fix(#537): use 8443 instead of 443 for the external ingress

This reverts commit a4b96ea4e8.

.github/renovate.json5

@@ -15,17 +15,17 @@
   //"schedule": ["on saturday"],
   "flux": {
     "fileMatch": [
-      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
     ]
   },
   "helm-values": {
     "fileMatch": [
-      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
     ]
   },
   "kubernetes": {
     "fileMatch": [
-      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
     ]
   },
   "kustomize": {

.taskfiles/Flux/Taskfile.yaml

@@ -3,20 +3,20 @@
 version: "3"
 
 vars:
-  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/sops-key.sops.yaml"
-  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTER_DIR}}/bootstrap/flux/forgejo-deploy-key.sops.yaml"
+  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/sops-key.sops.yaml"
+  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/forgejo-deploy-key.sops.yaml"
 
 tasks:
   bootstrap:
     desc: Bootstrap Flux into a Kubernetes cluster
     cmds:
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/bootstrap/flux
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/common/bootstrap/flux
       - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --server-side --filename -
       - sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --server-side --filename -
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/flux/config
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/{{.CLUSTER}}/flux/config
     preconditions:
       - { msg: "Missing cluster sops key", sh: "gpg -K 687802D4DFD8AA82EA55666CF7DADAC782D7663D" }
 
   reconcile:
-    desc: Force update Flux to pull in changes from your Git repository
+    desc: Force update Flux to pull in changes from the Git repository
     cmd: flux reconcile --namespace flux-system kustomization cluster --with-source

Taskfile.yaml

@@ -3,7 +3,7 @@
 version: "3"
 
 vars:
-  CLUSTER_DIR: "{{.ROOT_DIR}}/cluster"
+  CLUSTERS_DIR: "{{.ROOT_DIR}}/kubernetes"
 
 includes:
   flux: .taskfiles/Flux/Taskfile.yaml
@@ -11,4 +11,8 @@ includes:
 tasks:
   execPostgres:
     desc: Exec into the postgres pod as the postgres user
-    cmd: kubectl -n database exec -it postgresql-0 -- psql -d postgres -U postgres
+    cmd: kubectl -n database exec -it postgresql-0 -- psql -d postgres -U postgres
+
+  execMysql:
+    desc: Exec into the mysql pod as the mysql user
+    cmd: kubectl -n database exec -it mysql-0 -- mysql -u root -p

cluster/apps/database/postgresql/pgsql-pv.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: postgresql-pv
-  namespace: database
-spec:
-  storageClassName: hostpath
-  persistentVolumeReclaimPolicy: Retain
-  capacity:
-    storage: 12Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: "/mnt/MainPool/Kubernetes/databases/postgresql"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: postgresql-pv-claim
-  namespace: database
-spec:
-  storageClassName: hostpath
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

cluster/apps/database/postgresql/pgsql.sops.yaml

@@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: pgsql-secrets
-    namespace: database
-stringData:
-    adminPassword: ENC[AES256_GCM,data:gJ7rl2V/VlbIIRvRHcwMaZKN87t5n8bVWZCj/tRv8Uw=,iv:b/5eEnOrHzJrtnO+E2IGwJLHy2AdJQwv9WfUR5fUHY4=,tag:nTtaDNHVfYpChQX9UWwdKA==,type:str]
-    userPassword: ENC[AES256_GCM,data:gR7q508lUaRDRJ/z5lH99JLJSS9zWfg0O+TAm2B9uvo=,iv:9DDQxwd/BGtLQDacAH/crfT+qU4Pn5sGkWuEtmMprUI=,tag:tK3WoUd7729LQDVqU7pckQ==,type:str]
-    replicationPassword: ENC[AES256_GCM,data:BSA5IfYhhvN445yp2i3BI5zlIXgdj+LejCPzvlTMnVo=,iv:Qku2NAQPLxt+NUnk2dSx1+WAoyx3aEuA3+piU2mubYk=,tag:MnI+atK6VLZUc3eGS1OE1w==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-10-22T16:25:15Z"
-    mac: ENC[AES256_GCM,data:uWVPfKwPpR212js7f2RnCzEsMnxk2JpGPcf2L5i4gJCddJCrRJkdhjWGyVVpp/ociP3JLRTI95+WSEUH0KkPZpY1ptQevCVsUemRytOCtBlR0yR4qsBwEisSu8m4B5dbAYsqlXAndrBNL2WGB7uBv+ILgNxkhlN58unseSWJBDM=,iv:e7QyZSlhpyQ+A8OmV4p1848itIUxyam6CJOI9/N7DDY=,tag:N28mfrAjUTTYkly1hu0OhA==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:35:15Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//aQdUERyq3G7V29F5rpY6LdDgo8+hqrrZvdI3JnON0VUM
-            Tj3AAYg+xvYh8aPQywF9fJvn6qNw8fqrb2GiuuNTa9ZPCFsD+WXbuYHmQ9z6tAtV
-            opXe3QLNBuo9zEtUfGPbaCp8EH7f1TxQsTJoe9iE/1B2S69cHNUdgXZtfQyhpmlG
-            iyAk/G04kPazweIuFNjOYaN/12J/s2Cf5AZUeROkMxg8/GTPO68LeEBz9v4vl/1z
-            JlxmZyXR/9IeoBlO63asDrR85fcvSDb31K4qE3WVkag20bXClv1lehLVKO4bxA/F
-            lW1tXDR3odC9Ozme884Znd05L0NWkzYKYRta198IV6JuSCeMdjTscGGlMM9wqqKz
-            SZgs81FHXT16YCVupfI22CqMiD0EzQXrGEtJ4NqaBvhZu+MDxszNRzIl73b0HANc
-            8JQqQqOJh7ltrWnf39Xlv73yVC/pYbaV1LWGnMfqWvOcksa9QjOH9Ysfj/RxdaMw
-            VQhydU+21+xeuEQBL7OsiJQUzgJjFREnTRPXcorCtWxocCn5zwdct1SFchFzCOTp
-            H0ubpD+MP4RTWxuYbZRhE5ty6GJU9liRH7dUJtVaQiv8V+G1DungTqq36AbbnHzd
-            9cy+4cM3wZx2VYElL7DBom8nqqm7Xhffr0UaaY8VFuV5bBry3BmM5rOr8vDYqf7U
-            aAEJAhC/4yiBMuhEB+fwXIq/dBjMzW+p8SotK2QK03yaTFQchnBDknwVdqcKQxIZ
-            di3kupnjB+KllWOZhl121tT9L35ymL53BUu1FKCTFdIS2wXxy6UlIS98n0bvWJYN
-            c5WTfk81xmbT
-            =UE14
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:35:15Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ/9G2JDsJw6YJMjstWPrv07tnU0ErWZx5WGcNUGhw6T5tOJ
-            kXCAuaZax8NxoTtZnQ9Cd+WgJr7R0FuVPEPTc4G2RsfntSZq5rBgCpT0fgwyASFX
-            64b6YTbLcCL+G6sg/FwIi9SRqqCsaljATjoU685vrjaxYYfAdhyUoM3qSNjMMaMl
-            zVjn0kbWrQn4GqfuRMqcr+zCIQdHNTTJ12+c6UUo/zJp4zzjA68Yur9aiw1iHtR1
-            rYCPHX2/ZmQjADTHXqwpuMdb5j0VDcd5JcZabdcJkhn/6MRJiN+XryZN/Neq9UbF
-            5WrMaZz5v0iRnMUCr8HMw29P0ttu5Sma+RyCOZuWlpsXj+C84pJ8CjBbFhzSJzGP
-            cKI8Syn0CPLN3X6vKs+LJXEHg1jxJ9kuN+RgW+SQRctUX3A0JtFg2tWplkptNtLl
-            hN5rW+fWxk7BV9dP7wouwVJiKcW3Y/OMCF5H8YHwL/KVHvANBwNM+nmFPrHaqN2s
-            0RghznmZMVG+9IYedSM6d8ZJLnO/QsNTE0QTGM/3dmBAn9jcndCLTgcgThAtvcmw
-            lFJYaMN3W455Cccaif93xnb44yn47actgEuM6GOuP15GGJaHD2iBQ2atHcaQhNQR
-            mxhIIouu+Kaa6g34MA/VGDNoN0eNYI5RZIUSSBl7bgaOXs9/3j1Uvap9yesCaOTU
-            aAEJAhDDqjX7RUazeEByAiKjv5TxpQzsi8gR4zyrhf6tTx34jHzQNoVjYEtLMEVl
-            ZlAJ06RoxOj8O6+8RGYd/ZUE+TQPQ4jx+PgWrZPUQx8TSxevuduw5XZ1lKytUSCZ
-            GFDjOxp0lMGV
-            =LHSB
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.8.0

cluster/apps/default/cdn/helm-release.yaml

@@ -1,65 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: nginx-cdn
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: oci.seedno.de/seednode/nginx
-      tag: latest
-
-    args:
-    - -c
-    - /config/nginx.conf
-
-    service:
-      main:
-        ports:
-          http:
-            port: 6544
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "cdn.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            
-    persistence:
-      data:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/cdn/data
-        readOnly: true
-        mountPath: /data
-      config:
-        enabled: true
-        type: configMap
-        name: nginx-cdn-configmap
-
-    resources:
-      requests:
-        cpu: 1m

