zlhe8D5Wj0Pd/culrrifLbNGTnk+pPDrPrF2qX7SIJphezurMWhl
-            bCxWpCMTKgR4hY8OXisNQkJNK23QD3Yv/d7Iyp1fgrKFARNEsUV6sbiaZtlN2NRo
-            AQkCEHhPePf6np/Pt9fcpwBhbXWxr2lX2aG2ZKXyo30KEhb4XMeDtrNfS2wCFm5G
-            hF7YAk2yjg3oO2+efBN+mU6B4j4PiCQBeoW8mg5kIT/8QBUv1DISw9x6Ogx1YWO3
-            Wl0MU3lk4hU=
-            =llh6
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2024-05-23T00:59:04Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAhVkZCOiiicIA2RcjkF6ar4pzUeHSMes3fjn5GhEGILbQ
-            mzlEJ6P2Y6yJOd7oViE0BGx3UJVj/KtWUf8UCLVOjO8R9VpP63JX5PSTMmQjq/g1
-            oyxpbuUcBXyu3O5nk9vNv22o6RzAfAm6HKn9hPh/rJjy34XRI1SS/YkjozLA7Wg0
-            X9AOYoCLKiafpL2g4HVWELr21W3gJIkzQCouz92iYpmvFuK0iBR5juzxUBIRl5R8
-            cjgyRS8GIZX9hKrZuNtmFj2+MqalEyMBYDIwNG3CBWJsO+/kQJcj//J4p9Bvo4bp
-            fBkl37GcZHMTO/4Q9XaxDUoXp16hz1UR1NB/RhzjaU+FJ+8WNyCwPqzOaQKY4XXh
-            zQQ3HOVZGjKWLdVYECDCgPxzfAytANzl0OLWfG5hMm+yz9Rg7avBe8AXIvxS50dS
-            6ory/bH0dXwYAOjRRCNYnBbovHSKM0feZlZ+TIb32gAUnyp6B9+USa+Keur8hl05
-            vTZC2Qz+KAeWx+Lnlj81KeRYCpuh8WsEAiYOWUzYXJOFHYGtj7PrftakP0UafWak
-            qseyNhn8fIe/iZdT0z9vD85ab17FwHUkfW8teJruMLKAr+26riZx6mJ8oAqgvsJ7
-            /mFY1JQ+a/k+AyHjXg3DzWEM/w+JeteD++IgYhY0g2PvfsaGn9v234zLwnetoPzU
-            aAEJAhDQvADCSGFGXCLAmDOC10eauBgqkZDCnN5AYXVOV4VUryjRT4+PWhV7w5DF
-            MZrEAMsKh0EzxhNDigzzHCGbcrKoPgFSYoJ4QHIirezN9Veq6e/lMnZTVDzxYjuL
-            +Aju/WQgu2de
-            =XUMm
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.8.1
--- a/cluster/apps/download/qbit-manage/helm-release.yaml
+++ b/cluster/apps/download/qbit-manage/helm-release.yaml
@ -1,77 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: qbit-manage
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    initContainers:
-      # this init container copies the read only config from the configmap volume, into
-      # an emptydir volume mount that the pod can write to.
-      copy-config:
-        image: alpine:3.20
-        command:
-        - /bin/sh
-        - -c
-        - "ls /tmp/config-ro
-          && cp -r /tmp/config-ro/. /tmp/config/
-          && chmod 777 /tmp/config/config.yml
-          && ls /tmp/config"
-        volumeMounts:
-        - name: config-ro
-          mountPath: /tmp/config-ro
-        - name: config
-          mountPath: /tmp/config
-
-    image:
-      repository: bobokun/qbit_manage
-      tag: "v4.1.6"
-
-    env:
-      QBT_STARTUP_DELAY: 45 # seconds
-      QBT_SCHEDULE: 720 # 720min = 12hr
-
-    service:
-      main:
-        enabled: false
-
-    persistence:
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Torrents
-        mountPath: /storage/Torrents
-
-      config:
-        enabled: true
-        type: emptyDir
-        defaultMode: 777
-        mountPath: /config
-
-      config-ro:
-        enabled: true
-        type: custom
-        mountPath: /config-ro
-        volumeSpec:
-          configMap:
-            name: qbit-manage
-            items:
-            - key: "config.yml"
-              path: "config.yml"
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
--- a/cluster/apps/download/qbittorrent/qbittorrent-secrets.sops.yaml
+++ b/cluster/apps/download/qbittorrent/qbittorrent-secrets.sops.yaml
@ -1,79 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: qbittorrent-secrets
-    namespace: download
-stringData:
-    VPN_SERVICE_PROVIDER: ENC[AES256_GCM,data:DyL4u0gl,iv:PChVYvi9ROL+2L+W1Xm/RhZqt5BBbjv1DYF/73Ab98A=,tag:zfcDHCGBvB2L0Tn14knLYw==,type:str]
-    VPN_TYPE: ENC[AES256_GCM,data:G9+rhZPNIoYW,iv:aB12VEwY9RRecmf6izYrg52EHL1N5OukbxqaOxh/Frw=,tag:7FI24DGoz/zlHtEQwSnOTg==,type:str]
-    VPN_ENDPOINT_IP: ENC[AES256_GCM,data:kYHhv1gRNgphf/ibZVM=,iv:AGE+eQyxmneJdFY+GCATDIyabFbv3vt+TP2oKffYc+8=,tag:lHNiLbLIzF6yF0ag/BM/kQ==,type:str]
-    VPN_ENDPOINT_PORT: ENC[AES256_GCM,data:q/k5pBQ=,iv:9dRVgqEFnRZ6YAMAYsgZJ7nxrVpSE/jZiD0mj/Cc1qk=,tag:LC5Qjfh9ZzcrSp4aOtda6A==,type:str]
-    WIREGUARD_PUBLIC_KEY: ENC[AES256_GCM,data:TIAuTFXuA6uuUV2ZTNsTLSX8dFe9uQhtbGW1SQJv3/oTl+9Zr3ycDJWQHP8=,iv:D33e5nPNDl8iJ8eS+Xx9gUBGAokeofonhDNTAH8CJkk=,tag:pibbEFzpti/StfPFP/mQfA==,type:str]
-    WIREGUARD_PRIVATE_KEY: ENC[AES256_GCM,data:z9zB3tiMJ7ulYkHTUrAw49+teQohLujuU5229Texg2a6qpr0lbrMomVB4+Q=,iv:3Z7+irLRZtUsARa8eELUSZlHGg0eCufqBWmSFnzZBc8=,tag:zBJllUPVJcEsrj3vgFYAmg==,type:str]
-    WIREGUARD_ADDRESSES: ENC[AES256_GCM,data:U3EWfBcTdquvD5Y=,iv:bVgQXe58b+Qyo8ITlwdkeN6VKBSX6rdL86kt3SWbwXw=,tag:pJupP5YAnV1oY3IPU8lc0Q==,type:str]
-    PUBLICIP_API: ENC[AES256_GCM,data:Xj2wWvGu,iv:RMu52TbPOY6ZbJZ31fdZ+5mriBp7Xx5E9edzyNqKy7w=,tag:Tk2Or32ewmg0wqAvK04zWg==,type:str]
-    PUBLICIP_API_TOKEN: ENC[AES256_GCM,data:gHIzaNQ+ym1q0HKh3zg=,iv:YBtXJ+tcCviAJi3HazfDg5MSRvxIegyYW+nRkW0DMWk=,tag:5tko/Mz1YTgPrx3Yxppygg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2024-06-14T19:01:52Z"
-    mac: ENC[AES256_GCM,data:pfrO+IfMsKOVDWJqjGIrN+GT7uIoUDSUTfgjL2goxwZHhlwba0jVsfWxIvFusVgIR2kGH3jUPoy1NnSNydMC78YgEN3zNkorDm9jJ7489tfyFw7zu6iEX58fcFRr1XKltPlDdQgNTFmULWuuD0GHHP7QsnYUcRBz+tYV4QheGC0=,iv:XpdrFmphX+3JtmjixRB64SPI7sDrAZD6rpk3ztKQZiE=,tag:yCl9FPVjRu0/SyiMrbsUzA==,type:str]
-    pgp:
-        - created_at: "2024-06-14T19:01:52Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovAQ//QOK5hJIQsB4QPfO6vQSRaffvCNXa/w7bcsZsIw782/2V
-            mp/D/y4cudM3TGuc7VDQa9Ldwa10dt88pLIjVfWL16uJ91chVco1NkB6elCGyW0B
-            Dn4qR4bluQ9KKNPB67aOCAItbz+DHl3gTGsnI5NUhuwxY+ArRc+ETeUfyI2FP2HI
-            I7K0M2z8Tt2Z97AiLgv09io2Dvfq1NAgZqZz1OGAJvjcZaAaJbCnG7wOi1huxDrP
-            bAZOe8x4+vBOUsYotR0TU3013kptl0307X0cSHYHI8hRd2Kuqv/Py9dBKLdfQsZ9
-            7sa0xfHcjQboeTS3iiTO05OfWiBp2dnh4Yie24olBmjBTlxQLVvUTNyEgWReHff5
-            bJkG1zwrltVI3756d6KqMgIXn/KJJy555Ef7roj9NfJPm4PpG9tvWH8mA5no1d8q
-            1+0GvoMDnqe4qjP69+Y2NfwbN5KE9kIW8TMkJgAA8qZewjantRhCw8f0R/4+SiNO
-            bTAsCKq160aeGQvuZtE5vh+3+5Ctb1fvrUDukyvAZjW00tZia1Geqmn6+Sg6C+IH
-            CXgFR3PLyr+Doz53rvVM4vD82YOV4Cvq+Zo5ppkLXFRSosHcMi70l6qA8x+If4VV
-            L+cx4nWmJaUIwgPmlbp/GyVahMhw8+sKTorVx6llQKvQxg2ufzv/n4TXPxjI2ReF
-            AgwDXjg0p2IN1X8BEACG6MlQinhjwNwsqXAkzPUL1A/kPTozBfCrI45hPz4iziGG
-            NFp4BKm8OxtNObankvvXEhaCq0lvNtvWSqSo7fO69xwSazBrocdNcf6uoe4wLQoA
-            B5ZRqXeuTmC6FuYu22OuQQJCSoBnitWqJBWcBWqpcw1oL2sKRM8/pX1QHk9UE0nE
-            UW3sAdwa2skgws5y9bwQlGoqv6/WDhW3WdpzE50AIHwqHFPqIlcYHbUph33K5ob3
-            vDm3Q8QVWDSR/jG0JUyPK3RpOnDAETir14VoTa8Cyqqhg8vE0gJgp521dcm4OU9o
-            6TtRh7jjzCOnl+Ld6mautegRNiQpVw3/GPPexiYRGuLtG2fgaE0iJhSBKtNiT7R3
-            XQUBDUgEFL2MmBzPBx6R8utPnJl01kUNmXLJoVrP07P1z4UxZ9b9oSaW90kGk5Jc
-            CfW8fxy57zb7x0Eo+mhsGcaNXKG2VpMNHbPgKE5XQRBg0oYZGzG/095ZRGBjFpgI
-            nTYJe9glkQg5y7bEWqK/PzzOHYOYEStJXqeiwD3v6ECYi88tR1zOuzJZC42nU01p
-            jI7s4bB6ifHp9OkbXQUd+hOCGw5K6O7HXvkFgxRBQidqr4slGUuKt7gWGZ0QDQuy
-            6zgoiLz2vRdXusD+sMT61U4PHHVQlVStjCv8Pn85KS6uklQeSr0exvZPsIT/DNRo
-            AQkCELOYT3DH9bRIIeC3MZw7bhEZQX4p7z5Fltxr6U8OWYmtNRq4u+A5Os9n5Lzv
-            mTAVwVt7iM/6UFVPZd4TulIsNTuTg0pHlKySCHqYz8rdu49x1oSXwvQQJ8l5qSHt
-            45FKb9Mbxa8=
-            =QPEw
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2024-06-14T19:01:52Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ/+Pho6ggnn21ZFu5YWoebJemPY7+yDc1LaqrPMYlIrUxsK
-            tt8f/BQliG1IN/f7+PZ+2t3x1QenbVMoWZsPrUDRSgUUj59UjC2elEfgoM4deECo
-            vQlVGYw3vQl7thKpwyHxaGm/bX2bYFGqIikkTpWJq2bVuOQZBbeQcaqLZsK+8+ig
-            2cqCKCgimUJHTe6C8NHB9Xs0wWBqyhK+8hp7K5LuTTNPLTAxmWsAMZheWGE4YQrl
-            iu3uZwljxfK9MG8xgxyIOu5yLL0J1PhhM5oxK6ZT37VfwjnYaR6mOKMxc8eAMSbK
-            FC6ykObzXle/cZKM9hI1vGHBS47ePHC3xud4bIEEyUoG97e8CB6x0Keky11lKJeV
-            dWiaezXCWdhNvSBOR1E6kZNuMTNO8TKEa9WbDo6rUNq0BulP1nFTsXzB0KSCIkxg
-            oKrNQGuW+/COWS3dStKv/fWUOUYlJdQ6AXe/1GHhv30hMoX40cejq8BJS0FZDMNu
-            m4DAMm7gPO1UYSXLHHXne+VsEjCdXHMYuiGF5Qa21ahKZySPJlIvRu3Sj88QQRia
-            WeW5oitTfWp/8m7/tIcOyHYJA8tYSlmMxcPiuqH5zkQ1N6m0NwJGKjSUL6VustSH
-            KGcsRcSXG5IWJLZ84V+nfRvztItCfljZXAyNbHR7ZiOXxKMtIiKNnqMmHTv+GxPU