cluster/apps/default/fireflyiii/env-secret.sops.yaml

@@ -1,123 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: firefly-env-secret
-    namespace: default
-stringData:
-    ALLOW_WEBHOOKS: ENC[AES256_GCM,data:qdisaso=,iv:rT7WID3kRMPEGmWJepNmrj1tutxsT5Arw5AN9oVFoXE=,tag:jkYkRaGLEB3iBEjEVIAVCg==,type:str]
-    APP_DEBUG: ENC[AES256_GCM,data:Jyo8QmI=,iv:Gq2Ldh+H+oturcglphQb7ERHX8jD/5j01qtEJDRPAn4=,tag:m96oouPtT9J5zQHPs2QaVw==,type:str]
-    APP_ENV: ENC[AES256_GCM,data:19kiyms=,iv:KLwsQOsDvg/7f18FEsg+e2rgnXSbsxwSNbItmgLGy8M=,tag:mUX/UeXFi0eeZ68bsJpq8Q==,type:str]
-    APP_KEY: ENC[AES256_GCM,data:PI70apm/K8/1el4lW3KR6wLgBDgj0YAQ6KwngqxSv2Y=,iv:S7xrpAeY3wM3moCL/i5R045yst7Zz8ahXbLyNfvacZ0=,tag:hOXR1kKdxVoQxZyjZu+ajg==,type:str]
-    APP_LOG_LEVEL: ENC[AES256_GCM,data:ZwJTcn8y,iv:wk+jX9Zp1TTn1EHv0OLgt+0alm5JBHdWcEtIn1dTI6o=,tag:gR1Ls7dFGyt4hKGiwLU5wQ==,type:str]
-    APP_NAME: ENC[AES256_GCM,data:yfd2OQk6NvjKcA==,iv:jLL2Dt0YlWODwCKSnqR1yuSWJsKySQNZY/pEfxi5jJM=,tag:XoHlMsMuRG6S4Wm0PVjtBA==,type:str]
-    APP_URL: ENC[AES256_GCM,data:+bveNLjanPPMkoMrDO4KsA==,iv:xQWHzRKBMBumi2bFCUKoWLRiuNNV3HQLv1WGEiZ6RRg=,tag:h9IF4XwIK2P8sB4V1Su5Ug==,type:str]
-    AUDIT_LOG_LEVEL: ENC[AES256_GCM,data:OA7nqw==,iv:9BcE5Bf9QDf3kzA4Xbf0XkbkFjGAv6id7vdSI12wRm8=,tag:QN7o1eEbGSTvrGGBzzouSg==,type:str]
-    AUTHENTICATION_GUARD: ENC[AES256_GCM,data:wsQZSzAP0hE4o9DAwNtwSEM=,iv:U6513HaOzDDlCehFuSs8ey0KFWup9S8tAYiSX89EyNg=,tag:i5q9W6uglFZ9bKc2f4QPvQ==,type:str]
-    AUTHENTICATION_GUARD_HEADER: ENC[AES256_GCM,data:0GfWuR+1RhLsED/T5iEDYV3tkmx2wA==,iv:x/6xxFAv5+J8e55a9JnIZ49v/FJRL066rSf2bBxhHHU=,tag:hAhhsDDMeM29b8iMx3xwqA==,type:str]
-    BROADCAST_DRIVER: ENC[AES256_GCM,data:2iYs,iv:5oeuA+08uDRSJyLwwkdFC2q4LZKNs2OSoQjsnIX0aYY=,tag:m2ybfxtY98j39sBnax7IVA==,type:str]
-    CACHE_DRIVER: ENC[AES256_GCM,data:2lv9YGE=,iv:xuk6ih2wApMuWJIlm9clwYCnMR973lG7EOHDUZtlDvc=,tag:cdEh6/zAZ+7IcQMvHojgXQ==,type:str]
-    CACHE_PREFIX: ENC[AES256_GCM,data:OS/jr/Qo5A==,iv:wLeRO4uAo+HHB/1tK3m4MEeefmMRTc0+aTYuUGGrYyg=,tag:8cv8oxfwMkTeZ8+JsCoWVA==,type:str]
-    COOKIE_PATH: ENC[AES256_GCM,data:pQ==,iv:5QR02hlvi9n/gl6LLdSR2HSybzohlCisq51+QzUJv1k=,tag:hpwUD0ctU0pX7S+V6UNz/w==,type:str]
-    COOKIE_SAMESITE: ENC[AES256_GCM,data:HNlS,iv:f/kbAOVyWFEH6yKr+N3zM+9tNQQCpQA7/iKAg8ejFdk=,tag:g1rmzfnWSYIzxFJA0l/uUA==,type:str]
-    COOKIE_SECURE: ENC[AES256_GCM,data:fxJkE2M=,iv:0JXgzyybtMtIgxh6VSwAS5oehpVMFkLKvJFOBDcwhVM=,tag:RAhNUuJKOho6bvXJyNT6cg==,type:str]
-    DB_CONNECTION: ENC[AES256_GCM,data:Y7b+kts=,iv:1vZBNoO4O0Z8LPH3ZPSDpx49jtbQOEl6+BitbKyat4A=,tag:eOUpSlZGZKM0LPHdZMjb+Q==,type:str]
-    DB_DATABASE: ENC[AES256_GCM,data:1rRtAXfMaA==,iv:vErtoqpi1KsHVL0nQ6x2MVNe6JCKxjCxivXXjtUT6Uw=,tag:AYxHWADlGq4NHbcVx8QcHg==,type:str]
-    DB_HOST: ENC[AES256_GCM,data:sjYDEi8q4bAgpdnxin6yDBtNJw==,iv:6rxqBNvXSsE+2oxWbwiztmlxtKP8C0aeYMdmuGTyF/g=,tag:lRB3EwV4vwa64CI3xqi2lQ==,type:str]
-    DB_PASSWORD: ENC[AES256_GCM,data:PeysFTbHeZHTnkn0XlJ58AMZbS3EzANUQ8UnhQXRIoU=,iv:NM8c3dx8TlQkPVJGECnyg2L6JM7CQwlx/LQ59x15dY0=,tag:xuLow/AXp+yOUm4hO2527g==,type:str]
-    DB_PORT: ENC[AES256_GCM,data:yXp98w==,iv:a/jbQI7/3QMKaSJRiZGhdYBzdIzyNA0M3sL83bD/1is=,tag:PxauXvxyQlNo8EaFMzdjKg==,type:str]
-    DB_USERNAME: ENC[AES256_GCM,data:UOz2K8KusA==,iv:75KRLL7F0mtzESvfvVaIJiBqAz1i8JIcS2VwAMm3KVE=,tag:HmjzrLg4hLuAjQ88U3CDbw==,type:str]
-    DEFAULT_LANGUAGE: ENC[AES256_GCM,data:U2qo/Z0=,iv:duSb5g58hXy+BjmU51cWVc2APmz/THtQrmfKyWJL8Xs=,tag:3578FhaZxtyLXjFOJA7sVQ==,type:str]
-    DEFAULT_LOCALE: ENC[AES256_GCM,data:DX3VePo=,iv:d3P66DEPoI3yiZj00YaYVEsu9zCSQ+Nz0vCOxJjfkNk=,tag:JNeGcODHleBBOJrewOWq2w==,type:str]
-    DISABLE_CSP_HEADER: ENC[AES256_GCM,data:mS45ZNE=,iv:7twp7yAggJfGDKnoqoi4OY97uMQuOq1Y3y6LFst9qFY=,tag:mselnIDI/OzNplWsdq2YlA==,type:str]
-    DISABLE_FRAME_HEADER: ENC[AES256_GCM,data:lIO+3IU=,iv:/jCBrh9pxsNouU+glpvXqEXI3veHsqaHWkSDEJcJzHI=,tag:JHWUyPl6Ir+XczlkEm/xsw==,type:str]
-    DKR_BUILD_LOCALE: ENC[AES256_GCM,data:43nBSlc=,iv:pylnsBF4HORItmtHxLxaXjojdyazm1rseMtqgTwwX8k=,tag:mi7eWamr3l/H+foZUJYsJg==,type:str]
-    DKR_CHECK_SQLITE: ENC[AES256_GCM,data:TssvPA==,iv:N6kVxo9w7pjUy5PSt0nF3yPS7imaKaWbizPZdMv7rKQ=,tag:DpWzkfkFbFaQpuLTirsP1g==,type:str]
-    DKR_RUN_MIGRATION: ENC[AES256_GCM,data:6+nNEA==,iv:TxFrPKxoaN/neoRK09F5SJswfh+ULHw/tFQz+ouOOsU=,tag:UsMPAYDhgccBtBUAXxTNaQ==,type:str]
-    DKR_RUN_PASSPORT_INSTALL: ENC[AES256_GCM,data:rA1uHQ==,iv:TKV5pRA65C8FNHOrpzx90qA7maX5ld3aLCv/PrQamII=,tag:bqtT9pqHILiV1AEzkkYk5Q==,type:str]
-    DKR_RUN_REPORT: ENC[AES256_GCM,data:bqE/+A==,iv:PWlGji8/zVoosDeoWaTG4f9rDJwKOilwENI1JtzatPA=,tag:cHCeTgnB7c0TZ+9bSxFW4A==,type:str]
-    DKR_RUN_UPGRADE: ENC[AES256_GCM,data:76w+1w==,iv:XZwFW5WoWRBhfgM8Jf71IAEsWJxaWj6nmzh4arjV9IY=,tag:wm49cS3mMPPj0l7rNRm7nA==,type:str]
-    DKR_RUN_VERIFY: ENC[AES256_GCM,data:GE3u0A==,iv:hZc9+yCN781Hm/M6UrzAnFELJopG/m0PTaHCwJuK4Ic=,tag:SwJ/ujTY9VsrS8payg5FbA==,type:str]
-    ENABLE_EXTERNAL_MAP: ENC[AES256_GCM,data:jwbL3WE=,iv:EmuPlxlldYIK57w44oeiOUx4dNUx88avn/MXGw0khqk=,tag:6UqgxY3eTE/DQ4znx5NNzw==,type:str]
-    ENABLE_EXTERNAL_RATES: ENC[AES256_GCM,data://NWaSg=,iv:l1k7TLg2d4impHiGyHtVmXFBpHSK1X+MIIMEvqHmFCc=,tag:7FX96H6R+ez0corFjpzoWA==,type:str]
-    FIREFLY_III_LAYOUT: ENC[AES256_GCM,data:KGo=,iv:xvBorcd8fPvlGYeomuexZBtORPc7LJRII9pYP1ZNBsg=,tag:ibFX6k0a12rXElxRODc1YA==,type:str]
-    IS_HEROKU: ENC[AES256_GCM,data:Ffu4Sro=,iv:Q5txv1a/DcH+Utlr12zQJUBy4vlcdxcHFsNDWuWVOeU=,tag:NTay0IKz6s7a9dFpx1BZ+w==,type:str]
-    LOG_CHANNEL: ENC[AES256_GCM,data:Njfav/E=,iv:xwccazZYrtARU7xKooAnBKJcCDJH5xUSN0C+nIs8Pos=,tag:jI3pelMMZQQ37uuUmUmENQ==,type:str]
-    MAIL_FROM: ENC[AES256_GCM,data:ILVOrph55Ku8pIfsHtU8DjMuUjo=,iv:c4wzRvDugyRUbKZKq/fgQ2eP3CJ1wJzkQo89tBCZ0WU=,tag:tx2lUsnCBbYIk0h4gL/CBA==,type:str]
-    MAIL_MAILER: ENC[AES256_GCM,data:rdoZ,iv:NBi4YtbtTkDJHQmXBu9lGUfCWhfRgtYLI3UCayMpq2k=,tag:o+cXYLXlJ0bWVQAPr85CJA==,type:str]
-    MAIL_PORT: ENC[AES256_GCM,data:lffjiQ==,iv:GsZWiMZGuhpPJfX6vPcr3PKuq2YXS3oQ8v8NojufyKk=,tag:rHcfDoLZdU5wCQR4g/qV6A==,type:str]
-    MAILGUN_ENDPOINT: ENC[AES256_GCM,data:rrw7Rwjo//tdEyxN98pE,iv:3aeAQM4RV5hDFfZ08voXgk7IrejoM8YACluo75AmRrE=,tag:cAmTiI0vPAnY7NX+YlM6Og==,type:str]
-    MAP_DEFAULT_LAT: ENC[AES256_GCM,data:i8I6LaPPLFoi,iv:sG6dP5GS2G6kGXEsn8P3KJmyEThJ73WIN2gkMJwNDBA=,tag:uefjbg5pZdIIONBklcsSyw==,type:str]
-    MAP_DEFAULT_LONG: ENC[AES256_GCM,data:+ESO4h6cGSE=,iv:hAFNmDfc6XWnQbpLQXjUsdZSOwPu964MlFBXYsNr9O0=,tag:iXfs5Z+Ojojzp2H2u1kHxA==,type:str]
-    MAP_DEFAULT_ZOOM: ENC[AES256_GCM,data:zw==,iv:soYKokimSKxSS0x9nM7GcZfpXtwxjuXVls+KFh61w30=,tag:ryX2Rj1TakKRfynh7bFEtw==,type:str]
-    MYSQL_SSL_CAPATH: ENC[AES256_GCM,data:Mo68CXbhV7kK5ZGi5MS8,iv:pVKSl5Tu8xzZVk4FX0DIA3vpVYZ9V0RXtfkoUTYeAAU=,tag:bez1DYHFlOn5TZ/oz7F6fQ==,type:str]
-    MYSQL_SSL_VERIFY_SERVER_CERT: ENC[AES256_GCM,data:DT7Jow==,iv:ZEOzfc0IepdvDNo2vWanOsYAT4EGLvFnSpL8qiiOwes=,tag:eEilJ8cwgCer7H/8qpDPgg==,type:str]
-    MYSQL_USE_SSL: ENC[AES256_GCM,data:rsKgGpE=,iv:nEJbHiaqOvVauAtCyL6uvfmkAmgvjjSFb28L3/j1PmU=,tag:6d5whsZ30buXkc0W4+5JIg==,type:str]
-    PGSQL_SCHEMA: ENC[AES256_GCM,data:pmFdRyiy,iv:mYXXlj7R7T3RTuK7QNRKiY6HwCezQYaMpn6de0st+FA=,tag:xFs7kAnFuRjDVRjKyyrJOw==,type:str]
-    PGSQL_SSL_MODE: ENC[AES256_GCM,data:/spE//X3,iv:qCBP7fJVFixBrB1ApGti1Nq0S87RcVxpHqmPBW9GuWU=,tag:MyCEseplfPX9PNdoqGLvmw==,type:str]
-    QUEUE_DRIVER: ENC[AES256_GCM,data:tTmRSg==,iv:2KdDPsJ9PlyHsVsFdknC7A4cShE5bBBpRxWslF/0wgY=,tag:7QN0MlfyoDyukmAgmgQvxg==,type:str]
-    REDIS_CACHE_DB: ENC[AES256_GCM,data:9w==,iv:MKfWJO941vxlJ0VP/0ob9JeFnHkI+okOkd/ifxkbKTA=,tag:PyyjVTRCUSvZxpHekP9ENQ==,type:str]
-    REDIS_DB: ENC[AES256_GCM,data:Bw==,iv:h3v/+cO1W7eGDAGjVtgeDh8UekMg+ZvIRkNZx+iE/Es=,tag:nF143FAtE181ZJfAjtau7A==,type:str]
-    REDIS_HOST: ENC[AES256_GCM,data:7hVDI2P+443UGlw/jyBFmNTDBM2p,iv:sbLD+/wdDEiKYpR3ttrey6HTlI5n76trH3wZjU7s3uQ=,tag:qZP1nb9+tOr7Lm4i9HR4wg==,type:str]
-    REDIS_PASSWORD: ENC[AES256_GCM,data:/i9UM5Cx6h61xbDQ//ocmW1BtmT0LILnwwemOwaTTkw=,iv:FINFRW1006Ljnb1JSi+Ctae3Jw9xR5EW73Ut8FCNfHI=,tag:+6raDqY1TgQQgbkcCcbCLg==,type:str]
-    REDIS_PORT: ENC[AES256_GCM,data:ME1O4Q==,iv:FhqTqv645wnhhQdGW0IsemeXOlJuCKjbMa3tBw0kueI=,tag:b7TdkDklkFwE/X3lE6XZGA==,type:str]
-    REDIS_SCHEME: ENC[AES256_GCM,data:puE6,iv:XvOpz9QO7Fn14bbHT8L2p0HquNxIzxomN3Bg3K2NOQY=,tag:qerZcGVGKXW+YAyj6RK9Tg==,type:str]
-    SEND_ERROR_MESSAGE: ENC[AES256_GCM,data:9xoXVw==,iv:m20IvyDsNzw7v3U8Ai34MhhxrIUGnU3OK9LHwZAdlJo=,tag:BgrhqBiqc9RYo9EzOCvSsw==,type:str]
-    SEND_REPORT_JOURNALS: ENC[AES256_GCM,data:+ErZjA==,iv:dcrc2+U7MoSBQ3b7w2qe0wIb50AbLDQ8/N9TK03ub5o=,tag:ub6+5g77qZxq8IjxDmk7og==,type:str]
-    SESSION_DRIVER: ENC[AES256_GCM,data:QlF9bSQ=,iv:I1cjDE4EFVG166ISZaNuM0eFMs6U55y7LUl2cVIONrI=,tag:VxKEC67A3Y0IRNKJ/nZV0g==,type:str]
-    SITE_OWNER: ENC[AES256_GCM,data:KbzTQ/QdlMmxnSDr1mCo4EG9,iv:287MEAzZFE3+zp3bWWA5Y2u3w7iQH+7AAZ812I4Elx0=,tag:TlljmsgLww7EJIBMdDrKvA==,type:str]
-    TRUSTED_PROXIES: ENC[AES256_GCM,data:cAU=,iv:MBL/z8pmM2CxlDT1sY4my2gC3jsDo6O1NSa11w3en5U=,tag:zqzHOR69HT3+U7tQOFQQSw==,type:str]
-    TZ: ENC[AES256_GCM,data:45gLKxH0OsAfMPkgnjKgWQ==,iv:P9CUovVI4WSfZi1nyFHVzHJ7Oioai1FUZRcgBNhQb64=,tag:S7IF8Oxg7hYNcT0mcgkg7Q==,type:str]
-    STATIC_CRON_TOKEN: ENC[AES256_GCM,data:1xck+8s3ifQmregeKU6891pErxZy86fO0I6XPE83l3o=,iv:XSsCSJkkGwG12f2lhd6IDl07OLVCW8J/945acFP99lA=,tag:XNxSQGyHvR/6/A3EVT69gg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-06-17T19:05:29Z"
-    mac: ENC[AES256_GCM,data:GWtQz5/wKpk38ZYLwn+kGyCT8hFo2SmoaI9vuEFju6N9ipJW1MNQONqTx/Qa8Cje8pT7xIxdoTf+23PaFG91v/gcilMCYjE+OFnVBk80d6ZBTXiSmoQ0DYO3hWiXyMfXTJ1OPqExOkY09QSAfXOrN0JphnWpPNZnaVuxMJZS/Og=,iv:/QbEi6hhsPpeSa5bOxPObP8UUpAwA/I6wU8VXQ6NcOc=,tag:FYYj1y/zTl82SVva0oauuA==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:36:01Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//So248m5bmfJG0gp5ZIAK2dVhH44xEg/6yzZ6TC9W4px2
-            SPqB+gmwswX64NGcGZQ8LQZExyy2poxh7lfQHIdsv2QSTbf0vmOZqG9L7Fv/DSU0
-            EnUpt04K1yyVyW09tlcE/SIyMy9HhWyH0vZfwqHc/pHnaAhZKEuBH+kFiNPz4Bfd
-            xtXeieOGYV9ois2vM2NFNohEagrkbpMb8ZEOrWlB8+ZJZhkIeNc2kA+w0n0TEEtR
-            WefrBwear6YloK89hEfWRdJYksfKvOsU7U+L6MKpMxqGBIpLIV5kTifRAt8pdrNX
-            m7MY/laTWcqTp1VXUMZQUq+tCa/jjIh4MDvmzGcrRfhSLDvkFz8W43yHvy/hTKgc
-            nes55vhrWK9ABcZ5sZ3xdfH3ys3tODUsUkaLALaCbXUdg15cQRwvdNkgHou/oY26
-            jAc38EpeBEtIpkH+nBHLgbflFkElqOcpcS/5OR4mL0dGQ0EhhYTzxES+jcVYg9ka
-            Na163uPvhNnFNMUACKsDU/u2WngU8B5ISjlsiX9EkbKqDgHrLSJywKcoYESgnU/K
-            q+24HIFH8cmghRYJZ7SXDahsEw8VrcqQEWTSMM4YnwJeBZH9pjeUK6RySLHxK9F7
-            rK2djzc6so2Lk/AhYot9FNNwXWqrBKQq7kjFF8Mr6ALydZgst/tSBPtpTxpADZDU
-            aAEJAhDuDefWmaUMfyK+B21JoUTJtAp1icQZrIFg+mTH+qDWPXdpM1qsaci59aq/
-            vkML3TwjiytUNRMVORlLPv2z8adUuXIgPx8yEclTxCDKM3bqIfVs1xj2GAItyO4K
-            XYBV8oIdHegO
-            =GI4b
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:36:01Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAApwoZ01GS0soprXAf20Ye1XQVLIFvIuYjub01ibNZmb3m
-            uJiPyClzMqcjy6TKWvCc6sT1W5DQ3aY9E1ARhgwR/yaIZ31WvNcnLczaOACHPlaW
-            7e4o9tauN8CYpQqPmTxDyQehKe1EbWqq+63FRAUV0+9qEY/ACCwNtv1HCa2dgyto
-            0I6v/BmW+KJ10iGCsRv8g5IgPSjYT66a2fsDg24kjtqygHwZ5BPe6xUBJ7zxCmVT
-            z/3WKaNx5Rdv8l45QQcl2fe1qNNdljJNgowCq23uODcQPJPGEY4wOeYHOlGTKE+E
-            JojnysVUhILhZtTZ5/AcP36RCzMDGQX7wYtvwh6bgf4qf4InX8+O/WK3u+jOreUl
-            zbcy/lB7bsQ0usZNPsfy2Qh2LPlziBce9JtkPnWXBwS+lZUCXKDS8pizmj7DZnlo
-            +3L1f26rn21ye/iOyBArzVmqI4QLJzHJI7l6TZgvvv1dZKHyLW5jCHSq4f098roO
-            kIKxRThFvTZ9jqM7uDYGiAsGt1L7p+HJRY5WdAVGEaL8jWADW7jjF8qTF3BJ05A9
-            OgnRxIew6ofB5WeYSrU5dn5di6pTNI6bqHVHbZf3BTrGwdpqsAcniUtDM1FAdU/4
-            QtB7tXNAYV+ZTDez/MMm7l1xKS6FpPbM5ZUtrcv27I51e2HAyYSsj6FNWWyvXEbU
-            aAEJAhCfDkAnvink2rBria46BR0IPWSLaVEpnusa/OED/Xw4EEgiFq3XonPTHaqG
-            iXSfeD0XauMxpLan+YesEv9SRP3ef9iX5OGNwVPpIDlkOyUztBWtf3I7tP2LCf2p
-            /GKlxeQfAlpx
-            =zWYo
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/default/trilium/helm-release.yaml