-            aAEJAhCNWB8Fjs65uS2Z8L6e2UdXVH421SvI6XqxDlu966GySrkwmkEpRMe82+hh
-            nPCRVozTG1QYlUXkGQXgvpStkUq2O/ZrOXMmhagkvUPH1WUBIv7hH6rXUGznFSUy
-            t3b3VGLuUjFr
-            =YH9k
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.8.1
--- a/cluster/apps/download/radarr/helm-release.yaml
+++ b/cluster/apps/download/radarr/helm-release.yaml
@ -1,119 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: radarr
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/onedr0p/radarr-develop
-      tag: "5.7.0.8882"
-
-    # Metrics sidecar
-    sidecars:
-      exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.0.1
-        args:
-        - radarr
-        ports:
-        - name: metrics
-          containerPort: 9000
-        env:
-        - name: URL
-          value: "http://localhost"
-        - name: CONFIG
-          value: "/config/config.xml"
-        - name: PORT
-          value: 9000
-        - name: ENABLE_ADDITIONAL_METRICS
-          value: "true"
-        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-          value: "true"
-        volumeMounts:
-        - name: config
-          mountPath: /config
-          readOnly: true
-      
-    env:
-      TZ: America/New_York
-
-    service:
-      main:
-        labels:
-          app: radarr-service
-
-        ports:
-          http:
-            port: 7878
-
-          metrics:
-            enabled: true
-            port: 9000
-            protocol: HTTP
-
-    probes:
-      liveness:
-        enabled: false
-#        custom: true
-#        spec:
-#          httpGet:
-#            path: /ping
-#            port: 7878
-#          initialDelaySeconds: 10
-#          periodSeconds: 10
-#          timeoutSeconds: 3
-#          failureThreshold: 3
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "radarr.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/radarr
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        mountPath: /storage
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    resources:
-      requests:
-        cpu: 1m
-        memory: 350Mi
-      limits:
-        memory: 1500Mi
--- a/cluster/apps/download/sonarr/helm-release.yaml
+++ b/cluster/apps/download/sonarr/helm-release.yaml
@ -1,120 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: sonarr
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/onedr0p/sonarr-develop
-      tag: "4.0.5.1778"
-
-    # Metrics sidecar
-    sidecars:
-      exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.0.1
-        args:
-        - sonarr
-        ports:
-        - name: metrics
-          containerPort: 9000
-        env:
-        - name: URL
-          value: "http://localhost"
-        - name: CONFIG
-          value: "/config/config.xml"
-        - name: PORT
-          value: 9000
-        - name: ENABLE_ADDITIONAL_METRICS
-          value: "true"
-        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-          value: "true"
-        volumeMounts:
-        - name: config
-          mountPath: /config
-          readOnly: true
-
-    env:
-      TZ: America/New_York
-      SONARR__AUTHENTICATION_METHOD: "External"
-
-    service:
-      main:
-        labels:
-          app: sonarr-service
-
-        ports:
-          http:
-            port: 8989
-
-          metrics:
-            enabled: true
-            port: 9000
-            protocol: HTTP
-
-    probes:
-      liveness:
-        enabled: true
-        custom: true
-        spec:
-          httpGet:
-            path: /ping
-            port: 8989
-          initialDelaySeconds: 0
-          periodSeconds: 10
-          timeoutSeconds: 1
-          failureThreshold: 3
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "sonarr.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/sonarr
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        mountPath: /storage
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 350Mi
-      limits:
-        memory: 2500Mi
--- a/cluster/apps/media/jellyfin/helm-release.yaml
+++ b/cluster/apps/media/jellyfin/helm-release.yaml
@ -1,70 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: jellyfin
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: linuxserver/jellyfin
-      tag: "10.9.7"
-
-    podLabels:
-      needsAuthentik: "yes"
-
-    env:
-      PUID: 10000
-      PGID: 10000
-      TZ: America/New_York
-
-    service:
-      main:
-        ports:
-          http:
-            port: 8096
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "watch.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/jellyfin
-        mountPath: /config
-
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage/Media
-
-    resources:
-      requests:
-        cpu: 3m
-        memory: 1500Mi
-        
-      limits:
-        memory: 4000Mi
--- a/cluster/apps/media/komga/helm-release.yaml
+++ b/cluster/apps/media/komga/helm-release.yaml
@ -1,67 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: komga
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: gotson/komga
-      tag: "1.11.1"
-
-    env:
-      TZ: America/New_York
-
-    service:
-      main:
-        ports:
-          http:
-            port: 25600
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "comics.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/komga
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 1500Mi
-      limits:
-        memory: 3200Mi
--- a/cluster/apps/media/plex/helm-release.yaml
+++ b/cluster/apps/media/plex/helm-release.yaml
@ -1,86 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: plex
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-
-    image:
-      repository: lscr.io/linuxserver/plex
-      tag: "1.40.3"
-
-    env:
-      TZ: "America/New_York"
-      PUID: "1000"
-      PGID: "1000"
-      VERSION: "docker"
-
-    service:
-      main:
-        type: LoadBalancer
-
-        annotations:
-          metallb.universe.tf/loadBalancerIPs: "192.168.10.70"
-          metallb.universe.tf/allow-shared-ip: "main-ip-192.168.10.70"
-
-        ports:
-          http:
-            port: 32400
-            targetPort: 32400
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "plex.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/plex
-        mountPath: /config
-
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage/Media
-
-#      transcodes:
-#        enabled: true
-#        type: pvc
-#        accessMode: ReadWriteOnce
-#        size: 40Gi
-#        mountPath: /transcode
-
-    resources:
-      requests:
-        memory: 720Mi
-        
-      limits:
-        memory: 5000Mi
--- a/cluster/apps/monitoring/external-monitors/kustomization.yaml
+++ b/cluster/apps/monitoring/external-monitors/kustomization.yaml
@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- ./air-quality.yaml
- ./air-quality-dashboard.yaml
--- a/cluster/apps/tools/vaultwarden/helm-release.yaml
+++ b/cluster/apps/tools/vaultwarden/helm-release.yaml
@ -1,60 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vaultwarden
-  namespace: tools
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: vaultwarden/server
-      tag: "1.30.5"
-
-    service:
-      main:
-        ports:
-          http:
-            port: 80
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "bitwarden.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      data:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/vaultwarden
-        mountPath: /data
-
-    resources:
-      requests:
-        cpu: 1m
-        memory: 50Mi
-        
-      limits:
-        memory: 200Mi
--- a/cluster/bootstrap/flux/forgejo-deploy-key.sops.yaml
+++ b/cluster/bootstrap/flux/forgejo-deploy-key.sops.yaml
@ -1,76 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: forgejo-deploy-key
-    namespace: flux-system
-type: Opaque
-stringData:
-    identity: ENC[AES256_GCM,data:UvYyd3sprc1tsApJ66mY3vRoH3JWIEP4Hp8FlEugFh7NeuHL3MaI0uEqsAay8VC4wL3r2XqyEEJbwV9fYE8idtwbvjJXVSrdiACrtaZyIrYe64LgqXKvxqHOL9ysR6vuCD9euYXWy9DiHytHbuZU+6skfXFHRzuvrSH5SWn0nbyqnhYuaJ/MBYM1E6BoFYTLMAQGC8X9zcMYsN5drmvTa26CUP8awSxjTwb+iaSFqlXe08wt9tVpjDc5XldXY8tWgOFKg7jboJYIc9LgL6dboL4NtYxe3ouTWA30Pv2uhqm6CLujdMfGZ/UOj0/T7MSCYMmhq/gh7yKAQhwg4CPK+36T922jwSn2ILRNJTwn25CFOnutEkV5azZcqZglmiD+8rxFbvbtAsmEToOBJkaGSMNSra27bmeoXLZqblVlY+GcjpNxVA/7xp7nx8w3lh98YVKm+Otyl1LOUnR/arDsOlnsBuTldtfUaFC1Ty+JpGobPw51U1E8KBzMSGu+D/7q0DYV+W5o1G6PUz0iRefUj9mlvEtz8ENc49Pm,iv:Rl4ZRZ+DPiDxCvngvMeRZuOe4oWTm5nopAp/aUeAYtA=,tag:xrLL7oveJ+YKPk3Bk2tFzg==,type:str]
-    identity.pub: ENC[AES256_GCM,data:8NNDcrjVyimOwzZ7TXGkwUC7tYfWnQdKUHGjBpSmX5AHIVWMGDwf5gLs6uwUg5aWJb17vJzGHXpUd6tltA9YQWN7xM01IP1l5ZY5JcTpuOQ=,iv:67wgRB9KqP232yn0BmdvlgM7qoUfBkpG9Wirqo/hh/M=,tag:kvOv/634jO5X1EeaJ6Sy1w==,type:str]
-    known_hosts: ENC[AES256_GCM,data:kwvLA18vCmXXD4TKwzgULEmQxJ5ewudv5jyl1ybB8gck2a3EKRY5TBzQk6fqLY4H0pSxBCuYJ2d3c7rhTZ/uBlc49GJ8jNL99bIdBWOmKLxu6XPyQz6jAalDz7Hrwi1f9gZmH1Tk4huyI5Og6Wm4P5eWuJ16vdJ3ALPETWvPj6jjZXRcRRcTE5f48YSGCscMlqctH+bXAWp+u3Td1X4y+07uXXUlFY5YElcPlm0sjYJ4oLSOejCQLi2mQw8YTanBs2ddq+Ocv07BVYo4gr6lF0cMr9asbeWi0ofLJZKOifQRYaadSsJiWJXmpSCW5yoYbho/4LbiIWy1Hx7jKb+pAZjBF3Xdl8BhOQVvR2S9idte6RkLQLKLGqcKnXbT6eI0Y7B2gAG+giLGogj4HL6xowuA34uVO5jN2s2guHjkEPcLPfrGeUcmKKcZaMsyYbo5QfOa0I0FzrkLJaCVdRy3zhW6W9K3EDXlP+jnhqRr2UxiHxvP3d3KeqC635oY3Vmk5DgF2dNTy4fvps5Qj/+sB+qqFJCxXYRufCRLARe1fMdNo1OfX4ADuvbKd3gcy7ouiWzNEloM20jjeV2oIpgdFYhMGA5wkxxwqGanvidBDR759LFP2o5t7ESbFiWWkmg/5Ngu+F1H87RKb21fdjWZj9ahU9urOfK6MCtGMFZsE7k61dFaL7xVRGbUi59DKUBZ3WifuPBMo+WsafuYtecxDafAzhUp1B6dmMzEoGerIqu38EFAv5H9p/E+lUMmBxTm9rMN2GX4QOiGC5s4OYdSFHS4SHIO4/vfRGUdRtex2KAe41866d8d1KG2mA4IBvGqO3mxfnG3TNgfQlPRqFA+p6MA0RaS2oLL73+6HOTWCBUoIVamaQf3jf6lATr0if3kp58R8B1Q1uWPvc03OlbwYclKMVoaHTdbhE0Ar3swDACbmJfBDAA9ItcXVeRLsDJzbdBdCm95XRD+TrsyelUUR5RDZ/WMkX1DcUytq0uh1RGEAX+8jq3XZYWPlpPuBJY8D98r1R97kZgxLSpYfhdKrAXxYJ9nuU9pYOr1IGe4AD08nASsFW+DHhPTxDHubWLkzYDuED+lBgPm5I/A0h3PIcJfxMkNI0SRtoNwyeWyXFqSEA+Q78Gtu49txaiJaw3yfjLFhOAdMAbBg9rZ12XCgi1zPxijMmN0F/ucI2ljXsD3YHyGrSoQKlN/FGuSpV3YjLdwvSlM3fITrO6DY/HommSS4I+3Y6MulAZJxcO8kfIg3TX5Z1NOewZoWl64Uu9rzAIIjUrKG2P5hWNaYtaZcSVKuiWmOjzm9a5KAsjqaN4DMaDbSh/7kMvVnHalMZMzCdLuOOQkQcmYfVerhMGF+/BlUZRo+eq7u1kDkTXwbj+sPS6s8EBW5bQ9fmQa9brU,iv:7TNthmqlbS+duXv/7RUoM/yVEpC6AP+dkho0pRRiC00=,tag:N1rL9NlfpQD5PRTzvY6fWA==,type:str]
-    password: ENC[AES256_GCM,data:9AKaZ+INO+ZkUDCeBU/cSuoIsFm4cFpLOpDgMpzedte1RsD02QMdwg==,iv:6hiJrFeDhscz5gQIGwtSrDibbqTnhjitelw+KXZH9dI=,tag:wY6Lc39xiYPzJ/40rEhoKA==,type:str]
-    username: ENC[AES256_GCM,data:31/r,iv:Ubpk7pnkkUzyzTyOy9z9GhZJ2wQQCvu9tG3i0a2hSd0=,tag:6uj3Bticfzlxyu8T6sPLFQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2024-06-04T23:08:08Z"
-    mac: ENC[AES256_GCM,data:pJg2fZcQTAhnSDo0S91iaBXuveqHhwDiJ25T6/iuKIveMDoe5ILFIt6Jp+9uQkvAh2njmd50SZz2e+Xrn/DlvWo3jDg0F6nzByebvqRpEJmFeBH9xQkNjXuElCO6BbkPiQK/BwYM/36c7U9YyrlwNqcS//u/Gjl/0OFsYDhTWPo=,iv:/vSS3uD/luO58bEaIdIe+hxyfFfyY8sUspATmIaBLw4=,tag:6fZ0KAsDZmuNkzq3BxrvOg==,type:str]
-    pgp:
-        - created_at: "2024-06-04T23:08:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovARAAmJ0LPgMFgmlYl0p+xvkw5Q8tVSBjlVh2OUvwtWSy19pn
-            SEes/DgjHaqFjKFhy2IOHT0iijuFQzo3kn+jpDENAS48/GeaF4UgFJYIjSsTe3AI
-            0MRBqjAjFdr9qjYaul3qm1mqmco77Gfx7KEHnFMNuy+2Bm5u3C4TNnbMLlFygB1b
-            U7QNLVHOQPWECAQZ8S6+jiEPIXuRLD3BkLRhOZrcN11RuxX3jtiCPnciKtbCWuaE
-            38VYnOLpY//wNxL6NSzD4b80/0mstK51sp6jDMAskd8F7uUb+0lBphARYrnuV5MK
-            JRnk6D5cgX6xlnVVpbv3FEUuWq8rRtO0jn8mBsZpIvMO3YKoNfnRo52Ii+/tDdDt
-            ndzFHz/qnC9j/bAdMT1CSCfzPfvKWYZzvDFtEnb8asKQuqCuPY+RE+bEFDz7aLSH
-            swhUBxJYlH2gJsLOGaTzTg13qhn04oWVaI/1sOPuedyYCdLwJYQqc83prRh/p9CT
-            XJm0k8ENNqcXgw1u6gkzm9zweu0Bgn+qwSFhS/c43uYdh2k1qoGu/RrLiGv2wO0A
-            UIrsb2X6l2+QqlB5YZtmKMV8+NrL27A6ScuaSypMBaA/qgm+jNr4il4nhsyfLPjo
-            GhLS8CjVscd0GXItzkzr7dSl09xYkQ6Yo1jnXpQuzkEan+4vOUXsqt43uoEhGPSF
-            AgwDXjg0p2IN1X8BD/4nGfkU/LLLylHsMQy24j1e5wk26gSFlpm8lwuZpeBeDIr/
-            I67sWwwxdtjnUNEREYo76bLy9Nd2vEY6FWT8qlZFDSItAnQTvqvcY6LSp8X50clA
-            McxEW4DYNbmKtaRdGrYMzjU+ky1kozH9mcXtRsjD4DlUdv4Hlazp6BAF4a3jlCZw
-            HgW8y0qhWoDPvmMOsKCSXqwRYMxWPkxJTGAHzPLPZ7U+/aR+86lRGzvhuNelW87D
-            ajgALEGEtctuLKu4mbukKR7Ntx/V6mLQ8hXtESNxEYKKnvT2KkNFaJBZz15JLrOg
-            Ug03hbBEt+7ZEBZo6JKyMIlm1O3vhhllsWiFXxDmfPGB2kiNfV5lVGJuMAq17wyN
-            XFzV7TfiHWlD3N9R/HshpKY3SRNB6atMVpyxvl3eT4QI6W99WIaa+A0RZtRX9BqR
-            3AbGlRPORfR88GWo4qoGuAh0tzUskO9zsirU538hjS3euBRemqhqo5HsFGo3U42S
-            PlP8DMQ8nBbm83sUafqoCIKARgefWcdXT9LgxBqyxOgDjF4jAQ4hAIunGBwE+guA
-            DgAkKp4DVxgIu9C3LO9VoIcdjKvld+YQAJkFbXDUaOMMUHaw0pamwOYC1G02gtSd
-            IxYva37M/Fm5kjs2k8ybSQ+Ck22O0n8r/HXp8cpk+47iiHYrRkYD2w1y/IIC8dRo
-            AQkCEEf3NOSiq4CLObFXLJKRmgMRvDPmmWrrpic15JpLFuos/qp/24YdeXxTe2OI
-            pMwYIfuzeSTFckvU5PO073j2/rKLi/PFDNztmhzn/CmVSJdeJioiGXatPgP4Cvg7
-            cgIBF114+nU=
-            =G1/4
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2024-06-04T23:08:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAh52OKWUiy3Hk6wa7TpG/89s8grlUsKGfLyv4Z9GlJnvK
-            VAZ0MwEcaZcBt1ar3zm6QJKdnw+pt760qKZL3EAsShml1Fh2dEjTZ7O4M+8Vbhfg
-            2+xa35KHFNmnS4x3axkehbGdlzdA7tC9IG7tiNpy2mugPctXUmY4Ysd3i1YhkeBn
-            zgQW0cGIisw6YJ8RUua6jyGMyP9rxar56Ikybc89Xwqvr8choPCpr1ETxQLopEve
-            doQJe2zdCJg7cIG6MlAGFHEeBIE7/v1EklaQ1ybd6PPDX0NmXab5DssLj6Bn3ALo
-            jhKO46lAF9PpD8LsDKga6wDtiCgnATpVrShGIaOGs8NDpS9PW4R7wio3iqVcd1yi
-            YkhHc/fPQo77SJwqG1GQGpLhUvggoXF3jQTTCPn+Tm76J2cQh7ePh9RgT9ztcoM1
-            aCxib9d5BGDzjvLUNqBemyeSFOrjKPdKfyJ53Q4lnPbsPBFaonOKxuS85+YI7f4v
-            Fd0ks8rNX8GKXQWzYdoB36oSmTsUO2OEsT2xmB87Og2PZRgSQtNctPUV0GmDXShR
-            YkNfJbkPXzeKA0r9nZdAegZSZWkZsC1xIBftaLu7uKFfGNHIks2GmIfjTUvy+PZG
-            2rgyKwCo34b1vFBdg7xExMP95WPpTZoCUZcInV2NYiDQExUj+QBlf911n2SlaB3U
-            aAEJAhBQ+E5AePC2hCHHjZ+gOqglqD2E07tw9lL1TsvkzfpYRXv5QxjrBBNUaN9u
-            LCK2R5M8xESkVmkjWUOeCG/agxeU2SYpHRd5jnxwa2Ei3+DPSJcpjaunDPdcysid
-            jswHYh1ml8lf
-            =rmpd
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.8.1
--- a/cluster/core/kustomization.yaml
+++ b/cluster/core/kustomization.yaml
@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- ./kube-system
- ./helm-repositories.yaml
- ./cert-manager
- ./networking
- ./storage
- ./kube-replicator
--- a/cluster/core/storage/kustomization.yaml
+++ b/cluster/core/storage/kustomization.yaml
@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- ./longhorn
- ./openebs
-#- ./local-path-provisioner
--- a/cluster/core/storage/local-path-provisioner/helm.yaml
+++ b/cluster/core/storage/local-path-provisioner/helm.yaml
@ -1,82 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: local-path-provisioner
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://github.com/rancher/local-path-provisioner.git
-  ref:
-    tag: v0.0.28
---
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: local-path-provisioner
-  namespace: kube-system
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: ./deploy/chart/local-path-provisioner
-      sourceRef:
-        kind: GitRepository
-        name: local-path-provisioner
-        namespace: flux-system
-  maxHistory: 3
-  install:
-    createNamespace: true
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-  uninstall:
-    keepHistory: false
-  values:
-    helperImage:
-      repository: public.ecr.aws/docker/library/busybox
-      tag: latest
-    storageClass:
-      defaultClass: false
-    nodePathMap:
-      - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
-        paths: ["/var/lib/rancher/k3s/storage"]
-    # Note: Do not enable Flux variable substitution on this HelmRelease
-    configmap:
-      setup: |-
-        #!/bin/sh
-        while getopts "m:s:p:" opt
-        do
-            case $opt in
-                p)
-                absolutePath=$OPTARG
-                ;;
-                s)
-                sizeInBytes=$OPTARG
-                ;;
-                m)
-                volMode=$OPTARG
-                ;;
-            esac
-        done
-        mkdir -m 0777 -p ${absolutePath}
-        chmod 701 ${absolutePath}/..