@@ -1,50 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: trilium
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/zadam/trilium
-      tag: 0.63.7
-
-    env:
-      TRILIUM_PORT: &port 8080
-
-    service:
-      main:
-        ports:
-          http:
-            port: *port
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "notes.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/trilium
-        mountPath: /home/node/trilium-data

cluster/apps/download/radarr/helm-release.yaml

@@ -1,119 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: radarr
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/onedr0p/radarr-develop
-      tag: "5.7.0.8882"
-
-    # Metrics sidecar
-    sidecars:
-      exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.0.1
-        args:
-        - radarr
-        ports:
-        - name: metrics
-          containerPort: 9000
-        env:
-        - name: URL
-          value: "http://localhost"
-        - name: CONFIG
-          value: "/config/config.xml"
-        - name: PORT
-          value: 9000
-        - name: ENABLE_ADDITIONAL_METRICS
-          value: "true"
-        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-          value: "true"
-        volumeMounts:
-        - name: config
-          mountPath: /config
-          readOnly: true
-      
-    env:
-      TZ: America/New_York
-
-    service:
-      main:
-        labels:
-          app: radarr-service
-
-        ports:
-          http:
-            port: 7878
-
-          metrics:
-            enabled: true
-            port: 9000
-            protocol: HTTP
-
-    probes:
-      liveness:
-        enabled: false
-#        custom: true
-#        spec:
-#          httpGet:
-#            path: /ping
-#            port: 7878
-#          initialDelaySeconds: 10
-#          periodSeconds: 10
-#          timeoutSeconds: 3
-#          failureThreshold: 3
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "radarr.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/radarr
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        mountPath: /storage
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    resources:
-      requests:
-        cpu: 1m
-        memory: 350Mi
-      limits:
-        memory: 1500Mi

cluster/apps/download/sonarr/helm-release.yaml

@@ -1,120 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: sonarr
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/onedr0p/sonarr-develop
-      tag: "4.0.5.1778"
-
-    # Metrics sidecar
-    sidecars:
-      exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.0.1
-        args:
-        - sonarr
-        ports:
-        - name: metrics
-          containerPort: 9000
-        env:
-        - name: URL
-          value: "http://localhost"
-        - name: CONFIG
-          value: "/config/config.xml"
-        - name: PORT
-          value: 9000
-        - name: ENABLE_ADDITIONAL_METRICS
-          value: "true"
-        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-          value: "true"
-        volumeMounts:
-        - name: config
-          mountPath: /config
-          readOnly: true
-
-    env:
-      TZ: America/New_York
-      SONARR__AUTHENTICATION_METHOD: "External"
-
-    service:
-      main:
-        labels:
-          app: sonarr-service
-
-        ports:
-          http:
-            port: 8989
-
-          metrics:
-            enabled: true
-            port: 9000
-            protocol: HTTP
-
-    probes:
-      liveness:
-        enabled: true
-        custom: true
-        spec:
-          httpGet:
-            path: /ping
-            port: 8989
-          initialDelaySeconds: 0
-          periodSeconds: 10
-          timeoutSeconds: 1
-          failureThreshold: 3
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "sonarr.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/sonarr
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        mountPath: /storage
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 350Mi
-      limits:
-        memory: 2500Mi

cluster/apps/media/jellyfin/helm-release.yaml

@@ -1,70 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: jellyfin
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: linuxserver/jellyfin
-      tag: "10.9.7"
-
-    podLabels:
-      needsAuthentik: "yes"
-
-    env:
-      PUID: 10000
-      PGID: 10000
-      TZ: America/New_York
-
-    service:
-      main:
-        ports:
-          http:
-            port: 8096
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "watch.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/jellyfin
-        mountPath: /config
-
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage/Media
-
-    resources:
-      requests:
-        cpu: 3m
-        memory: 1500Mi
-        
-      limits:
-        memory: 4000Mi

cluster/apps/media/komga/helm-release.yaml

@@ -1,67 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: komga
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: gotson/komga
-      tag: "1.11.1"
-
-    env:
-      TZ: America/New_York
-
-    service:
-      main:
-        ports:
-          http:
-            port: 25600
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "comics.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/komga
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 1500Mi
-      limits:
-        memory: 3200Mi

cluster/apps/media/plex/helm-release.yaml

@@ -1,86 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: plex
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-
-    image:
-      repository: lscr.io/linuxserver/plex
-      tag: "1.40.3"
-
-    env:
-      TZ: "America/New_York"
-      PUID: "1000"
-      PGID: "1000"
-      VERSION: "docker"
-
-    service:
-      main:
-        type: LoadBalancer
-
-        annotations:
-          metallb.universe.tf/loadBalancerIPs: "192.168.10.70"
-          metallb.universe.tf/allow-shared-ip: "main-ip-192.168.10.70"
-
-        ports:
-          http:
-            port: 32400
-            targetPort: 32400
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "plex.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/plex
-        mountPath: /config
-
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage/Media
-
-#      transcodes:
-#        enabled: true
-#        type: pvc
-#        accessMode: ReadWriteOnce
-#        size: 40Gi
-#        mountPath: /transcode
-
-    resources:
-      requests:
-        memory: 720Mi
-        
-      limits:
-        memory: 5000Mi

cluster/apps/tools/vaultwarden/helm-release.yaml

@@ -1,60 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vaultwarden
-  namespace: tools
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: vaultwarden/server
-      tag: "1.30.5"
-
-    service:
-      main:
-        ports:
-          http:
-            port: 80
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "bitwarden.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-
-    persistence:
-      data:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/vaultwarden
-        mountPath: /data
-
-    resources:
-      requests:
-        cpu: 1m
-        memory: 50Mi
-        
-      limits:
-        memory: 200Mi