-      teardown: |-
-        #!/bin/sh
-        while getopts "m:s:p:" opt
-        do
-            case $opt in
-                p)
-                absolutePath=$OPTARG
-                ;;
-                s)
-                sizeInBytes=$OPTARG
-                ;;
-                m)
-                volMode=$OPTARG
-                ;;
-            esac
-        done
-        rm -rf ${absolutePath}
--- a/cluster/secrets/orca-registry-puller.sops.yaml
+++ b/cluster/secrets/orca-registry-puller.sops.yaml
@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: orca-puller
-    namespace: default
-    annotations:
-        replicator.v1.mittwald.de/replication-allowed: "true"
-        replicator.v1.mittwald.de/replication-allowed-namespaces: '*'
-data:
-    .dockerconfigjson: ENC[AES256_GCM,data:g58h5rYAEZu2W3CYnYHgajsp7wvnFdhyRCt1qWPHbVDC+nwD1TVqTGDga1b2/RTR5tdobqZ9FdP41/1dzZeNBe2lfXOsWhQYd87EhpchFYRgsb9u7ZL32sxERhAxSg+0/AaoIYSHbuBLgRwxqnHOojS7Hcg956L+6Kgh/uiaOGsUrKRjlMAI0aN4agx+n/nU,iv:ichMs+o/3ld90VVq/UatXpAtpD6qjrEIdt0ZRwyh0Gg=,tag:lxvZy9U6sGsndz3sAy3DTQ==,type:str]
-type: kubernetes.io/dockerconfigjson
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-07-22T02:12:00Z"
-    mac: ENC[AES256_GCM,data:yFHVGwFdi2n4Ju6SqqxXDxqxZaHKROIsQZtF+AtJY52f0XJif9jP2fi05dnxULnQ+wWOq4FPwVXc/9GiCiYMItecEApS0+6C7sWxKCWzYYAiFyxSajECzNtr4/XN5yoZBJCgsgFAf42jy9Nr5xLHOAVomnNfmDheS/Pe+Uq9v9E=,iv:oFKca0hHR7ERNgJqDp3pOxzQDBlTCF9Fx1yIl3HCj2o=,tag:107vU6pOFE6Na4BO5C5tiA==,type:str]
-    pgp:
-        - created_at: "2023-07-22T02:12:00Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//QEVgmHtcIVC1afYtQMgD3Kwb+n0nZid3d/enKN64D+fJ
-            bw0xXX9tjO4sy3To49k0EDETLW5paxcNApFYL+zajxNfa+EAZfdYxQqKWraQcxvL
-            /p8bNDyzYDrecWcIdcq4RqrVEA4Ga0K6MmPM0t5l+J/PgguDJWmAxEzlmTb/CdqI
-            MpUmO0RoLHb6m0vfAkEI0LT5E/37pTdqjAq4eMT9n7zxeHr3NmJBIetahENxTKDk
-            Ymw7DhBCLZBPvHyxw/kU7hS/yhJMxmLw9mjHuzWkYVYmZQDB/TwqWsL4cVLFNAVu
-            LqZBHtl2HmaeGefhDij4SfxCj3qTi1e3z1T5wch97XmFanabNizb2oezHYou4h5k
-            AVqWuxUd13am9YhmRMQ32TPPxyAWpV4W87C/XnIrMrfePH2xy54S2ISyL5lQ1I3K
-            5/a4ZMU8hBdCw7FxX6OSAXUd5cCfelJEaRopvwgXF5ZfQjARjQ7iGCedqBQbOsZM
-            vsf5WQvYxp8uivj7gKxhn+KkqJoM225OQKlSwCQ2bj20WsZ3SrjBuK41iO88urej
-            SJLAqG42e+nUjHXn/ql794kCHHG59uRES1wWLvgQ6Siu8TxJK6B+fjOrHBMOeSiD
-            oMKyqWIvziXN5KczkIpOWFCJzHb+AGTUn/a/jCLAqAxAqkWHwwbLdMiUv1053vHS
-            XgHkdbFnWqSekHCdLXu6q1lJhY+VAyzI55Ex2HvdxzBxWQKZAD4c1fFN/88j/Fb4
-            6/IVZvSU45coCyUR3O+py0s6XvBjrJL6W4haNXMl6nVcTxHgby1JTX5vickv400=
-            =cqEc
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-07-22T02:12:00Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//RAyoi7oTNza3klhojjvUXum9iH3pOl1eqNu3qdJc9L4A
-            rGeo7Q9NTgywAaHQA4N0WPjJfFNkKSFLBxbtRpzlVCNrfontoGoFr5fGFWDh2Kfe
-            LydY3Zz9yUfcQYuGm8onVM6B6ImYUtM9ZPix808jxfiuz7rvqNmxqTdCa9o5oMHK
-            TqQ5u26MBR9cFf+W7bxKdDsqm4vEhxxWpEf5wgX+iZboA4O/J8LCVwrp6pb2pJ1q
-            nMA5ElKk/WZbsB6C20DYNXJRsdHjC1Huye6NDt1Em2XY9qcfWkQskVtohlYCdDCp
-            TciHgOF32rmN7h1i4j5Ae58AaSQmNRpKZFc192z8+dHdiSlzQEno6XXV11pezz/i
-            0ALvy2Q+r7xFA8xXyrOf7xOU/j9T8XCEAeidtQoZzEcINtg93tKItakzqacxRa2C
-            4Yj3Wic3LGSX13dZ5cpQNT6P3F6UMVAlVEEu1lHdsAjShbmuFWSFNXVo473O3Nwu
-            1imHmfb1xnqbiWS0tKdUX9jMQg+xYPrsAXQESq/9PmPJxl4tsGPzzCu+rMKf9pmF
-            XqGBASdcf9WaB4Hojm6+4UKb7pPDKAC2vLnOV9ilGv/0z+DwxU0x9swPkAYBm9M9
-            KkcaEh8petqyU2J8f91ESU3OafMo2h5OsJvzB2Zte2XIZIZV0h0y8mo6LKOJ1hzS
-            XgFiMVicO02DFcMkSJXA7ZVnV+1qfJl5vPW6Sa0vDikz/k8jYoRSv2skwZcpFIYf
-            Kr6LbZskq2QVBDS50HdpbOfyF+N8/mYuSfjKkuVH8oOq0KrZ38eJROiygPgpUYk=
-            =i9P2
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3
--- a/docs/apps/ganymede.md
+++ b/docs/apps/ganymede.md
@ -0,0 +1,7 @@
+# Ganymede
+
+## Temporal IO
+Temporal IO requires some annoying permissions in the database. It requires permission to create databases.
+```sql
+ALTER USER temporal CREATEDB;
+```
--- a/3546
+++ b/3546
--- a/kubernetes/common/apps/cert-manager/app/files/helm-release.yaml
+++ b/kubernetes/common/apps/cert-manager/app/files/helm-release.yaml
@ -8,15 +8,13 @@ spec:
  chart:
    spec:
      chart: cert-manager
-      version: v1.15.1
+      version: v1.17.1
      sourceRef:
        kind: HelmRepository
        name: jetstack-charts
        namespace: flux-system
  values:
-    installCRDs: false
-    webhook:
-      enabled: true
+    installCRDs: true
    extraArgs:
      - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
      - --dns01-recursive-nameservers-only
--- a/kubernetes/common/apps/cert-manager/app/files/helm-repository.yaml
+++ b/kubernetes/common/apps/cert-manager/app/files/helm-repository.yaml
--- a/kubernetes/common/apps/cert-manager/app/files/kustomization.yaml
+++ b/kubernetes/common/apps/cert-manager/app/files/kustomization.yaml
@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- ./env-secret.sops.yaml
+- ./helm-repository.yaml
 - ./helm-release.yaml
--- a/kubernetes/common/apps/cert-manager/app/ks.yaml
+++ b/kubernetes/common/apps/cert-manager/app/ks.yaml
@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/cert-manager/certs/files/ca/ca-cert.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/ca/ca-cert.yaml
@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ca-cert
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: cluster-ca
+  secretName: ca-cert-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: self-signed-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
--- a/kubernetes/common/apps/cert-manager/certs/files/ca/ca-issuer.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/ca/ca-issuer.yaml
@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ca-issuer
+spec:
+  ca:
+    secretName: ca-cert-secret
--- a/kubernetes/common/apps/cert-manager/certs/files/ca/kustomization.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/ca/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./self-signed-issuer.yaml
+- ./ca-cert.yaml
+- ./ca-issuer.yaml
--- a/kubernetes/common/apps/cert-manager/certs/files/ca/self-signed-issuer.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/ca/self-signed-issuer.yaml
@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: self-signed-issuer
+spec:
+  selfSigned: {}
--- a/kubernetes/common/apps/cert-manager/certs/files/cloudflare-cred.sops.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/cloudflare-cred.sops.yaml
--- a/kubernetes/common/apps/cert-manager/certs/files/kustomization.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/kustomization.yaml
@ -1,10 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- ./namespace.yaml
 - ./cloudflare-cred.sops.yaml
- ./helm-repository.yaml
- ./helm-release.yaml
 - ./letsencrypt-prod.yaml
 - ./letsencrypt-stage.yaml
- ./wildcard-cert.yaml
+- ./ca
--- a/kubernetes/common/apps/cert-manager/certs/files/letsencrypt-prod.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/letsencrypt-prod.yaml
@ -10,9 +10,6 @@ spec:
    privateKeySecretRef:
      name: letsencrypt-production
    solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
      - dns01:
          cloudflare:
            email: "${SECRET_MY_EMAIL}"
@ -22,3 +19,5 @@ spec:
        selector:
          dnsZones:
            - "${SECRET_NEW_DOMAIN}"
+            - "internal.${SECRET_NEW_DOMAIN}"
+            - "*.internal.${SECRET_NEW_DOMAIN}"
--- a/kubernetes/common/apps/cert-manager/certs/files/letsencrypt-stage.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/files/letsencrypt-stage.yaml
@ -10,9 +10,6 @@ spec:
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
      - dns01:
          cloudflare:
            email: "${SECRET_MY_EMAIL}"
--- a/kubernetes/common/apps/cert-manager/certs/ks.yaml
+++ b/kubernetes/common/apps/cert-manager/certs/ks.yaml
@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-certificates
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/certs/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: cert-manager
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/cert-manager/kustomization.yaml