cluster/bootstrap/flux/forgejo-deploy-key.sops.yaml

@@ -1,76 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: forgejo-deploy-key
-    namespace: flux-system
-type: Opaque
-stringData:
-    identity: ENC[AES256_GCM,data:UvYyd3sprc1tsApJ66mY3vRoH3JWIEP4Hp8FlEugFh7NeuHL3MaI0uEqsAay8VC4wL3r2XqyEEJbwV9fYE8idtwbvjJXVSrdiACrtaZyIrYe64LgqXKvxqHOL9ysR6vuCD9euYXWy9DiHytHbuZU+6skfXFHRzuvrSH5SWn0nbyqnhYuaJ/MBYM1E6BoFYTLMAQGC8X9zcMYsN5drmvTa26CUP8awSxjTwb+iaSFqlXe08wt9tVpjDc5XldXY8tWgOFKg7jboJYIc9LgL6dboL4NtYxe3ouTWA30Pv2uhqm6CLujdMfGZ/UOj0/T7MSCYMmhq/gh7yKAQhwg4CPK+36T922jwSn2ILRNJTwn25CFOnutEkV5azZcqZglmiD+8rxFbvbtAsmEToOBJkaGSMNSra27bmeoXLZqblVlY+GcjpNxVA/7xp7nx8w3lh98YVKm+Otyl1LOUnR/arDsOlnsBuTldtfUaFC1Ty+JpGobPw51U1E8KBzMSGu+D/7q0DYV+W5o1G6PUz0iRefUj9mlvEtz8ENc49Pm,iv:Rl4ZRZ+DPiDxCvngvMeRZuOe4oWTm5nopAp/aUeAYtA=,tag:xrLL7oveJ+YKPk3Bk2tFzg==,type:str]
-    identity.pub: ENC[AES256_GCM,data:8NNDcrjVyimOwzZ7TXGkwUC7tYfWnQdKUHGjBpSmX5AHIVWMGDwf5gLs6uwUg5aWJb17vJzGHXpUd6tltA9YQWN7xM01IP1l5ZY5JcTpuOQ=,iv:67wgRB9KqP232yn0BmdvlgM7qoUfBkpG9Wirqo/hh/M=,tag:kvOv/634jO5X1EeaJ6Sy1w==,type:str]
-    known_hosts: ENC[AES256_GCM,data:kwvLA18vCmXXD4TKwzgULEmQxJ5ewudv5jyl1ybB8gck2a3EKRY5TBzQk6fqLY4H0pSxBCuYJ2d3c7rhTZ/uBlc49GJ8jNL99bIdBWOmKLxu6XPyQz6jAalDz7Hrwi1f9gZmH1Tk4huyI5Og6Wm4P5eWuJ16vdJ3ALPETWvPj6jjZXRcRRcTE5f48YSGCscMlqctH+bXAWp+u3Td1X4y+07uXXUlFY5YElcPlm0sjYJ4oLSOejCQLi2mQw8YTanBs2ddq+Ocv07BVYo4gr6lF0cMr9asbeWi0ofLJZKOifQRYaadSsJiWJXmpSCW5yoYbho/4LbiIWy1Hx7jKb+pAZjBF3Xdl8BhOQVvR2S9idte6RkLQLKLGqcKnXbT6eI0Y7B2gAG+giLGogj4HL6xowuA34uVO5jN2s2guHjkEPcLPfrGeUcmKKcZaMsyYbo5QfOa0I0FzrkLJaCVdRy3zhW6W9K3EDXlP+jnhqRr2UxiHxvP3d3KeqC635oY3Vmk5DgF2dNTy4fvps5Qj/+sB+qqFJCxXYRufCRLARe1fMdNo1OfX4ADuvbKd3gcy7ouiWzNEloM20jjeV2oIpgdFYhMGA5wkxxwqGanvidBDR759LFP2o5t7ESbFiWWkmg/5Ngu+F1H87RKb21fdjWZj9ahU9urOfK6MCtGMFZsE7k61dFaL7xVRGbUi59DKUBZ3WifuPBMo+WsafuYtecxDafAzhUp1B6dmMzEoGerIqu38EFAv5H9p/E+lUMmBxTm9rMN2GX4QOiGC5s4OYdSFHS4SHIO4/vfRGUdRtex2KAe41866d8d1KG2mA4IBvGqO3mxfnG3TNgfQlPRqFA+p6MA0RaS2oLL73+6HOTWCBUoIVamaQf3jf6lATr0if3kp58R8B1Q1uWPvc03OlbwYclKMVoaHTdbhE0Ar3swDACbmJfBDAA9ItcXVeRLsDJzbdBdCm95XRD+TrsyelUUR5RDZ/WMkX1DcUytq0uh1RGEAX+8jq3XZYWPlpPuBJY8D98r1R97kZgxLSpYfhdKrAXxYJ9nuU9pYOr1IGe4AD08nASsFW+DHhPTxDHubWLkzYDuED+lBgPm5I/A0h3PIcJfxMkNI0SRtoNwyeWyXFqSEA+Q78Gtu49txaiJaw3yfjLFhOAdMAbBg9rZ12XCgi1zPxijMmN0F/ucI2ljXsD3YHyGrSoQKlN/FGuSpV3YjLdwvSlM3fITrO6DY/HommSS4I+3Y6MulAZJxcO8kfIg3TX5Z1NOewZoWl64Uu9rzAIIjUrKG2P5hWNaYtaZcSVKuiWmOjzm9a5KAsjqaN4DMaDbSh/7kMvVnHalMZMzCdLuOOQkQcmYfVerhMGF+/BlUZRo+eq7u1kDkTXwbj+sPS6s8EBW5bQ9fmQa9brU,iv:7TNthmqlbS+duXv/7RUoM/yVEpC6AP+dkho0pRRiC00=,tag:N1rL9NlfpQD5PRTzvY6fWA==,type:str]
-    password: ENC[AES256_GCM,data:9AKaZ+INO+ZkUDCeBU/cSuoIsFm4cFpLOpDgMpzedte1RsD02QMdwg==,iv:6hiJrFeDhscz5gQIGwtSrDibbqTnhjitelw+KXZH9dI=,tag:wY6Lc39xiYPzJ/40rEhoKA==,type:str]
-    username: ENC[AES256_GCM,data:31/r,iv:Ubpk7pnkkUzyzTyOy9z9GhZJ2wQQCvu9tG3i0a2hSd0=,tag:6uj3Bticfzlxyu8T6sPLFQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2024-06-04T23:08:08Z"
-    mac: ENC[AES256_GCM,data:pJg2fZcQTAhnSDo0S91iaBXuveqHhwDiJ25T6/iuKIveMDoe5ILFIt6Jp+9uQkvAh2njmd50SZz2e+Xrn/DlvWo3jDg0F6nzByebvqRpEJmFeBH9xQkNjXuElCO6BbkPiQK/BwYM/36c7U9YyrlwNqcS//u/Gjl/0OFsYDhTWPo=,iv:/vSS3uD/luO58bEaIdIe+hxyfFfyY8sUspATmIaBLw4=,tag:6fZ0KAsDZmuNkzq3BxrvOg==,type:str]
-    pgp:
-        - created_at: "2024-06-04T23:08:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAyqlIeyoxYovARAAmJ0LPgMFgmlYl0p+xvkw5Q8tVSBjlVh2OUvwtWSy19pn
-            SEes/DgjHaqFjKFhy2IOHT0iijuFQzo3kn+jpDENAS48/GeaF4UgFJYIjSsTe3AI
-            0MRBqjAjFdr9qjYaul3qm1mqmco77Gfx7KEHnFMNuy+2Bm5u3C4TNnbMLlFygB1b
-            U7QNLVHOQPWECAQZ8S6+jiEPIXuRLD3BkLRhOZrcN11RuxX3jtiCPnciKtbCWuaE
-            38VYnOLpY//wNxL6NSzD4b80/0mstK51sp6jDMAskd8F7uUb+0lBphARYrnuV5MK
-            JRnk6D5cgX6xlnVVpbv3FEUuWq8rRtO0jn8mBsZpIvMO3YKoNfnRo52Ii+/tDdDt
-            ndzFHz/qnC9j/bAdMT1CSCfzPfvKWYZzvDFtEnb8asKQuqCuPY+RE+bEFDz7aLSH
-            swhUBxJYlH2gJsLOGaTzTg13qhn04oWVaI/1sOPuedyYCdLwJYQqc83prRh/p9CT
-            XJm0k8ENNqcXgw1u6gkzm9zweu0Bgn+qwSFhS/c43uYdh2k1qoGu/RrLiGv2wO0A
-            UIrsb2X6l2+QqlB5YZtmKMV8+NrL27A6ScuaSypMBaA/qgm+jNr4il4nhsyfLPjo
-            GhLS8CjVscd0GXItzkzr7dSl09xYkQ6Yo1jnXpQuzkEan+4vOUXsqt43uoEhGPSF
-            AgwDXjg0p2IN1X8BD/4nGfkU/LLLylHsMQy24j1e5wk26gSFlpm8lwuZpeBeDIr/
-            I67sWwwxdtjnUNEREYo76bLy9Nd2vEY6FWT8qlZFDSItAnQTvqvcY6LSp8X50clA
-            McxEW4DYNbmKtaRdGrYMzjU+ky1kozH9mcXtRsjD4DlUdv4Hlazp6BAF4a3jlCZw
-            HgW8y0qhWoDPvmMOsKCSXqwRYMxWPkxJTGAHzPLPZ7U+/aR+86lRGzvhuNelW87D
-            ajgALEGEtctuLKu4mbukKR7Ntx/V6mLQ8hXtESNxEYKKnvT2KkNFaJBZz15JLrOg
-            Ug03hbBEt+7ZEBZo6JKyMIlm1O3vhhllsWiFXxDmfPGB2kiNfV5lVGJuMAq17wyN
-            XFzV7TfiHWlD3N9R/HshpKY3SRNB6atMVpyxvl3eT4QI6W99WIaa+A0RZtRX9BqR
-            3AbGlRPORfR88GWo4qoGuAh0tzUskO9zsirU538hjS3euBRemqhqo5HsFGo3U42S
-            PlP8DMQ8nBbm83sUafqoCIKARgefWcdXT9LgxBqyxOgDjF4jAQ4hAIunGBwE+guA
-            DgAkKp4DVxgIu9C3LO9VoIcdjKvld+YQAJkFbXDUaOMMUHaw0pamwOYC1G02gtSd
-            IxYva37M/Fm5kjs2k8ybSQ+Ck22O0n8r/HXp8cpk+47iiHYrRkYD2w1y/IIC8dRo
-            AQkCEEf3NOSiq4CLObFXLJKRmgMRvDPmmWrrpic15JpLFuos/qp/24YdeXxTe2OI
-            pMwYIfuzeSTFckvU5PO073j2/rKLi/PFDNztmhzn/CmVSJdeJioiGXatPgP4Cvg7
-            cgIBF114+nU=
-            =G1/4
-            -----END PGP MESSAGE-----
-          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
-        - created_at: "2024-06-04T23:08:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAh52OKWUiy3Hk6wa7TpG/89s8grlUsKGfLyv4Z9GlJnvK
-            VAZ0MwEcaZcBt1ar3zm6QJKdnw+pt760qKZL3EAsShml1Fh2dEjTZ7O4M+8Vbhfg
-            2+xa35KHFNmnS4x3axkehbGdlzdA7tC9IG7tiNpy2mugPctXUmY4Ysd3i1YhkeBn
-            zgQW0cGIisw6YJ8RUua6jyGMyP9rxar56Ikybc89Xwqvr8choPCpr1ETxQLopEve
-            doQJe2zdCJg7cIG6MlAGFHEeBIE7/v1EklaQ1ybd6PPDX0NmXab5DssLj6Bn3ALo
-            jhKO46lAF9PpD8LsDKga6wDtiCgnATpVrShGIaOGs8NDpS9PW4R7wio3iqVcd1yi
-            YkhHc/fPQo77SJwqG1GQGpLhUvggoXF3jQTTCPn+Tm76J2cQh7ePh9RgT9ztcoM1
-            aCxib9d5BGDzjvLUNqBemyeSFOrjKPdKfyJ53Q4lnPbsPBFaonOKxuS85+YI7f4v
-            Fd0ks8rNX8GKXQWzYdoB36oSmTsUO2OEsT2xmB87Og2PZRgSQtNctPUV0GmDXShR
-            YkNfJbkPXzeKA0r9nZdAegZSZWkZsC1xIBftaLu7uKFfGNHIks2GmIfjTUvy+PZG
-            2rgyKwCo34b1vFBdg7xExMP95WPpTZoCUZcInV2NYiDQExUj+QBlf911n2SlaB3U
-            aAEJAhBQ+E5AePC2hCHHjZ+gOqglqD2E07tw9lL1TsvkzfpYRXv5QxjrBBNUaN9u
-            LCK2R5M8xESkVmkjWUOeCG/agxeU2SYpHRd5jnxwa2Ei3+DPSJcpjaunDPdcysid
-            jswHYh1ml8lf
-            =rmpd
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.8.1

cluster/core/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./kube-system
-- ./helm-repositories.yaml
-- ./cert-manager
-- ./networking
-- ./storage
-- ./kube-replicator

cluster/core/storage/local-path-provisioner/helm.yaml

@@ -1,82 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: local-path-provisioner
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://github.com/rancher/local-path-provisioner.git
-  ref:
-    tag: v0.0.28
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: local-path-provisioner
-  namespace: kube-system
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: ./deploy/chart/local-path-provisioner
-      sourceRef:
-        kind: GitRepository
-        name: local-path-provisioner
-        namespace: flux-system
-  maxHistory: 3
-  install:
-    createNamespace: true
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-  uninstall:
-    keepHistory: false
-  values:
-    helperImage:
-      repository: public.ecr.aws/docker/library/busybox
-      tag: latest
-    storageClass:
-      defaultClass: false
-    nodePathMap:
-      - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
-        paths: ["/var/lib/rancher/k3s/storage"]
-    # Note: Do not enable Flux variable substitution on this HelmRelease
-    configmap:
-      setup: |-
-        #!/bin/sh
-        while getopts "m:s:p:" opt
-        do
-            case $opt in
-                p)
-                absolutePath=$OPTARG
-                ;;
-                s)
-                sizeInBytes=$OPTARG
-                ;;
-                m)
-                volMode=$OPTARG
-                ;;
-            esac
-        done
-        mkdir -m 0777 -p ${absolutePath}
-        chmod 701 ${absolutePath}/..
-      teardown: |-
-        #!/bin/sh
-        while getopts "m:s:p:" opt
-        do
-            case $opt in
-                p)
-                absolutePath=$OPTARG
-                ;;
-                s)
-                sizeInBytes=$OPTARG
-                ;;
-                m)
-                volMode=$OPTARG
-                ;;
-            esac
-        done
-        rm -rf ${absolutePath}