+++ b/kubernetes/common/apps/cert-manager/kustomization.yaml
@ -2,5 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ./namespace.yaml
- ./woodpecker
- ./forgejo-runner
+- ./app/ks.yaml
+- ./certs/ks.yaml
--- a/kubernetes/common/apps/cert-manager/namespace.yaml
+++ b/kubernetes/common/apps/cert-manager/namespace.yaml
--- a/kubernetes/common/apps/exim/app/env-secret.sops.yaml
+++ b/kubernetes/common/apps/exim/app/env-secret.sops.yaml
--- a/kubernetes/common/apps/exim/app/helm-release.yaml
+++ b/kubernetes/common/apps/exim/app/helm-release.yaml
--- a/kubernetes/common/apps/exim/app/kustomization.yaml
+++ b/kubernetes/common/apps/exim/app/kustomization.yaml
--- a/kubernetes/common/apps/exim/ks.yaml
+++ b/kubernetes/common/apps/exim/ks.yaml
@ -0,0 +1,26 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: exim
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/exim/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/intel-gpu/files/gpu-plugin.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/gpu-plugin.yaml
@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: intel-gpu-plugin
+  namespace: intel-gpu
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: intel-device-plugins-gpu
+      version: 0.32.0
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+
+  dependsOn:
+  - name: intel-device-operator
+    namespace: intel-gpu
+
+  values:
+    name: intel-gpu-plugin
+    sharedDevNum: 6
+    nodeFeatureRule: true
--- a/kubernetes/common/apps/intel-gpu/files/helm-repos.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/helm-repos.yaml
@ -1,8 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: woodpecker-charts
+  name: intel
  namespace: flux-system
 spec:
  interval: 1m
-  url: https://woodpecker-ci.org/
+  url: https://intel.github.io/helm-charts
--- a/kubernetes/common/apps/intel-gpu/files/intel-device-plugins-operator.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/intel-device-plugins-operator.yaml
@ -0,0 +1,23 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: intel-device-operator
+  namespace: intel-gpu
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: intel-device-plugins-operator
+      version: 0.31.1
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+
+  dependsOn:
+  - name: nfd
+    namespace: kube-system
+
+  values:
+    
--- a/kubernetes/common/apps/intel-gpu/files/kustomization.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/kustomization.yaml
@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- helm-repos.yaml
+- namespace.yaml
+- intel-device-plugins-operator.yaml
+- gpu-plugin.yaml
--- a/kubernetes/common/apps/intel-gpu/files/namespace.yaml
+++ b/kubernetes/common/apps/intel-gpu/files/namespace.yaml
@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: intel-gpu
--- a/kubernetes/common/apps/intel-gpu/ks.yaml
+++ b/kubernetes/common/apps/intel-gpu/ks.yaml
@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: intel-gpu
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/intel-gpu/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+  - name: nfd
+    namespace: flux-system
+  # requires certificates for communications between plugins
+  - name: cert-manager
+    namespace: flux-system
--- a/kubernetes/common/apps/metallb/app/files/helm-release.yaml
+++ b/kubernetes/common/apps/metallb/app/files/helm-release.yaml
@ -17,11 +17,11 @@ spec:
  chart:
    spec:
      chart: metallb
-      version: 0.14.5
+      version: 0.14.9
      sourceRef:
        kind: HelmRepository
        name: metallb-charts
        namespace: flux-system
  values:
    crds:
-      enabled: false
+      enabled: true
--- a/kubernetes/common/apps/metallb/app/files/kustomization.yaml
+++ b/kubernetes/common/apps/metallb/app/files/kustomization.yaml
--- a/kubernetes/common/apps/metallb/app/ks.yaml
+++ b/kubernetes/common/apps/metallb/app/ks.yaml
@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/metallb/kustomization.yaml
+++ b/kubernetes/common/apps/metallb/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./app/ks.yaml
+- ./pool/ks.yaml
--- a/cluster/core/networking/metallb/namespace.yaml
+++ b/cluster/core/networking/metallb/namespace.yaml
--- a/kubernetes/common/apps/metallb/pool/files/kustomization.yaml
+++ b/kubernetes/common/apps/metallb/pool/files/kustomization.yaml
@ -1,6 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
- ./namespace.yaml
- ./helm-release.yaml
 - ./metallb-static-ips.yaml
--- a/kubernetes/common/apps/metallb/pool/files/metallb-static-ips.yaml
+++ b/kubernetes/common/apps/metallb/pool/files/metallb-static-ips.yaml
--- a/kubernetes/common/apps/metallb/pool/ks.yaml
+++ b/kubernetes/common/apps/metallb/pool/ks.yaml
@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb-pool
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/pool/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: metallb
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets
--- a/kubernetes/common/apps/nfd/files/helm-repos.yaml
+++ b/kubernetes/common/apps/nfd/files/helm-repos.yaml
@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: nfd-charts
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://kubernetes-sigs.github.io/node-feature-discovery/charts
--- a/kubernetes/common/apps/nfd/files/kustomization.yaml
+++ b/kubernetes/common/apps/nfd/files/kustomization.yaml
@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- helm-repos.yaml
+- nfd.yaml
--- a/kubernetes/common/apps/nfd/files/nfd.yaml
+++ b/kubernetes/common/apps/nfd/files/nfd.yaml
@ -0,0 +1,19 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfd
+  namespace: kube-system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: node-feature-discovery
+      version: 0.17.1
+      sourceRef:
+        kind: HelmRepository
+        name: nfd-charts
+        namespace: flux-system
+
+  values:
+    
--- a/kubernetes/common/apps/nfd/ks.yaml
+++ b/kubernetes/common/apps/nfd/ks.yaml
@ -0,0 +1,18 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nfd
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/nfd/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
--- a/kubernetes/common/apps/openebs/helm-release.yaml
+++ b/kubernetes/common/apps/openebs/helm-release.yaml
@ -11,7 +11,7 @@ spec:
      version: 3.10.0
      sourceRef:
        kind: HelmRepository
-        name: openebs-charts
+        name: openebs
        namespace: flux-system

  values:
--- a/kubernetes/common/apps/openebs/helm-repository.yaml
+++ b/kubernetes/common/apps/openebs/helm-repository.yaml
@ -1,17 +1,17 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: bitnami-charts
+  name: openebs
  namespace: flux-system
 spec:
  interval: 1m
-  url: https://charts.bitnami.com/bitnami
+  url: https://openebs.github.io/charts
 ---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: bjws-charts
+  name: openebs-monitoring
  namespace: flux-system
 spec:
  interval: 1m
-  url: https://bjw-s.github.io/helm-charts
+  url: https://openebs.github.io/monitoring
--- a/kubernetes/common/apps/openebs/kustomization.yaml
+++ b/kubernetes/common/apps/openebs/kustomization.yaml
@ -4,5 +4,4 @@ resources:
 - ./namespace.yaml
 - ./helm-repository.yaml
 - ./helm-release.yaml
- ./mainpool-sc.yaml
 - ./monitoring-helm-release.yaml
--- a/kubernetes/common/apps/openebs/monitoring-helm-release.yaml
+++ b/kubernetes/common/apps/openebs/monitoring-helm-release.yaml
@ -11,7 +11,7 @@ spec:
      version: 0.4.13
      sourceRef:
        kind: HelmRepository
-        name: openebs-monitoring-charts
+        name: openebs-monitoring
        namespace: flux-system

  values:
--- a/kubernetes/common/apps/openebs/namespace.yaml
+++ b/kubernetes/common/apps/openebs/namespace.yaml
--- a/kubernetes/common/apps/volsync-system/kustomization.yaml
+++ b/kubernetes/common/apps/volsync-system/kustomization.yaml
@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./snapshot-controller/ks.yaml
+- ./volsync/ks.yaml
--- a/kubernetes/common/apps/volsync-system/namespace.yaml
+++ b/kubernetes/common/apps/volsync-system/namespace.yaml
@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: volsync-system
--- a/kubernetes/common/apps/volsync-system/snapshot-controller/app/helm-release.yaml
+++ b/kubernetes/common/apps/volsync-system/snapshot-controller/app/helm-release.yaml
@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: snapshot-controller
+  namespace: volsync-system
+spec:
+  interval: 30m
+  timeout: 15m
+  chart:
+    spec:
+      chart: snapshot-controller
+      version: 4.0.1
+      sourceRef:
+        kind: HelmRepository
+        name: piraeus
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    webhook:
+      enabled: false
--- a/kubernetes/common/apps/volsync-system/snapshot-controller/app/helm-repo.yaml
+++ b/kubernetes/common/apps/volsync-system/snapshot-controller/app/helm-repo.yaml
@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: piraeus
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://piraeus.io/helm-charts/
--- a/kubernetes/common/apps/volsync-system/snapshot-controller/app/kustomization.yaml
+++ b/kubernetes/common/apps/volsync-system/snapshot-controller/app/kustomization.yaml
@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./helm-repo.yaml
+- ./helm-release.yaml
--- a/kubernetes/common/apps/volsync-system/snapshot-controller/ks.yaml
+++ b/kubernetes/common/apps/volsync-system/snapshot-controller/ks.yaml
@ -0,0 +1,19 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: snapshot-controller
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  #targetNamespace: volsync-system
+  path: ./kubernetes/common/apps/volsync-system/snapshot-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
--- a/kubernetes/common/apps/volsync-system/volsync/app/helm-release.yaml
+++ b/kubernetes/common/apps/volsync-system/volsync/app/helm-release.yaml
@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: volsync
+  namespace: volsync-system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: volsync
+      version: 0.11.0
+      sourceRef:
+        kind: HelmRepository
+        name: backube
+        namespace: flux-system
+  values:
+    manageCRDs: true
+    metrics:
+      disableAuth: true
--- a/kubernetes/common/apps/volsync-system/volsync/app/helm-repo.yaml
+++ b/kubernetes/common/apps/volsync-system/volsync/app/helm-repo.yaml
@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: backube
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://backube.github.io/helm-charts/
--- a/kubernetes/common/apps/volsync-system/volsync/app/kustomization.yaml
+++ b/kubernetes/common/apps/volsync-system/volsync/app/kustomization.yaml
@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./helm-repo.yaml
+- ./helm-release.yaml
--- a/kubernetes/common/apps/volsync-system/volsync/ks.yaml
+++ b/kubernetes/common/apps/volsync-system/volsync/ks.yaml
@ -0,0 +1,21 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: volsync
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  #targetNamespace: volsync-system
+  path: ./kubernetes/common/apps/volsync-system/volsync/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  dependsOn:
+    - name: snapshot-controller
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
--- a/kubernetes/common/bootstrap/flux/forgejo-deploy-key.sops.yaml
+++ b/kubernetes/common/bootstrap/flux/forgejo-deploy-key.sops.yaml
@ -0,0 +1,76 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: forgejo-deploy-key
+    namespace: flux-system
+type: Opaque
+stringData:
+    identity: ENC[AES256_GCM,data:XdDbrb6Hkn6DkSkFzvrFf6zvxbVMOiGkdDoZwOnu5S6Fj/Ln8jeP6QxpKYqJH62J5SaFtLQs4Eb443vURFqRRZO/s9E9bDUfToFcCvTOF+DcigO03yk81wPRnu19Zr+VJK/R3d5EYfc/aDv/52mm/MnH4ytwFdN/ped7vT6zwbgWByPGtn5lN7pgsmnFSOXJvpfHrbyWva/mAntf6tRXEMO97xs9VazH9PlVrBp6y9qEsVb/EzNFLMx6VYCj/e+/wiegb0+SAUTgHbf6WrEpEtpY+RBmJqVPrK68F9oxvXNgBcBb0LWg9p81pl8QfJHDKDtDUW08mnibT+IMqiwoECwKuArvCyI7fjd/VRBRYhcHZkJwJxIbEmIxHxs9ubCMUGvBtcuKfctQ/KwkyeuAvoPeFqOJlRfYooRxF3tLutE5XsSWEI87PdU7VrGYKnYTO+9aItAK60w/BsiJbkF1xrvBcLmOJx7p1zcDNuAuYBz9QBsSUChSzwUsrGmxebN/3XAmB/n/mcp8bka7d/vtmjSpVBruVu9olg00,iv:/39YiKJ5i6LRchiElgrClE20iJuV4SF7HB95Qi7lRdo=,tag:IQCxRRHEFg5XypwjQP7VDQ==,type:str]
+    identity.pub: ENC[AES256_GCM,data:qNJjZriw2GgTMUz85E7R91n2m0cAlqWn4mZdOUgppOMGWEwxiIma4vM3YGkx2Ltt0u78rzng1KJBLSHRXvygJiQLj72+nDYqNuoSK5EQDjk=,iv:VVIX7dU/JO7mCBa/J7gBSYvNX+xyQRtKRzx/BEe0Ny0=,tag:5VO+ib7+qKX6FFefXIGODQ==,type:str]
+    known_hosts: ENC[AES256_GCM,data:MHZdra08vS1QvRWuAvmaKhHxAkhfZuznMhWvM21X6oriI8ylfeaI2Ho2DIUmToiSKGS4wZiTNiB7lMvrPBcCO/l+f2bGXFu4YdXrTLFoV3O9K9cwQRftsqAKgq+zLP5zy11Jd8Hy5J1numqhCb/DmP9AjZflDfhANckBHuDlEJiV4xitbLaMWzmgLDS34K/h1Q+u92j2OgBD5lHiHxszlTkTsqAtSdChCDExOS2Z2nMQIIRI7+E2uGlNtaQ9AhviZlREUWAxGUr8y+fK9jN/XGnaUWEjS5SXUXwtzHnBzv+t5dCtuMLQ2eOki7qcYU5jaQ2uhMrovmaYiIdEgVMtt6VQOoo/5uQx5CHzTwrbqA5lm0hMArf1ZvuzoUf6rJvRBL3KKolWW5wjb57xQxGNgkJ03SI2AYFIVrCB/glEmKK3ZEOn0AFkWTB0rchgjuKnVLuwh5Q5e7yCLrMgQdUcRZCPt0W9CEkVirmBYN8CB6Cuh5cnzXUDrmSvJxJRXFLv/RR+IOEBzQFujMSbp4WdXqZzORx/GrbFKECGuOO0srFdeE+EJVehmvX/OWqQsV21fia3VuUm36w5TjrgsyHQBB70s59RGy6XPzPbmYD/BYk4n7D3Tq7ngukbWqO7ImP0DbUEZlW+ZqEg7S/rYGbeI3oiJs36MLJnMCyXmJ0T7znPoKTZAu4MFQY2JvOcngGTq8ua1ftbQFYVQbOBcF0nkQoe81uj4S8YBziq2rT1vFfgw26OeWlwmUCWQ0i3a7US3VzoJ9D/qU4HAOrjz8REekfwLcL6rEqwSKbDl6gerye5os/iWaXHhOQDFrntc+kodgNLpI003/AXS598Wshzl1iX1FUN5N/Ak6JMKwa4Gv3om6DYiWnHETbkl/6KKtlZFfJ/b7KDjrVGIizT/CZdYegWzg/y8uzTZ9hscO+KfUqda0hg7gWzm+puMrLrVQNvWomtB5eqo6rq1sRER555HTv7ieacha+ZOrwcv1YgpKEB5fpf1vrKrMSCUbVPG/QEDp8PacLcxHpkIiC1sFW3FcvDfw1NzJ6pP4R4FAR1IomBq15+78BM7axx0LXFq8ILYKm7tw643qj5l5HYyoTYAKjji6eLXhG03l2gGeOBa2Qzu2PgudjwoT2uZvZv3MT921na2gQ1Ri8LvhFMXyw+Gvmc3PSOxigoegvWCiDlvS3cfEg7+Dl7IlpaeADWBSWT6qE3x2eYW3V6PtUjuaM/vlJm7RunMYicIB/JMK3Biw+2fhU2RlmINtA2dMDUsaOdetC9DeYltVQPY0XYlV9Kn0OpiPf6mpq2R9ceiQ1QZ4wVBijNHvWqEr92ytodUpLZPxY7qCZ0ArPAFh36YliZg43tlB1041ukqWrWqwtRGINTvGGFW57XHvBVzR0osjwS,iv:5Zi1hQ7sQQFJMB4Ynk8QfyEDco4KrSsriFYHgho6YLU=,tag:t+Z8okFnDFCvt/uLfr06Cw==,type:str]
+    password: ENC[AES256_GCM,data:fGFEgW7D5M0if8qqfNGFUP3cUCW8Nn/XsmRf0PM21vDLjrYzuOLHJA==,iv:ds829XOqukonj7fqZWO+ErK6IDGb61nCa/lwEp0P91Y=,tag:gtudo2jdx6Totv6JcUKBEg==,type:str]
+    username: ENC[AES256_GCM,data:44LM,iv:uBoSRjeqqq0CC4BRcpp2F0ua09nOI3kaWcAJA2AOFyU=,tag:cjyOHOG+hoPHc2pVvJ8+5A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-10-18T23:02:46Z"
+    mac: ENC[AES256_GCM,data:8ESBtPXyeYNjGJ8FLmslEolr/F1gq5XBAkPuPQQxm5SnM++TwbG0E2oyy8TD7FYa62l48Rsdl+o02cwAI8KFk7zcy6588Ti7IBszmkanlDZy0VqoD4rAY4WJZ2m8m0yJEx7roM7gQm0nYJGRufRyK+g2OjVh1YQBxGymnrL2Jtg=,iv:CvFWYFxHfCH8ChQp9XA6S36vswnhUBNRkfW2ZmuIvGE=,tag:Jl+vffpyK1iYzXC1lgJT+Q==,type:str]
+    pgp:
+        - created_at: "2024-10-18T23:02:46Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ//cYkEt2KpQw/5VtIM9Ym1c2i2MCSh7y+nQdzocy4RF2Iw
+            H7jR99FHl7vFfNp4tJyfz+OGnE/3B2EqDUM2bCmrp1628iQext0ExKSAheIJygPZ
+            6lMpOEBlW51BMdYxSE+PJh+F/Q7Bpnwnf5BJDkobeoKdTrItu24krFJdMjakZmwN
+            96yGH0C80rtEHHn1A2/MpgBnCBClsJx+HRdp8Tc4552uD2mYYahJmrKzh7euqJbV
+            jgCgJtL8RxBArNsDiWCCe2QuKjMCjpstuP6xS7RDMVkB7U//IrIa3D1RqQOEYzTP
+            s9HngMBuvxj6T1iHBXPYIzqr/cHMPtXd/1wJIPpICe6dThbJruPUAyg4cO/bPy1C
+            UhxWyqLKY3i3OyI9YvlXpNEyordqgVMuA9SYnLB9M7es+MjKMcHFwG0zX4hs6Qaq
+            Bozf51pzogZcjIuEM+sl54IwQsAnAWcpNGRPNtzIKf8LwEihJhfkOCRFArbuIxzB
+            8Am7CMkcQLTqN4jckdYfSELK2pUfLgV73XMcmgtUz7/NugpdvcIpByLmSz0+04L0
+            /FYWAy5rto0c5HDkF3tV+88EuThbsuYp3zQpA7QP9eH7TdZqnvE6ouhQhmxUR/99
+            4aZHHQ7sIbtscmyU9eUo6M8pCHpk7tfkp8wWQjoo99oyxE/1qfY58BonaQ4+E/mF
+            AgwDAAAAAAAAAAABD/4v3+2tYz9hkNRN11ubHqYDkLT4PB1+2YLxXUJlYr44UWkl
+            JLv1jwGdLHuGiC/nF0YQpvEU7+yMnz8JUKU1S3vdJxFm3t1qvx57iSPCgs04/9rI
+            sQHdmpYd1ejvRM7pVUrUvXFEilWxCtwU4JnSH5IlJ+43srgC2vmlIld8/oyghwc3
+            9KeN1iFabBcnbqvxdL0WCfEipFJh0gI0WeM9N+t0MahbAm2MGIkj9ZMJ9O+XZX0P
+            MgoHvfRnkFrSYadTzXX9/gF0N8GGayY/AVgcFFJIn1HFyxoB1gHP5F5/GV8YVpWP
+            W5o/v5NKYmS22LJQNdFNCgUtjjrdmeeP5SIOCDTytJEahWtlZE4xgmIfHMlbS9fX
+            c+/pSAakV9Nz39EDUUlMAyj9uoEuE0RDaSRIIzOEvVJmCy40cczpbux4vRE55CBb
+            Kpj4IW3NnRavXucVt/gtSp+jz8IEpxGjTbgAMxtTi88XZkE2mjDjH0wXGm3Cdr8E
+            +cG01WXKZnV+Rw3EEthyg9A3Yhl2dCXa+9xeuIbM7R5Ay+VUmkcuhrPxhyCMA5OT
+            +1StnHTwC2qTJnhfrgnEsRAetu/q0wGrWVj7+/2sfLgABuqqByX9l3N3mRyLG3ZK
+            HUwPYoHis00J88P2h/5q/Fg9QB6ShsOhv3kvGpr5y3vBpQ9aAwdJcg6fdSzvqNRo