cluster/secrets/orca-registry-puller.sops.yaml

@@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: orca-puller
-    namespace: default
-    annotations:
-        replicator.v1.mittwald.de/replication-allowed: "true"
-        replicator.v1.mittwald.de/replication-allowed-namespaces: '*'
-data:
-    .dockerconfigjson: ENC[AES256_GCM,data:g58h5rYAEZu2W3CYnYHgajsp7wvnFdhyRCt1qWPHbVDC+nwD1TVqTGDga1b2/RTR5tdobqZ9FdP41/1dzZeNBe2lfXOsWhQYd87EhpchFYRgsb9u7ZL32sxERhAxSg+0/AaoIYSHbuBLgRwxqnHOojS7Hcg956L+6Kgh/uiaOGsUrKRjlMAI0aN4agx+n/nU,iv:ichMs+o/3ld90VVq/UatXpAtpD6qjrEIdt0ZRwyh0Gg=,tag:lxvZy9U6sGsndz3sAy3DTQ==,type:str]
-type: kubernetes.io/dockerconfigjson
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-07-22T02:12:00Z"
-    mac: ENC[AES256_GCM,data:yFHVGwFdi2n4Ju6SqqxXDxqxZaHKROIsQZtF+AtJY52f0XJif9jP2fi05dnxULnQ+wWOq4FPwVXc/9GiCiYMItecEApS0+6C7sWxKCWzYYAiFyxSajECzNtr4/XN5yoZBJCgsgFAf42jy9Nr5xLHOAVomnNfmDheS/Pe+Uq9v9E=,iv:oFKca0hHR7ERNgJqDp3pOxzQDBlTCF9Fx1yIl3HCj2o=,tag:107vU6pOFE6Na4BO5C5tiA==,type:str]
-    pgp:
-        - created_at: "2023-07-22T02:12:00Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//QEVgmHtcIVC1afYtQMgD3Kwb+n0nZid3d/enKN64D+fJ
-            bw0xXX9tjO4sy3To49k0EDETLW5paxcNApFYL+zajxNfa+EAZfdYxQqKWraQcxvL
-            /p8bNDyzYDrecWcIdcq4RqrVEA4Ga0K6MmPM0t5l+J/PgguDJWmAxEzlmTb/CdqI
-            MpUmO0RoLHb6m0vfAkEI0LT5E/37pTdqjAq4eMT9n7zxeHr3NmJBIetahENxTKDk
-            Ymw7DhBCLZBPvHyxw/kU7hS/yhJMxmLw9mjHuzWkYVYmZQDB/TwqWsL4cVLFNAVu
-            LqZBHtl2HmaeGefhDij4SfxCj3qTi1e3z1T5wch97XmFanabNizb2oezHYou4h5k
-            AVqWuxUd13am9YhmRMQ32TPPxyAWpV4W87C/XnIrMrfePH2xy54S2ISyL5lQ1I3K
-            5/a4ZMU8hBdCw7FxX6OSAXUd5cCfelJEaRopvwgXF5ZfQjARjQ7iGCedqBQbOsZM
-            vsf5WQvYxp8uivj7gKxhn+KkqJoM225OQKlSwCQ2bj20WsZ3SrjBuK41iO88urej
-            SJLAqG42e+nUjHXn/ql794kCHHG59uRES1wWLvgQ6Siu8TxJK6B+fjOrHBMOeSiD
-            oMKyqWIvziXN5KczkIpOWFCJzHb+AGTUn/a/jCLAqAxAqkWHwwbLdMiUv1053vHS
-            XgHkdbFnWqSekHCdLXu6q1lJhY+VAyzI55Ex2HvdxzBxWQKZAD4c1fFN/88j/Fb4
-            6/IVZvSU45coCyUR3O+py0s6XvBjrJL6W4haNXMl6nVcTxHgby1JTX5vickv400=
-            =cqEc
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-07-22T02:12:00Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//RAyoi7oTNza3klhojjvUXum9iH3pOl1eqNu3qdJc9L4A
-            rGeo7Q9NTgywAaHQA4N0WPjJfFNkKSFLBxbtRpzlVCNrfontoGoFr5fGFWDh2Kfe
-            LydY3Zz9yUfcQYuGm8onVM6B6ImYUtM9ZPix808jxfiuz7rvqNmxqTdCa9o5oMHK
-            TqQ5u26MBR9cFf+W7bxKdDsqm4vEhxxWpEf5wgX+iZboA4O/J8LCVwrp6pb2pJ1q
-            nMA5ElKk/WZbsB6C20DYNXJRsdHjC1Huye6NDt1Em2XY9qcfWkQskVtohlYCdDCp
-            TciHgOF32rmN7h1i4j5Ae58AaSQmNRpKZFc192z8+dHdiSlzQEno6XXV11pezz/i
-            0ALvy2Q+r7xFA8xXyrOf7xOU/j9T8XCEAeidtQoZzEcINtg93tKItakzqacxRa2C
-            4Yj3Wic3LGSX13dZ5cpQNT6P3F6UMVAlVEEu1lHdsAjShbmuFWSFNXVo473O3Nwu
-            1imHmfb1xnqbiWS0tKdUX9jMQg+xYPrsAXQESq/9PmPJxl4tsGPzzCu+rMKf9pmF
-            XqGBASdcf9WaB4Hojm6+4UKb7pPDKAC2vLnOV9ilGv/0z+DwxU0x9swPkAYBm9M9
-            KkcaEh8petqyU2J8f91ESU3OafMo2h5OsJvzB2Zte2XIZIZV0h0y8mo6LKOJ1hzS
-            XgFiMVicO02DFcMkSJXA7ZVnV+1qfJl5vPW6Sa0vDikz/k8jYoRSv2skwZcpFIYf
-            Kr6LbZskq2QVBDS50HdpbOfyF+N8/mYuSfjKkuVH8oOq0KrZ38eJROiygPgpUYk=
-            =i9P2
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

docs/apps/ganymede.md

@@ -0,0 +1,7 @@
+# Ganymede
+
+## Temporal IO
+Temporal IO requires some annoying permissions in the database. It requires permission to create databases.
+```sql
+ALTER USER temporal CREATEDB;
+```

kubernetes/common/apps/cert-manager/app/files/helm-release.yaml

@@ -8,13 +8,13 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: v1.15.1
+      version: v1.16.2
       sourceRef:
         kind: HelmRepository
         name: jetstack-charts
         namespace: flux-system
   values:
-    installCRDs: false
+    installCRDs: true
     webhook:
       enabled: true
     extraArgs:
@@ -28,6 +28,6 @@ spec:
         - "9.9.9.9"
     prometheus:
       servicemonitor:
-        enabled: true
+        enabled: false
         labels:
           release: kube-prometheus-stack

kubernetes/common/apps/cert-manager/app/files/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./env-secret.sops.yaml
+- ./helm-repository.yaml
 - ./helm-release.yaml

kubernetes/common/apps/cert-manager/app/ks.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/cert-manager/certs/files/ca/ca-cert.yaml

@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ca-cert
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: cluster-ca
+  secretName: ca-cert-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: self-signed-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

kubernetes/common/apps/cert-manager/certs/files/ca/ca-issuer.yaml

@@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ca-issuer
+spec:
+  ca:
+    secretName: ca-cert-secret

kubernetes/common/apps/cert-manager/certs/files/ca/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./self-signed-issuer.yaml
+- ./ca-cert.yaml
+- ./ca-issuer.yaml

kubernetes/common/apps/cert-manager/certs/files/ca/self-signed-issuer.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: self-signed-issuer
+spec:
+  selfSigned: {}

kubernetes/common/apps/cert-manager/certs/files/kustomization.yaml

@@ -1,10 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./namespace.yaml
 - ./cloudflare-cred.sops.yaml
-- ./helm-repository.yaml
-- ./helm-release.yaml
 - ./letsencrypt-prod.yaml
 - ./letsencrypt-stage.yaml
-- ./wildcard-cert.yaml
+- ./ca

kubernetes/common/apps/cert-manager/certs/files/letsencrypt-prod.yaml

@@ -10,9 +10,6 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-production
     solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
       - dns01:
           cloudflare:
             email: "${SECRET_MY_EMAIL}"
@@ -21,4 +18,6 @@ spec:
               key: api-token
         selector:
           dnsZones:
-            - "${SECRET_NEW_DOMAIN}"
+            - "${SECRET_NEW_DOMAIN}"
+            - "internal.${SECRET_NEW_DOMAIN}"
+            - "*.internal.${SECRET_NEW_DOMAIN}"

kubernetes/common/apps/cert-manager/certs/files/letsencrypt-stage.yaml

@@ -10,9 +10,6 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-staging
     solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
       - dns01:
           cloudflare:
             email: "${SECRET_MY_EMAIL}"

kubernetes/common/apps/cert-manager/certs/ks.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-certificates
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/certs/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: cert-manager
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/cert-manager/kustomization.yaml

@@ -2,5 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ./namespace.yaml
-- ./helm-release.yaml
-- ./metallb-static-ips.yaml
+- ./app/ks.yaml
+- ./certs/ks.yaml

kubernetes/common/apps/exim/ks.yaml

@@ -0,0 +1,26 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: exim
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/exim/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/intel-gpu/files/gpu-plugin.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: intel-gpu-plugin
+  namespace: intel-gpu
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: intel-device-plugins-gpu
+      version: 0.31.1
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+
+  dependsOn:
+  - name: intel-device-operator
+    namespace: intel-gpu
+
+  values:
+    name: intel-gpu-plugin
+    sharedDevNum: 3
+    nodeFeatureRule: true

kubernetes/common/apps/intel-gpu/files/helm-repos.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: intel
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://intel.github.io/helm-charts

kubernetes/common/apps/intel-gpu/files/intel-device-plugins-operator.yaml

@@ -0,0 +1,23 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: intel-device-operator
+  namespace: intel-gpu
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: intel-device-plugins-operator
+      version: 0.31.1
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+
+  dependsOn:
+  - name: nfd
+    namespace: kube-system
+
+  values:
+    

kubernetes/common/apps/intel-gpu/files/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- helm-repos.yaml
+- namespace.yaml
+- intel-device-plugins-operator.yaml
+- gpu-plugin.yaml

kubernetes/common/apps/intel-gpu/files/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: intel-gpu

kubernetes/common/apps/intel-gpu/ks.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: intel-gpu
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/intel-gpu/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+  - name: nfd
+    namespace: flux-system
+  # requires certificates for communications between plugins
+  - name: cert-manager
+    namespace: flux-system

kubernetes/common/apps/metallb/app/files/helm-release.yaml

@@ -17,11 +17,11 @@ spec:
   chart:
     spec:
       chart: metallb
-      version: 0.14.5
+      version: 0.14.8
       sourceRef:
         kind: HelmRepository
         name: metallb-charts
         namespace: flux-system
   values:
     crds:
-      enabled: false
+      enabled: true

kubernetes/common/apps/metallb/app/ks.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/metallb/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./app/ks.yaml
+- ./pool/ks.yaml

kubernetes/common/apps/metallb/pool/files/kustomization.yaml

@@ -1,5 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./air-quality.yaml
-- ./air-quality-dashboard.yaml
+- ./metallb-static-ips.yaml

kubernetes/common/apps/metallb/pool/ks.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb-pool
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/pool/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: metallb
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/nfd/files/helm-repos.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: nfd-charts
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://kubernetes-sigs.github.io/node-feature-discovery/charts

kubernetes/common/apps/nfd/files/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./longhorn
-- ./openebs
-#- ./local-path-provisioner
+- helm-repos.yaml
+- nfd.yaml

kubernetes/common/apps/nfd/files/nfd.yaml

@@ -0,0 +1,19 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfd
+  namespace: kube-system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: node-feature-discovery
+      version: 0.16.6
+      sourceRef:
+        kind: HelmRepository
+        name: nfd-charts
+        namespace: flux-system
+
+  values:
+    

kubernetes/common/apps/nfd/ks.yaml

@@ -0,0 +1,18 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nfd
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/nfd/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg

kubernetes/common/apps/openebs/kustomization.yaml

@@ -4,5 +4,4 @@ resources:
 - ./namespace.yaml
 - ./helm-repository.yaml
 - ./helm-release.yaml
-- ./alerts.yaml
-- ./service-monitor.yaml
+- ./monitoring-helm-release.yaml

kubernetes/common/apps/volsync-system/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./namespace.yaml
+- ./snapshot-controller/ks.yaml
+- ./volsync/ks.yaml

kubernetes/common/apps/volsync-system/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: volsync-system