+            AQkCEJL1gcVBMb6aiPKDqR1QRH6pNh7qHm9DFem7xd+5CcgF11ONq8/vlAY86ENo
+            SRqFBVYU+00cpzF+yE589J2h3PvNLpO/u2C9J5rrmmvTp9WRnvJnzW+Y521ZPQAJ
+            XrZhPjnaDkE=
+            =P5CG
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-10-18T23:02:46Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ//W/yyW7xw283FVjRldWn0DcdYmU59yL4qxFyuWWRfFTng
+            kfGc+9DkPdCBwWKQsRzc3sm8b4hU6dRL2BTRysUwc2V6QDkjGZsR/jhpBtNjB9y3
+            FbyB3KKyCOl89ADJBY+WgBuqUlHdlqyTlPDCNIQfFngiFGNQd3LZ/6fToo8ZeA3A
+            jLQA/ZB4t0umccc1O2tyG6j5/UjtSyfUrHyMahDEZ9umwsJ/xmTxT/cHVJA3tYr6
+            WAo2ZD9qJxB8knYM175E9g+4I1ZI8xrTDuXOecxXW4zLELH0RyPxNkAwCGI2L+fH
+            7CZvgxRjmsgGXK7Y7fg4mj4YLqkKkuiReUIU4DACdkVlKHTD+rkHynnOJGqn7FYA
+            D107J94rZpXZTsbpu+Sp93fzbac4tmSZmXDcfY5aYQ9hdvX+/MkInfmcpMVoYmIm
+            2xghVNii1MUqaGtvsLgXdbIGoCH6ylQA6eCWOjBISFkGgzQQKykV7PxA7QjluY35
+            0+vJfHCHriqee6KTJVGoKfgFswZYGsD/tfV4llQLQg8gmdBblBWizEp4JhRI0ZUn
+            iC5AJ9KJAmDImS/tS1hmlFBrWOFSm5NkfwYBZ8A9lKnfX7TcY1Cx5ixeNjKOHINr
+            zyhDvVgokewAc8/ggI0yE7QS4ekaeYcp9ezycSlL5/aUaNgf4EGBI/p3yG7Xwa/U
+            aAEJAhBONeevknrsrKbLCNpr1qIfR49r22EFRNTkk9HKbrau9VZTG7eQRZN1UglG
+            btfE/KdfUcz5+YnroPF3Dc5Qpjwzzi4SYLUgOwITBvzOfxkRg2MWqlUza5C+Qjgm
+            ueCa0/OcMKbb
+            =FxSv
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1
--- a/kubernetes/common/bootstrap/flux/kustomization.yaml
+++ b/kubernetes/common/bootstrap/flux/kustomization.yaml
@ -5,7 +5,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - github.com/fluxcd/flux2/manifests/install?ref=v2.3.0
+  - github.com/fluxcd/flux2/manifests/install?ref=v2.4.0
 patches:
  # Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests
  - target:
--- a/kubernetes/common/bootstrap/flux/sops-key.sops.yaml
+++ b/kubernetes/common/bootstrap/flux/sops-key.sops.yaml
--- a/kubernetes/common/templates/volsync/b2.yaml
+++ b/kubernetes/common/templates/volsync/b2.yaml
@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/volsync.backube/replicationsource_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: "${APP}-b2"
+spec:
+  sourcePVC: "${APP}"
+  trigger:
+    schedule: "0 0 * * *"
+  restic:
+    copyMethod: "${VOLSYNC_COPYMETHOD:-Snapshot}"
+    pruneIntervalDays: 7
+    repository: "${APP}-volsync-b2-secret"
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
+    cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}"
+    cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
+    cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
+    accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
+    moverSecurityContext:
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+    retain:
+      daily: 7
--- a/kubernetes/common/templates/volsync/backup-creds.sops.yaml
+++ b/kubernetes/common/templates/volsync/backup-creds.sops.yaml
@ -0,0 +1,74 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ${APP}-volsync-b2-secret
+type: Opaque
+stringData:
+    RESTIC_REPOSITORY: ENC[AES256_GCM,data:FgWKr+aNrb73J1m89nSL0mZ15c7sqI8+Zsc6PsfNccNx2N+ZAlEsSlyl4YgOKgKO6CI0CVglkA==,iv:uLqzK+5jfF3g/2jDFf7uSXudnAydfRTI9UhQxfBwIbQ=,tag:JMnC7YnuaLqWbGgXXjmHbg==,type:str]
+    RESTIC_PASSWORD: ENC[AES256_GCM,data:KFVHg1tT6o7TvifVT/RWPdbbtSh6WoIx68eGQ8uuGRE=,iv:XRJ2iQWrcLELy+2ACcJi2IDV16L6yA7qBhk1xmU+y8c=,tag:FpkUCPMlY9+GEvBwWvfn0g==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Cl2VoK3FKQdbmYX6CZrSTZBLHMIgR/6HtQ==,iv:CsW/T56z2tn+VLzWItTmm0QfvrztBNrVUvzF3+0thbk=,tag:ADDMdb6EYFzGCNCPomOa1A==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:+LbMKuEQGY2926sq726xeRpLlM07BGAMiPeT7HLEPw==,iv:C/mEPP2xsQI72AGtKjaCEHdYAC898QbB3wUpIcomN1U=,tag:pRF2oYFythF7b/WwysEjZg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-10-17T01:29:44Z"
+    mac: ENC[AES256_GCM,data:i5zvyCogUkQiFGKvVjh5w5fzoZTBhZRlbiTq8MhWdD3UB8Bdi8gUd2RIk2cti2rpGq+iOPowpquIGVnItirES07MQ0cW9cnS7Lntp6cNerv7mi5SV8qhAvX+43qnDsvLWfxKI/UYyEc84Z0GCT66EdlWhTk/jGrTrYuF1CLaVo0=,iv:XbFwq3GBEMxBWoJNHUxD53ws5TCpCpzclpcBGzSm7Hk=,tag:Uwmfd+Kxeihm0XSRfbM27g==,type:str]
+    pgp:
+        - created_at: "2024-10-17T01:29:44Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAARAAjTJUSRR9PHp8bSVXA+TgBgV8XcqW1R0T093FTCiHJR52
+            onK9p+nJ/z+FeG26wpWpoc5VoaV5vgHY5MMX6t9EMXU99XPdnLOX3myOSF4UHo8P
+            YG8eXuOJL2IXu6Ch58Y2W0ua++heep/bLBua8oIHDqFZyuFcmo1U2NdtrpfEyGXf
+            8uQmUYuCHwigYWbKYqzCBIZwOpRV09tLF4Xwm9f8bEVCJv09k4befiJS6mlgjKHY
+            9VzUA/Zn/ZC7iD/MuMG+Rd6yEE6DMxcBahM/bmFKKJ5S4Sax0Ij31xR1jh5jZ06z
+            AdmVz9iGcjAVcC91nsZcBttXMwCNAn0WvWRcTG5SgJQ0U0LdTp4Gnjf36zDOpqOp
+            5NgTXptL1bb16EOeC/uHjq35MvPxMfUzkogkwv1P9J9Q2NaGR337N4GwTpKPNa9A
+            j3C1j4WPSs7/N2OeeUr+KDcHFCk7vvSWblQcZ0JtErA0XsSzYWwfahKHt32fomTZ
+            ncCb/RvllQfafU1tPLco1JM08wDutTEcO11roVmItaUsuxjj+X8AgLBMnH1ajg2F
+            hbJQ37C4JFUN155VQpvUG3i+jS/aHHgeEagy2AzJoaFtF5/PU7Y14RD/F7YSD26R
+            DTSq2ysghtFXlTWK3BjgoG4nc0IuFyh1x2iae2/Z8HwkDC8o7IhtItzWnqVXQtGF
+            AgwDAAAAAAAAAAABD/9r+6dhOYiAk7V6waMcArG6oQo5vffFI0b1165DmHss/KNg
+            zWX3FMccAi8OscYavxe97ESETXN77Ix2KEz2xbh2cqzgZN0qzqsgpqCR93N5gHKy
+            58ITR0+fUq8xWK/YcSDU099Kj7M8GL5rVl00a6AFpJOni21/cbBusRlSP0tBlgnO
+            VgLZqCk3/+i4P53+XSppOR0xjxaXgihPqrOaEwRk5DlJCSHWCUneGIiNJs06KV/D
+            TX0qMkABKw3ljkTzXT8uP5qG5VhrgC00r3DQPs+FZy+O9Fapsbz0z+QTSetsxCzW
+            oNQFu/0fttfbPiMHLyrOx4I04h3Q3vqM6PfJMc/70larlGmpQQf9qANzbDDW5sj8
+            5rvV9JAJ9/YGnAIlOzuEehoY3fmyfDTWwF1aGt8oHjlTKSL9KOh7vPyso/HoCzrt
+            cSpFsxrLdryrSAyb33NLVEQrDCH/WPqnChowwt+1o6OPiHy5R21r9Pt7BWRVX/AS
+            T6DEXXpLicYeJABFT8U+emXLBPo3fMOADLTnH48J4PNlCiWObDGOPBT/4e/n07wf
+            9GidDBEvCDOftOxaK2sGpkJ1ZDFZuDUaizP1Vu1NVl0IVj8r1H8a6C1y7qIEDyST
+            1MH5GrabRX6MfFOjXd0NFmXuPchXxBqwg+ZCuqeSWbVQA6TlJBHE2CY9uQTZa9Ro
+            AQkCEBBUfKvzmguNcG4GxZFeqK15yj2FYFLIS3duuUbaOAz5etAHadtB0z+cBwPt
+            Z5QwxEU/8Uf4JxzMSWyHVirPgxYGd0LWbiV1shiwm81cudQtpSOJeV4wYE1y9rZP
+            uqtwSypCwtA=
+            =Gd8M
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-10-17T01:29:44Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ/+JzeuokOO0qdLb1HmZoNiL17dYHUFGBLqs8td4uNJRhwQ
+            CafrelpvuC0KhpEqxnfmsnBgZkArpzabtQN2VipkI3+bJFnBftyzXr84UTeM8MzX
+            DYs6JNQ4+LujxAN0h1K17wTw9HL2azujfhC+IHmQog7lOg7DlKTIk1NuVfG6u/bt
+            AJYJfwj125UU+eHrAPmg1NBYbPhvqJbEC3FZ94SN8saNSRazU7OdXDHoiz3ZWisS
+            SgDgesTeS+MZev7y1TdlX9XIs4X/4xdaE/DLiwQSB/n53lghyFj8cDu/n2oIh/Uf
+            APmlQ/CPUXXn12RgIb2hZPfdBieiBSekR71iC8ZXptm14BoycTCzX/lN+rYmQbH4
+            GNY7d7IPZUO5+jXXAaTtM7rNS4VsEDILN8aTSgrxNoD1HoeB76po8fvaVNnh/FuA
+            5a8LEDeNMzYwJdWLsnUudtPCofQmFRyM78JLj47Bi0ovhWLeN651sgG8/UEubC3x
+            VMoTDUO+MR6P+YVvla9hGTp2k+3bVjW4nNT4OL7aAflYmbGAGlLmRjeLV5HmEMr3
+            ftYSdIg337Kj+Aw7mpUuFXKCn8hAbxIWjyeA/L0xEhnlygBVCeRCWyABmdztXYyg
+            1732VWWiT3wyMY6QWPL9fyVNKv0rNl+76xwzbbtiXtTVZuL2OEqlse4rXzxbbZvU
+            aAEJAhDflMnNROqHuqiqOmm85rN/Hkdunmt60dq3fz8ROhNJwD8MN1sMYcSZAe+B
+            LlP/sYD2M0Vt8aLN041GstmIfq2p5hAMMKPnmo+IxHfoGUnVi0UbNbOF2lyRm1XT
+            C0IsI8I1ccHR
+            =KrSe
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1
--- a/kubernetes/common/templates/volsync/kustomization.yaml
+++ b/kubernetes/common/templates/volsync/kustomization.yaml
@ -0,0 +1,9 @@
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./backup-creds.sops.yaml
+- ./minio-creds.sops.yaml
+- ./pvc.yaml
+- ./minio.yaml
+- ./b2.yaml
--- a/kubernetes/common/templates/volsync/minio-creds.sops.yaml
+++ b/kubernetes/common/templates/volsync/minio-creds.sops.yaml
@ -0,0 +1,74 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ${APP}-volsync-secret
+type: Opaque
+stringData:
+    RESTIC_REPOSITORY: ENC[AES256_GCM,data:JQZci/kqmOyRURSMmPBJqrzaJN0xti+BZVgbcgHC9axiq0qoNrumJHGL8+ffyd7q,iv:nG1cokfJKkmmMuwch64KxQ4/eG6OE76pypQFqUDf650=,tag:xr3DhMBsWFf2cjrPLRC1AA==,type:str]
+    RESTIC_PASSWORD: ENC[AES256_GCM,data:9IOyIGO6TCoeRserdXs6V1vnTBI2n65ChqpBECgX5Kc=,iv:GCwhW9pFAx8GwvxvR81s3+Ippt7YPYVSSVuFmKMjjdU=,tag:YytjzuPbkU+Gh0h67eS76A==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:MjXpPFMdpxyZdg/sHhp50g==,iv:r5bHD7usqnY3M1jn40CG79ed6eOiLRJaCNHDGyixJ2E=,tag:pFRELVZmsS9/HztqAuDc8g==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:6ZQwXEXSyMQGZmnf4zEVyCzeWIZKoshheIgu2WLmDeU=,iv:+ETwZmOJaDlH7CC+zNQc1NqbOfoVV+jT5zPEP2cCA0Y=,tag:l1V2LHN0RgeMSImga5zDaQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-10-17T01:29:50Z"
+    mac: ENC[AES256_GCM,data:6acDu36pbKhN3j2k4XkOU1zPlT1tGWOxwtyPKEDWLu1FMvL5Sk/xdJh8OT0MqNsgagO2bk0kvgHh3YhM3NErXalJx0HSwCUOKpHikN2OMQg02X+u2zUMRMsOblkzZWfY6XWAQD0PWxpnAV9ndVtB68gPCN5lX3Ios1n0zzqhFNk=,iv:QIlc3hiCsrQdM0LBBVqYau9QBJxVyArG1o2+3F6NgLA=,tag:wqaWWnLRthJAqfRKyl401w==,type:str]
+    pgp:
+        - created_at: "2024-10-17T01:29:50Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAARAAxDMPYaG4/Vq1UZnM2yx9QXu6D2ZlnAg3/A0xu8rbbise
+            YPc+PEIjvzXoQE7sFmcLCjPDWU23Mj5jMxq9QLt05cpt9EGMyvcGEqmYEcZFYalI
+            ROgc0rQwg57hkqA6JJRExtJUfqB5MQSS7BqkCtrUvvxZNq340l3oBzLXBmE9vS7C
+            JYqiNx8eJfv7AcVow5/R8kiFBCqI9VhOMr8VxNLcX5iA/pdL3HaQXph0LN3FvBmF
+            cPLHdooHODgR77ucYiVZT+pT5weSLJ4NND8VgAw8oN2vJ3xCu4G2xIcWq3q4u9SR
+            t3brI9qZcxN50PcJhNmRQVDLm3zXWoHTJ8/40KgTn1luRx+VaQTSzxjCe+KComdD
+            mFnma1lWIyji7JkCe5Mro5YVocInZrNACdVHmE/tl5qhSM4Qv1OBfTPYeMoW852z
+            7oKxgnfluKqkNjnWDL6yCaHvpJFDbYz3wqfa2D+Ci0t6BNp7vA0qWTxRqGzXVKc9
+            YRz1QE1AIoQ8Y93UVJe6JBODgbtZ11FuEJsIJIeB3SXF9nzP5n+jsP/G5kA5P5vj
+            IfwMTblIZ3dov0uZXhg6a3aSAGn2VcGLoxvK/I96c2VYvY9LAA4KJz9R8wDTagFg
+            +HEe3BgXkgrnNVD58NLpYOBbch+hDuqkuGh+a5qqFZ3h2yySwEWy+6bcnqG8yQWF
+            AgwDAAAAAAAAAAABEACYFHrG0SrtyiykAqyf/dMPZ35fyI7aHfr4ABZNMC71Kulu
+            haAqOYWgkhpjQvTe9PqMI6EtEJGya0iVkTtNLV0O2B1/8apXz298xxaR7S5JPpAI
+            +GKjugAB9atRnf69FkN58PNcL8TJpNsrR3CiOX6Bbjc5DCkQMpDIgny9mO3mwlHa
+            xvaS9o3DYgo9UvKWptvpiJKC8ve47eX/cQmUZjPMpUGUYpUGSeK8oJGQl4hgAnC2
+            pXz89ZTM0rTp/YW123wO4OPvJ4lMpitzG73Gbmd1vUOk+5IpVaI+q6a0VYXVeAEU
+            ol+l84h5jhNSR38sYfTD9fCzXvK/49sBhf7kWG+pH6dnmpO/hqXMXOREXlnkC10m
+            uU5LieRX0otYgiPs9pMCSLRSa1my8UsHNdM6eVMsn0+Ji7UFoIYAnq79cdVeKDHN
+            Q5YNF+i1cKPnNarIU4XOqVny7t2YE7B01j3PDYbrp3W5yMAoAF4j9uQ8h7XEX7y4
+            SlKO8HYcuYTIWcTm+L8FTZMVrQS2cn9HnyZfCxHHD4vbmxAO6hmWodAJv1rFBLYj
+            yO/4L/MyEVCSnE94vUudR79oQ+6qJOWZypfCPiqn2HVDiHvmbf/Iwc1v+v/GZkFX
+            6wTqkJ8oi4nGuFU0AfYJG6ENEEmz1dpvnXLIy9vDWq98vrBPFrqOnrTgd6eQQNRo
+            AQkCEHVlPi7Sn/dhXhcIgGiQzV45MPoo47FSQ+AjjPh6tzIZPj2dcDDdM7TBYGsF
+            KEknmv9JOX+Web9E9O+n9uJY6RM5zWsf1JNJ5EGMYgQ54wwgoO3DRs6ikg1Bfozb
+            rXV9iM2Pens=
+            =jPuh
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-10-17T01:29:50Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ/9EfpjOanGUTYg4qCnwmykiGcEqVmGSj9+aJ4PdrPcLuqe
+            IiZavUGQXhh9kviR8oRRXzwpQeyWQmYNdeKjL1f1sj635I0e+quSh5Y21UsBjYHm
+            EP2JnmTlDAWYL02FKrZ9OqSfeoI2tdObWjBzC5cDnUiIbJ40abuFcI3wtNqx8MZf
+            x4V9j17FYejDIRIShSzm95TfVbcadX6BAsDHO7zjpgi7jtpeYtBa/7/s+dHyiPoJ
+            ZWQ2HD4fzRtfiah1sJl9GrvWK+BAyRkbO2C3Ob0nNTWjujWYQkJYhQb4f5DYbMka
+            B481UqDcj1hssTU1w7TmaYl2s8QxwSdfa1yIm4GaRofmKW67MMIynksFRPz40p+5
+            DWAcDoRshY8yi+EvSMUA0h2pstGo0kV1zqYwkDN1Gl2/D5zn2SnkbKuytLAzjUTe
+            sxWf1TTqXF4bvfVGIo+It6saIfMOKtUeIxnwbc+6lb95Ah9YEaMY5RtAmEgMF6m7
+            +c4+NyGCJ/A2E26pLDOWf1TwbomlqwR3ertq744hLgOja23DJgMhZDfSWjjwVj79
+            vDj9E5/3HRNOrC/J0HTaqq6wxh5LD8jY/INNi3+BDWWiQ3YJ4c7kjwgrwp297PiS
+            QtRQel3QIlrdpQSydDs3mhWs1RMPiCzkjatq0eQVvl/zkxlw1qpbslPEpOR8JI3U
+            aAEJAhDMV7aqU+viKvHsxGgEEDyfd2Mj1/FQtE5OA5+9GL/Y42AyV4fFct2bdhTO
+            +e1Ry5EE7Y8PMK9/HAjn78XY4hkqf8wIPaooL8Poq6Lq9Ylt+KVq80IFYgS8LXOS
+            nYrbk7kpGaUp
+            =n3YG
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1
--- a/kubernetes/common/templates/volsync/minio.yaml
+++ b/kubernetes/common/templates/volsync/minio.yaml
@ -0,0 +1,51 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/volsync.backube/replicationsource_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: "${APP}"
+spec:
+  sourcePVC: "${APP}"
+  trigger:
+    schedule: "0 * * * *"
+  restic:
+    copyMethod: "${VOLSYNC_COPYMETHOD:-Snapshot}"
+    pruneIntervalDays: 7
+    repository: "${APP}-volsync-secret"
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
+    cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}"
+    cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
+    cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
+    accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
+    moverSecurityContext:
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+    retain:
+      hourly: 24
+      daily: 7
+      weekly: 5
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/volsync.backube/replicationdestination_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: "${APP}-dst"
+spec:
+  trigger:
+    manual: restore-once
+  restic:
+    repository: "${APP}-volsync-secret"
+    copyMethod: Snapshot # must be Snapshot
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
+    cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
+    cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
+    cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-8Gi}"
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
+    accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
+    capacity: "${VOLSYNC_CAPACITY}"
+    # moverSecurityContext:
+      # runAsUser: 10000
+      # runAsGroup: 10000
+      # fsGroup: 10000
--- a/kubernetes/common/templates/volsync/pvc.yaml
+++ b/kubernetes/common/templates/volsync/pvc.yaml
@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: "${APP}"
+spec:
+  accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: "${APP}-dst"
+  resources:
+    requests:
+      storage: "${VOLSYNC_CAPACITY}"
+  storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
--- a/kubernetes/main/apps/authentik/app/authentik-secrets.sops.yaml
+++ b/kubernetes/main/apps/authentik/app/authentik-secrets.sops.yaml
--- a/kubernetes/main/apps/authentik/app/dashboard.yaml
+++ b/kubernetes/main/apps/authentik/app/dashboard.yaml
--- a/kubernetes/main/apps/authentik/app/helm-release.yaml
+++ b/kubernetes/main/apps/authentik/app/helm-release.yaml
@ -1,3 +1,4 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@ -10,18 +11,21 @@ spec:
  chart:
    spec:
      chart: authentik
-      version: 2024.6.0
+      version: 2024.12.3
      sourceRef:
        kind: HelmRepository
        name: authentik-charts
        namespace: flux-system
+  dependsOn:
+  - name: redis
+    namespace: database
  values:
    global:
      env:
        - name: AUTHENTIK_HOST
-          value: &host "auth.${SECRET_NEW_DOMAIN}"
+          value: http://authentik-server.authentik.svc
        - name: AUTHENTIK_HOST_BROWSER
-          value: *host
+          value: "https://auth.${SECRET_NEW_DOMAIN}"
        - name: AUTHENTIK_SECRET_KEY
          valueFrom:
            secretKeyRef:
@ -51,7 +55,7 @@ spec:
          cert-manager.io/cluster-issuer: letsencrypt-production
          traefik.ingress.kubernetes.io/router.entrypoints: websecure
        hosts:
-          - *host
+          - &host "auth.${SECRET_NEW_DOMAIN}"
        paths:
          - /
        pathType: Prefix
@ -84,7 +88,7 @@ spec:
        enabled: true
        environment: "k3s"
      postgresql:
-        host: "postgresql.database"
+        host: "postgres16-rw.database.svc"
        name: "authentik" # database name
        user: "authentik"
      redis:
--- a/kubernetes/main/apps/authentik/app/helm-repository.yaml
+++ b/kubernetes/main/apps/authentik/app/helm-repository.yaml
--- a/kubernetes/main/apps/authentik/app/kustomization.yaml
+++ b/kubernetes/main/apps/authentik/app/kustomization.yaml
--- a/kubernetes/main/apps/authentik/app/namespace.yaml
+++ b/kubernetes/main/apps/authentik/app/namespace.yaml
--- a/kubernetes/main/apps/authentik/app/network_policy.yaml
+++ b/kubernetes/main/apps/authentik/app/network_policy.yaml
--- a/Show more
+++ b/Show more