kubernetes/common/apps/volsync-system/snapshot-controller/app/helm-release.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: snapshot-controller
+  namespace: volsync-system
+spec:
+  interval: 30m
+  timeout: 15m
+  chart:
+    spec:
+      chart: snapshot-controller
+      version: 3.0.6
+      sourceRef:
+        kind: HelmRepository
+        name: piraeus
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    webhook:
+      enabled: false

kubernetes/common/apps/volsync-system/snapshot-controller/app/helm-repo.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: piraeus
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://piraeus.io/helm-charts/

kubernetes/common/apps/volsync-system/snapshot-controller/app/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./helm-repo.yaml
+- ./helm-release.yaml

kubernetes/common/apps/volsync-system/snapshot-controller/ks.yaml

@@ -0,0 +1,19 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: snapshot-controller
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  #targetNamespace: volsync-system
+  path: ./kubernetes/common/apps/volsync-system/snapshot-controller/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg

kubernetes/common/apps/volsync-system/volsync/app/helm-release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: volsync
+  namespace: volsync-system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: volsync
+      version: 0.11.0
+      sourceRef:
+        kind: HelmRepository
+        name: backube
+        namespace: flux-system
+  values:
+    manageCRDs: true
+    metrics:
+      disableAuth: true

kubernetes/common/apps/volsync-system/volsync/app/helm-repo.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: backube
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://backube.github.io/helm-charts/

kubernetes/common/apps/volsync-system/volsync/app/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./helm-repo.yaml
+- ./helm-release.yaml

kubernetes/common/apps/volsync-system/volsync/ks.yaml

@@ -0,0 +1,21 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: volsync
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  #targetNamespace: volsync-system
+  path: ./kubernetes/common/apps/volsync-system/volsync/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  dependsOn:
+    - name: snapshot-controller
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg

kubernetes/common/bootstrap/flux/forgejo-deploy-key.sops.yaml

@@ -0,0 +1,76 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: forgejo-deploy-key
+    namespace: flux-system
+type: Opaque
+stringData:
+    identity: ENC[AES256_GCM,data:XdDbrb6Hkn6DkSkFzvrFf6zvxbVMOiGkdDoZwOnu5S6Fj/Ln8jeP6QxpKYqJH62J5SaFtLQs4Eb443vURFqRRZO/s9E9bDUfToFcCvTOF+DcigO03yk81wPRnu19Zr+VJK/R3d5EYfc/aDv/52mm/MnH4ytwFdN/ped7vT6zwbgWByPGtn5lN7pgsmnFSOXJvpfHrbyWva/mAntf6tRXEMO97xs9VazH9PlVrBp6y9qEsVb/EzNFLMx6VYCj/e+/wiegb0+SAUTgHbf6WrEpEtpY+RBmJqVPrK68F9oxvXNgBcBb0LWg9p81pl8QfJHDKDtDUW08mnibT+IMqiwoECwKuArvCyI7fjd/VRBRYhcHZkJwJxIbEmIxHxs9ubCMUGvBtcuKfctQ/KwkyeuAvoPeFqOJlRfYooRxF3tLutE5XsSWEI87PdU7VrGYKnYTO+9aItAK60w/BsiJbkF1xrvBcLmOJx7p1zcDNuAuYBz9QBsSUChSzwUsrGmxebN/3XAmB/n/mcp8bka7d/vtmjSpVBruVu9olg00,iv:/39YiKJ5i6LRchiElgrClE20iJuV4SF7HB95Qi7lRdo=,tag:IQCxRRHEFg5XypwjQP7VDQ==,type:str]
+    identity.pub: ENC[AES256_GCM,data:qNJjZriw2GgTMUz85E7R91n2m0cAlqWn4mZdOUgppOMGWEwxiIma4vM3YGkx2Ltt0u78rzng1KJBLSHRXvygJiQLj72+nDYqNuoSK5EQDjk=,iv:VVIX7dU/JO7mCBa/J7gBSYvNX+xyQRtKRzx/BEe0Ny0=,tag:5VO+ib7+qKX6FFefXIGODQ==,type:str]
+    known_hosts: ENC[AES256_GCM,data:MHZdra08vS1QvRWuAvmaKhHxAkhfZuznMhWvM21X6oriI8ylfeaI2Ho2DIUmToiSKGS4wZiTNiB7lMvrPBcCO/l+f2bGXFu4YdXrTLFoV3O9K9cwQRftsqAKgq+zLP5zy11Jd8Hy5J1numqhCb/DmP9AjZflDfhANckBHuDlEJiV4xitbLaMWzmgLDS34K/h1Q+u92j2OgBD5lHiHxszlTkTsqAtSdChCDExOS2Z2nMQIIRI7+E2uGlNtaQ9AhviZlREUWAxGUr8y+fK9jN/XGnaUWEjS5SXUXwtzHnBzv+t5dCtuMLQ2eOki7qcYU5jaQ2uhMrovmaYiIdEgVMtt6VQOoo/5uQx5CHzTwrbqA5lm0hMArf1ZvuzoUf6rJvRBL3KKolWW5wjb57xQxGNgkJ03SI2AYFIVrCB/glEmKK3ZEOn0AFkWTB0rchgjuKnVLuwh5Q5e7yCLrMgQdUcRZCPt0W9CEkVirmBYN8CB6Cuh5cnzXUDrmSvJxJRXFLv/RR+IOEBzQFujMSbp4WdXqZzORx/GrbFKECGuOO0srFdeE+EJVehmvX/OWqQsV21fia3VuUm36w5TjrgsyHQBB70s59RGy6XPzPbmYD/BYk4n7D3Tq7ngukbWqO7ImP0DbUEZlW+ZqEg7S/rYGbeI3oiJs36MLJnMCyXmJ0T7znPoKTZAu4MFQY2JvOcngGTq8ua1ftbQFYVQbOBcF0nkQoe81uj4S8YBziq2rT1vFfgw26OeWlwmUCWQ0i3a7US3VzoJ9D/qU4HAOrjz8REekfwLcL6rEqwSKbDl6gerye5os/iWaXHhOQDFrntc+kodgNLpI003/AXS598Wshzl1iX1FUN5N/Ak6JMKwa4Gv3om6DYiWnHETbkl/6KKtlZFfJ/b7KDjrVGIizT/CZdYegWzg/y8uzTZ9hscO+KfUqda0hg7gWzm+puMrLrVQNvWomtB5eqo6rq1sRER555HTv7ieacha+ZOrwcv1YgpKEB5fpf1vrKrMSCUbVPG/QEDp8PacLcxHpkIiC1sFW3FcvDfw1NzJ6pP4R4FAR1IomBq15+78BM7axx0LXFq8ILYKm7tw643qj5l5HYyoTYAKjji6eLXhG03l2gGeOBa2Qzu2PgudjwoT2uZvZv3MT921na2gQ1Ri8LvhFMXyw+Gvmc3PSOxigoegvWCiDlvS3cfEg7+Dl7IlpaeADWBSWT6qE3x2eYW3V6PtUjuaM/vlJm7RunMYicIB/JMK3Biw+2fhU2RlmINtA2dMDUsaOdetC9DeYltVQPY0XYlV9Kn0OpiPf6mpq2R9ceiQ1QZ4wVBijNHvWqEr92ytodUpLZPxY7qCZ0ArPAFh36YliZg43tlB1041ukqWrWqwtRGINTvGGFW57XHvBVzR0osjwS,iv:5Zi1hQ7sQQFJMB4Ynk8QfyEDco4KrSsriFYHgho6YLU=,tag:t+Z8okFnDFCvt/uLfr06Cw==,type:str]
+    password: ENC[AES256_GCM,data:fGFEgW7D5M0if8qqfNGFUP3cUCW8Nn/XsmRf0PM21vDLjrYzuOLHJA==,iv:ds829XOqukonj7fqZWO+ErK6IDGb61nCa/lwEp0P91Y=,tag:gtudo2jdx6Totv6JcUKBEg==,type:str]
+    username: ENC[AES256_GCM,data:44LM,iv:uBoSRjeqqq0CC4BRcpp2F0ua09nOI3kaWcAJA2AOFyU=,tag:cjyOHOG+hoPHc2pVvJ8+5A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-10-18T23:02:46Z"
+    mac: ENC[AES256_GCM,data:8ESBtPXyeYNjGJ8FLmslEolr/F1gq5XBAkPuPQQxm5SnM++TwbG0E2oyy8TD7FYa62l48Rsdl+o02cwAI8KFk7zcy6588Ti7IBszmkanlDZy0VqoD4rAY4WJZ2m8m0yJEx7roM7gQm0nYJGRufRyK+g2OjVh1YQBxGymnrL2Jtg=,iv:CvFWYFxHfCH8ChQp9XA6S36vswnhUBNRkfW2ZmuIvGE=,tag:Jl+vffpyK1iYzXC1lgJT+Q==,type:str]
+    pgp:
+        - created_at: "2024-10-18T23:02:46Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ//cYkEt2KpQw/5VtIM9Ym1c2i2MCSh7y+nQdzocy4RF2Iw
+            H7jR99FHl7vFfNp4tJyfz+OGnE/3B2EqDUM2bCmrp1628iQext0ExKSAheIJygPZ
+            6lMpOEBlW51BMdYxSE+PJh+F/Q7Bpnwnf5BJDkobeoKdTrItu24krFJdMjakZmwN
+            96yGH0C80rtEHHn1A2/MpgBnCBClsJx+HRdp8Tc4552uD2mYYahJmrKzh7euqJbV
+            jgCgJtL8RxBArNsDiWCCe2QuKjMCjpstuP6xS7RDMVkB7U//IrIa3D1RqQOEYzTP
+            s9HngMBuvxj6T1iHBXPYIzqr/cHMPtXd/1wJIPpICe6dThbJruPUAyg4cO/bPy1C
+            UhxWyqLKY3i3OyI9YvlXpNEyordqgVMuA9SYnLB9M7es+MjKMcHFwG0zX4hs6Qaq
+            Bozf51pzogZcjIuEM+sl54IwQsAnAWcpNGRPNtzIKf8LwEihJhfkOCRFArbuIxzB
+            8Am7CMkcQLTqN4jckdYfSELK2pUfLgV73XMcmgtUz7/NugpdvcIpByLmSz0+04L0
+            /FYWAy5rto0c5HDkF3tV+88EuThbsuYp3zQpA7QP9eH7TdZqnvE6ouhQhmxUR/99
+            4aZHHQ7sIbtscmyU9eUo6M8pCHpk7tfkp8wWQjoo99oyxE/1qfY58BonaQ4+E/mF
+            AgwDAAAAAAAAAAABD/4v3+2tYz9hkNRN11ubHqYDkLT4PB1+2YLxXUJlYr44UWkl
+            JLv1jwGdLHuGiC/nF0YQpvEU7+yMnz8JUKU1S3vdJxFm3t1qvx57iSPCgs04/9rI
+            sQHdmpYd1ejvRM7pVUrUvXFEilWxCtwU4JnSH5IlJ+43srgC2vmlIld8/oyghwc3
+            9KeN1iFabBcnbqvxdL0WCfEipFJh0gI0WeM9N+t0MahbAm2MGIkj9ZMJ9O+XZX0P
+            MgoHvfRnkFrSYadTzXX9/gF0N8GGayY/AVgcFFJIn1HFyxoB1gHP5F5/GV8YVpWP
+            W5o/v5NKYmS22LJQNdFNCgUtjjrdmeeP5SIOCDTytJEahWtlZE4xgmIfHMlbS9fX
+            c+/pSAakV9Nz39EDUUlMAyj9uoEuE0RDaSRIIzOEvVJmCy40cczpbux4vRE55CBb
+            Kpj4IW3NnRavXucVt/gtSp+jz8IEpxGjTbgAMxtTi88XZkE2mjDjH0wXGm3Cdr8E
+            +cG01WXKZnV+Rw3EEthyg9A3Yhl2dCXa+9xeuIbM7R5Ay+VUmkcuhrPxhyCMA5OT
+            +1StnHTwC2qTJnhfrgnEsRAetu/q0wGrWVj7+/2sfLgABuqqByX9l3N3mRyLG3ZK
+            HUwPYoHis00J88P2h/5q/Fg9QB6ShsOhv3kvGpr5y3vBpQ9aAwdJcg6fdSzvqNRo
+            AQkCEJL1gcVBMb6aiPKDqR1QRH6pNh7qHm9DFem7xd+5CcgF11ONq8/vlAY86ENo
+            SRqFBVYU+00cpzF+yE589J2h3PvNLpO/u2C9J5rrmmvTp9WRnvJnzW+Y521ZPQAJ
+            XrZhPjnaDkE=
+            =P5CG
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-10-18T23:02:46Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ//W/yyW7xw283FVjRldWn0DcdYmU59yL4qxFyuWWRfFTng
+            kfGc+9DkPdCBwWKQsRzc3sm8b4hU6dRL2BTRysUwc2V6QDkjGZsR/jhpBtNjB9y3
+            FbyB3KKyCOl89ADJBY+WgBuqUlHdlqyTlPDCNIQfFngiFGNQd3LZ/6fToo8ZeA3A
+            jLQA/ZB4t0umccc1O2tyG6j5/UjtSyfUrHyMahDEZ9umwsJ/xmTxT/cHVJA3tYr6
+            WAo2ZD9qJxB8knYM175E9g+4I1ZI8xrTDuXOecxXW4zLELH0RyPxNkAwCGI2L+fH
+            7CZvgxRjmsgGXK7Y7fg4mj4YLqkKkuiReUIU4DACdkVlKHTD+rkHynnOJGqn7FYA
+            D107J94rZpXZTsbpu+Sp93fzbac4tmSZmXDcfY5aYQ9hdvX+/MkInfmcpMVoYmIm
+            2xghVNii1MUqaGtvsLgXdbIGoCH6ylQA6eCWOjBISFkGgzQQKykV7PxA7QjluY35
+            0+vJfHCHriqee6KTJVGoKfgFswZYGsD/tfV4llQLQg8gmdBblBWizEp4JhRI0ZUn
+            iC5AJ9KJAmDImS/tS1hmlFBrWOFSm5NkfwYBZ8A9lKnfX7TcY1Cx5ixeNjKOHINr
+            zyhDvVgokewAc8/ggI0yE7QS4ekaeYcp9ezycSlL5/aUaNgf4EGBI/p3yG7Xwa/U
+            aAEJAhBONeevknrsrKbLCNpr1qIfR49r22EFRNTkk9HKbrau9VZTG7eQRZN1UglG
+            btfE/KdfUcz5+YnroPF3Dc5Qpjwzzi4SYLUgOwITBvzOfxkRg2MWqlUza5C+Qjgm
+            ueCa0/OcMKbb
+            =FxSv
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1

kubernetes/common/bootstrap/flux/kustomization.yaml

@@ -5,7 +5,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - github.com/fluxcd/flux2/manifests/install?ref=v2.3.0
+  - github.com/fluxcd/flux2/manifests/install?ref=v2.4.0
 patches:
   # Resources renamed to match those installed by oci://ghcr.io/fluxcd/flux-manifests
   - target:

kubernetes/common/templates/volsync/b2.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/volsync.backube/replicationsource_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: "${APP}-b2"
+spec:
+  sourcePVC: "${APP}"
+  trigger:
+    schedule: "0 0 * * *"
+  restic:
+    copyMethod: "${VOLSYNC_COPYMETHOD:-Snapshot}"
+    pruneIntervalDays: 7
+    repository: "${APP}-volsync-b2-secret"
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
+    cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}"
+    cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
+    cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
+    accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
+    moverSecurityContext:
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+    retain:
+      daily: 7

kubernetes/common/templates/volsync/backup-creds.sops.yaml

@@ -0,0 +1,74 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ${APP}-volsync-b2-secret
+type: Opaque
+stringData:
+    RESTIC_REPOSITORY: ENC[AES256_GCM,data:FgWKr+aNrb73J1m89nSL0mZ15c7sqI8+Zsc6PsfNccNx2N+ZAlEsSlyl4YgOKgKO6CI0CVglkA==,iv:uLqzK+5jfF3g/2jDFf7uSXudnAydfRTI9UhQxfBwIbQ=,tag:JMnC7YnuaLqWbGgXXjmHbg==,type:str]
+    RESTIC_PASSWORD: ENC[AES256_GCM,data:KFVHg1tT6o7TvifVT/RWPdbbtSh6WoIx68eGQ8uuGRE=,iv:XRJ2iQWrcLELy+2ACcJi2IDV16L6yA7qBhk1xmU+y8c=,tag:FpkUCPMlY9+GEvBwWvfn0g==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Cl2VoK3FKQdbmYX6CZrSTZBLHMIgR/6HtQ==,iv:CsW/T56z2tn+VLzWItTmm0QfvrztBNrVUvzF3+0thbk=,tag:ADDMdb6EYFzGCNCPomOa1A==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:+LbMKuEQGY2926sq726xeRpLlM07BGAMiPeT7HLEPw==,iv:C/mEPP2xsQI72AGtKjaCEHdYAC898QbB3wUpIcomN1U=,tag:pRF2oYFythF7b/WwysEjZg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-10-17T01:29:44Z"
+    mac: ENC[AES256_GCM,data:i5zvyCogUkQiFGKvVjh5w5fzoZTBhZRlbiTq8MhWdD3UB8Bdi8gUd2RIk2cti2rpGq+iOPowpquIGVnItirES07MQ0cW9cnS7Lntp6cNerv7mi5SV8qhAvX+43qnDsvLWfxKI/UYyEc84Z0GCT66EdlWhTk/jGrTrYuF1CLaVo0=,iv:XbFwq3GBEMxBWoJNHUxD53ws5TCpCpzclpcBGzSm7Hk=,tag:Uwmfd+Kxeihm0XSRfbM27g==,type:str]
+    pgp:
+        - created_at: "2024-10-17T01:29:44Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAARAAjTJUSRR9PHp8bSVXA+TgBgV8XcqW1R0T093FTCiHJR52
+            onK9p+nJ/z+FeG26wpWpoc5VoaV5vgHY5MMX6t9EMXU99XPdnLOX3myOSF4UHo8P
+            YG8eXuOJL2IXu6Ch58Y2W0ua++heep/bLBua8oIHDqFZyuFcmo1U2NdtrpfEyGXf
+            8uQmUYuCHwigYWbKYqzCBIZwOpRV09tLF4Xwm9f8bEVCJv09k4befiJS6mlgjKHY
+            9VzUA/Zn/ZC7iD/MuMG+Rd6yEE6DMxcBahM/bmFKKJ5S4Sax0Ij31xR1jh5jZ06z
+            AdmVz9iGcjAVcC91nsZcBttXMwCNAn0WvWRcTG5SgJQ0U0LdTp4Gnjf36zDOpqOp
+            5NgTXptL1bb16EOeC/uHjq35MvPxMfUzkogkwv1P9J9Q2NaGR337N4GwTpKPNa9A
+            j3C1j4WPSs7/N2OeeUr+KDcHFCk7vvSWblQcZ0JtErA0XsSzYWwfahKHt32fomTZ
+            ncCb/RvllQfafU1tPLco1JM08wDutTEcO11roVmItaUsuxjj+X8AgLBMnH1ajg2F
+            hbJQ37C4JFUN155VQpvUG3i+jS/aHHgeEagy2AzJoaFtF5/PU7Y14RD/F7YSD26R
+            DTSq2ysghtFXlTWK3BjgoG4nc0IuFyh1x2iae2/Z8HwkDC8o7IhtItzWnqVXQtGF
+            AgwDAAAAAAAAAAABD/9r+6dhOYiAk7V6waMcArG6oQo5vffFI0b1165DmHss/KNg
+            zWX3FMccAi8OscYavxe97ESETXN77Ix2KEz2xbh2cqzgZN0qzqsgpqCR93N5gHKy
+            58ITR0+fUq8xWK/YcSDU099Kj7M8GL5rVl00a6AFpJOni21/cbBusRlSP0tBlgnO
+            VgLZqCk3/+i4P53+XSppOR0xjxaXgihPqrOaEwRk5DlJCSHWCUneGIiNJs06KV/D
+            TX0qMkABKw3ljkTzXT8uP5qG5VhrgC00r3DQPs+FZy+O9Fapsbz0z+QTSetsxCzW
+            oNQFu/0fttfbPiMHLyrOx4I04h3Q3vqM6PfJMc/70larlGmpQQf9qANzbDDW5sj8
+            5rvV9JAJ9/YGnAIlOzuEehoY3fmyfDTWwF1aGt8oHjlTKSL9KOh7vPyso/HoCzrt
+            cSpFsxrLdryrSAyb33NLVEQrDCH/WPqnChowwt+1o6OPiHy5R21r9Pt7BWRVX/AS
+            T6DEXXpLicYeJABFT8U+emXLBPo3fMOADLTnH48J4PNlCiWObDGOPBT/4e/n07wf
+            9GidDBEvCDOftOxaK2sGpkJ1ZDFZuDUaizP1Vu1NVl0IVj8r1H8a6C1y7qIEDyST
+            1MH5GrabRX6MfFOjXd0NFmXuPchXxBqwg+ZCuqeSWbVQA6TlJBHE2CY9uQTZa9Ro
+            AQkCEBBUfKvzmguNcG4GxZFeqK15yj2FYFLIS3duuUbaOAz5etAHadtB0z+cBwPt
+            Z5QwxEU/8Uf4JxzMSWyHVirPgxYGd0LWbiV1shiwm81cudQtpSOJeV4wYE1y9rZP
+            uqtwSypCwtA=
+            =Gd8M
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-10-17T01:29:44Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ/+JzeuokOO0qdLb1HmZoNiL17dYHUFGBLqs8td4uNJRhwQ
+            CafrelpvuC0KhpEqxnfmsnBgZkArpzabtQN2VipkI3+bJFnBftyzXr84UTeM8MzX
+            DYs6JNQ4+LujxAN0h1K17wTw9HL2azujfhC+IHmQog7lOg7DlKTIk1NuVfG6u/bt
+            AJYJfwj125UU+eHrAPmg1NBYbPhvqJbEC3FZ94SN8saNSRazU7OdXDHoiz3ZWisS
+            SgDgesTeS+MZev7y1TdlX9XIs4X/4xdaE/DLiwQSB/n53lghyFj8cDu/n2oIh/Uf
+            APmlQ/CPUXXn12RgIb2hZPfdBieiBSekR71iC8ZXptm14BoycTCzX/lN+rYmQbH4
+            GNY7d7IPZUO5+jXXAaTtM7rNS4VsEDILN8aTSgrxNoD1HoeB76po8fvaVNnh/FuA
+            5a8LEDeNMzYwJdWLsnUudtPCofQmFRyM78JLj47Bi0ovhWLeN651sgG8/UEubC3x
+            VMoTDUO+MR6P+YVvla9hGTp2k+3bVjW4nNT4OL7aAflYmbGAGlLmRjeLV5HmEMr3
+            ftYSdIg337Kj+Aw7mpUuFXKCn8hAbxIWjyeA/L0xEhnlygBVCeRCWyABmdztXYyg
+            1732VWWiT3wyMY6QWPL9fyVNKv0rNl+76xwzbbtiXtTVZuL2OEqlse4rXzxbbZvU
+            aAEJAhDflMnNROqHuqiqOmm85rN/Hkdunmt60dq3fz8ROhNJwD8MN1sMYcSZAe+B
+            LlP/sYD2M0Vt8aLN041GstmIfq2p5hAMMKPnmo+IxHfoGUnVi0UbNbOF2lyRm1XT
+            C0IsI8I1ccHR
+            =KrSe
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1

kubernetes/common/templates/volsync/kustomization.yaml

@@ -0,0 +1,9 @@
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./backup-creds.sops.yaml
+- ./minio-creds.sops.yaml
+- ./pvc.yaml
+- ./minio.yaml
+- ./b2.yaml

kubernetes/common/templates/volsync/minio-creds.sops.yaml

@@ -0,0 +1,74 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ${APP}-volsync-secret
+type: Opaque
+stringData:
+    RESTIC_REPOSITORY: ENC[AES256_GCM,data:JQZci/kqmOyRURSMmPBJqrzaJN0xti+BZVgbcgHC9axiq0qoNrumJHGL8+ffyd7q,iv:nG1cokfJKkmmMuwch64KxQ4/eG6OE76pypQFqUDf650=,tag:xr3DhMBsWFf2cjrPLRC1AA==,type:str]
+    RESTIC_PASSWORD: ENC[AES256_GCM,data:9IOyIGO6TCoeRserdXs6V1vnTBI2n65ChqpBECgX5Kc=,iv:GCwhW9pFAx8GwvxvR81s3+Ippt7YPYVSSVuFmKMjjdU=,tag:YytjzuPbkU+Gh0h67eS76A==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:MjXpPFMdpxyZdg/sHhp50g==,iv:r5bHD7usqnY3M1jn40CG79ed6eOiLRJaCNHDGyixJ2E=,tag:pFRELVZmsS9/HztqAuDc8g==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:6ZQwXEXSyMQGZmnf4zEVyCzeWIZKoshheIgu2WLmDeU=,iv:+ETwZmOJaDlH7CC+zNQc1NqbOfoVV+jT5zPEP2cCA0Y=,tag:l1V2LHN0RgeMSImga5zDaQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-10-17T01:29:50Z"
+    mac: ENC[AES256_GCM,data:6acDu36pbKhN3j2k4XkOU1zPlT1tGWOxwtyPKEDWLu1FMvL5Sk/xdJh8OT0MqNsgagO2bk0kvgHh3YhM3NErXalJx0HSwCUOKpHikN2OMQg02X+u2zUMRMsOblkzZWfY6XWAQD0PWxpnAV9ndVtB68gPCN5lX3Ios1n0zzqhFNk=,iv:QIlc3hiCsrQdM0LBBVqYau9QBJxVyArG1o2+3F6NgLA=,tag:wqaWWnLRthJAqfRKyl401w==,type:str]
+    pgp:
+        - created_at: "2024-10-17T01:29:50Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAARAAxDMPYaG4/Vq1UZnM2yx9QXu6D2ZlnAg3/A0xu8rbbise
+            YPc+PEIjvzXoQE7sFmcLCjPDWU23Mj5jMxq9QLt05cpt9EGMyvcGEqmYEcZFYalI
+            ROgc0rQwg57hkqA6JJRExtJUfqB5MQSS7BqkCtrUvvxZNq340l3oBzLXBmE9vS7C
+            JYqiNx8eJfv7AcVow5/R8kiFBCqI9VhOMr8VxNLcX5iA/pdL3HaQXph0LN3FvBmF
+            cPLHdooHODgR77ucYiVZT+pT5weSLJ4NND8VgAw8oN2vJ3xCu4G2xIcWq3q4u9SR
+            t3brI9qZcxN50PcJhNmRQVDLm3zXWoHTJ8/40KgTn1luRx+VaQTSzxjCe+KComdD
+            mFnma1lWIyji7JkCe5Mro5YVocInZrNACdVHmE/tl5qhSM4Qv1OBfTPYeMoW852z
+            7oKxgnfluKqkNjnWDL6yCaHvpJFDbYz3wqfa2D+Ci0t6BNp7vA0qWTxRqGzXVKc9
+            YRz1QE1AIoQ8Y93UVJe6JBODgbtZ11FuEJsIJIeB3SXF9nzP5n+jsP/G5kA5P5vj
+            IfwMTblIZ3dov0uZXhg6a3aSAGn2VcGLoxvK/I96c2VYvY9LAA4KJz9R8wDTagFg
+            +HEe3BgXkgrnNVD58NLpYOBbch+hDuqkuGh+a5qqFZ3h2yySwEWy+6bcnqG8yQWF
+            AgwDAAAAAAAAAAABEACYFHrG0SrtyiykAqyf/dMPZ35fyI7aHfr4ABZNMC71Kulu
+            haAqOYWgkhpjQvTe9PqMI6EtEJGya0iVkTtNLV0O2B1/8apXz298xxaR7S5JPpAI
+            +GKjugAB9atRnf69FkN58PNcL8TJpNsrR3CiOX6Bbjc5DCkQMpDIgny9mO3mwlHa
+            xvaS9o3DYgo9UvKWptvpiJKC8ve47eX/cQmUZjPMpUGUYpUGSeK8oJGQl4hgAnC2
+            pXz89ZTM0rTp/YW123wO4OPvJ4lMpitzG73Gbmd1vUOk+5IpVaI+q6a0VYXVeAEU
+            ol+l84h5jhNSR38sYfTD9fCzXvK/49sBhf7kWG+pH6dnmpO/hqXMXOREXlnkC10m
+            uU5LieRX0otYgiPs9pMCSLRSa1my8UsHNdM6eVMsn0+Ji7UFoIYAnq79cdVeKDHN
+            Q5YNF+i1cKPnNarIU4XOqVny7t2YE7B01j3PDYbrp3W5yMAoAF4j9uQ8h7XEX7y4
+            SlKO8HYcuYTIWcTm+L8FTZMVrQS2cn9HnyZfCxHHD4vbmxAO6hmWodAJv1rFBLYj
+            yO/4L/MyEVCSnE94vUudR79oQ+6qJOWZypfCPiqn2HVDiHvmbf/Iwc1v+v/GZkFX
+            6wTqkJ8oi4nGuFU0AfYJG6ENEEmz1dpvnXLIy9vDWq98vrBPFrqOnrTgd6eQQNRo
+            AQkCEHVlPi7Sn/dhXhcIgGiQzV45MPoo47FSQ+AjjPh6tzIZPj2dcDDdM7TBYGsF
+            KEknmv9JOX+Web9E9O+n9uJY6RM5zWsf1JNJ5EGMYgQ54wwgoO3DRs6ikg1Bfozb
+            rXV9iM2Pens=
+            =jPuh
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-10-17T01:29:50Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAwAAAAAAAAAAAQ/9EfpjOanGUTYg4qCnwmykiGcEqVmGSj9+aJ4PdrPcLuqe
+            IiZavUGQXhh9kviR8oRRXzwpQeyWQmYNdeKjL1f1sj635I0e+quSh5Y21UsBjYHm
+            EP2JnmTlDAWYL02FKrZ9OqSfeoI2tdObWjBzC5cDnUiIbJ40abuFcI3wtNqx8MZf
+            x4V9j17FYejDIRIShSzm95TfVbcadX6BAsDHO7zjpgi7jtpeYtBa/7/s+dHyiPoJ
+            ZWQ2HD4fzRtfiah1sJl9GrvWK+BAyRkbO2C3Ob0nNTWjujWYQkJYhQb4f5DYbMka
+            B481UqDcj1hssTU1w7TmaYl2s8QxwSdfa1yIm4GaRofmKW67MMIynksFRPz40p+5
+            DWAcDoRshY8yi+EvSMUA0h2pstGo0kV1zqYwkDN1Gl2/D5zn2SnkbKuytLAzjUTe
+            sxWf1TTqXF4bvfVGIo+It6saIfMOKtUeIxnwbc+6lb95Ah9YEaMY5RtAmEgMF6m7
+            +c4+NyGCJ/A2E26pLDOWf1TwbomlqwR3ertq744hLgOja23DJgMhZDfSWjjwVj79
+            vDj9E5/3HRNOrC/J0HTaqq6wxh5LD8jY/INNi3+BDWWiQ3YJ4c7kjwgrwp297PiS
+            QtRQel3QIlrdpQSydDs3mhWs1RMPiCzkjatq0eQVvl/zkxlw1qpbslPEpOR8JI3U
+            aAEJAhDMV7aqU+viKvHsxGgEEDyfd2Mj1/FQtE5OA5+9GL/Y42AyV4fFct2bdhTO
+            +e1Ry5EE7Y8PMK9/HAjn78XY4hkqf8wIPaooL8Poq6Lq9Ylt+KVq80IFYgS8LXOS
+            nYrbk7kpGaUp
+            =n3YG
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1

kubernetes/common/templates/volsync/minio.yaml

@@ -0,0 +1,51 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/volsync.backube/replicationsource_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  name: "${APP}"
+spec:
+  sourcePVC: "${APP}"
+  trigger:
+    schedule: "0 * * * *"
+  restic:
+    copyMethod: "${VOLSYNC_COPYMETHOD:-Snapshot}"
+    pruneIntervalDays: 7
+    repository: "${APP}-volsync-secret"
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
+    cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-4Gi}"
+    cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
+    cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
+    accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
+    moverSecurityContext:
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+    retain:
+      hourly: 24
+      daily: 7
+      weekly: 5
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/volsync.backube/replicationdestination_v1alpha1.json
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: "${APP}-dst"
+spec:
+  trigger:
+    manual: restore-once
+  restic:
+    repository: "${APP}-volsync-secret"
+    copyMethod: Snapshot # must be Snapshot
+    volumeSnapshotClassName: "${VOLSYNC_SNAPSHOTCLASS:-zfs-mainpool}"
+    cacheStorageClassName: "${VOLSYNC_CACHE_SNAPSHOTCLASS:-mainpool-hostpath}"
+    cacheAccessModes: ["${VOLSYNC_CACHE_ACCESSMODES:-ReadWriteOnce}"]
+    cacheCapacity: "${VOLSYNC_CACHE_CAPACITY:-8Gi}"
+    storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"
+    accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
+    capacity: "${VOLSYNC_CAPACITY}"
+    # moverSecurityContext:
+      # runAsUser: 10000
+      # runAsGroup: 10000
+      # fsGroup: 10000

kubernetes/common/templates/volsync/pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: "${APP}"
+spec:
+  accessModes: ["${VOLSYNC_ACCESSMODES:-ReadWriteOnce}"]
+  dataSourceRef:
+    kind: ReplicationDestination
+    apiGroup: volsync.backube
+    name: "${APP}-dst"
+  resources:
+    requests:
+      storage: "${VOLSYNC_CAPACITY}"
+  storageClassName: "${VOLSYNC_STORAGECLASS:-openebs-zfs-mainpool}"

kubernetes/main/apps/authentik/app/helm-release.yaml

@@ -1,3 +1,4 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -10,18 +11,21 @@ spec:
   chart:
     spec:
       chart: authentik
-      version: 2024.6.0
+      version: 2024.10.4
       sourceRef:
         kind: HelmRepository
         name: authentik-charts
         namespace: flux-system
+  dependsOn:
+  - name: redis
+    namespace: database
   values:
     global:
       env:
         - name: AUTHENTIK_HOST
-          value: &host "auth.${SECRET_NEW_DOMAIN}"
+          value: http://authentik-server.authentik.svc
         - name: AUTHENTIK_HOST_BROWSER
-          value: *host
+          value: "https://auth.${SECRET_NEW_DOMAIN}"
         - name: AUTHENTIK_SECRET_KEY
           valueFrom:
             secretKeyRef:
@@ -51,7 +55,7 @@ spec:
           cert-manager.io/cluster-issuer: letsencrypt-production
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
-          - *host
+          - &host "auth.${SECRET_NEW_DOMAIN}"
         paths:
           - /
         pathType: Prefix
@@ -84,7 +88,7 @@ spec:
         enabled: true
         environment: "k3s"
       postgresql:
-        host: "postgresql.database"
+        host: "postgres16-rw.database.svc"
         name: "authentik" # database name
         user: "authentik"
       redis:

kubernetes/main/apps/authentik/ks.yaml

@@ -0,0 +1,26 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: authentik
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/main/apps/authentik/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: cloudnative-pg-cluster
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/main/apps/database/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
 - ./namespace.yaml
 #- ./network_policy.yaml
-- ./postgresql
+- ./postgresql/ks.yaml
 - ./redis
-- ./minio
+- ./minio
+- ./mysql

kubernetes/main/apps/database/mysql/helm-release.yaml

@@ -0,0 +1,30 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mysql
+  namespace: database
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: mysql
+      version: 11.1.20
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami-charts
+        namespace: flux-system
+  values:
+    global:
+      defaultStorageClass: mainpool-hostpath
+
+    auth:
+      existingSecret: mysql
+
+    metrics:
+      serviceMonitor:
+        enabled: true
+        labels:
+          release: kube-prometheus-stack
+
+      prometheusRule:
+        enabled: true

kubernetes/main/apps/database/mysql/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./mysql.sops.yaml
+- ./helm-release.yaml

kubernetes/main/apps/database/mysql/mysql.sops.yaml

@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: mysql
+    namespace: database
+stringData:
+    mysql-root-password: ENC[AES256_GCM,data:8wAhBPa9CQTEj87SorjQj2GmY3E4jxbR0JAzOk0u7r8=,iv:6hv8qftod56M3udqao1MxADcrSlDMsfz2YtFLWzrzVM=,tag:kEXOtDAQg2xRzZz/csSatg==,type:str]
+    mysql-replication-password: ENC[AES256_GCM,data:cHdCVcP7+Y48e3SFzZCf9Q4peVGxhIVFFVuUwwFrGDA=,iv:GBNAFzvQUHtidYgpNKiEPWABIwVk9muEFRLaYBZbFDM=,tag:3B35mjWJV1MQ0ASZuoyyPQ==,type:str]
+    mysql-password: ENC[AES256_GCM,data:D/fW2cAMiurBixcJRCTJUmlvr0kEmTnMsgVM8xKTu18=,iv:bc+7P0cGJy+6YR1I6mzSAq6gGiEH6uOKdmSjYkdoWxs=,tag:hEDAyGpDQCKbgA9XvGeL4Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-08-05T15:30:54Z"
+    mac: ENC[AES256_GCM,data:ni1zA28zwCp6Fvqv5FtET/ylqOV6L/IXl4KtVo73aIDunlI29qD0cpTbFMPh4bxHqqYUsa/EBF+we5kglLQzP/9qnVrNXCNZnWbkCIsVlghMOLGqVFi7CJFc42ghNGQD9BVj5115VGSX3D05x1a9JI070AoEYQ+/OgLuZf0XxDE=,iv:bi33L8MotNRkg5+WAsXE8a0RlPWfu2rCnA/WaOnHsV0=,tag:7rTzgiDKtPsfCF+e7T5ABQ==,type:str]
+    pgp:
+        - created_at: "2024-08-05T15:30:54Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAyqlIeyoxYovAQ/8DqfstkJgwoIrbTVbVBQheBfPoNl+6iV1IxctfXsr+2CF
+            rY9gV1qxOVh/E0hHyOws8F6EE+oCdbHtsGBa/1KiN0HBY55HFRm9LXF5s5EKOEWg
+            bXg0Gyoqvfny31+UAGAIW91yAGJ07jp4u3oj8RGKHF7sLcuCrk5NfajK7ALzG6hp
+            vpbXenT2D4xxsWqdhkY7azwrqqPC0XyWx2XkFscED2PzwTpT1gPALrtdhknVlCtE
+            azyPtVIg2swt3kWm5bsYJgOHhnnnDTEX412XXJTqQUmmZCTAeKRIo0xtG9Kicujy
+            gzIhxQd14i7jniYzj8uNkNWEaIBfehSqQM+IWRSB6AgV5AnalDudgSyN2R7yDi2a
+            vLt+H1UuESlfuYmqQgG9pDrJG1nigWxMhexm6Ykdz3LnSbzcrkJ9/sCXg0ZCwFok
+            RYMajxB2nHTvQBCSCSqFPzgViDYlv83Vck6vHGma3Lyhe2YDBIGC8bXNmRS92xl+
+            FkbssELrtFdxj8cbQ3WTBU33CdTs6EglSmBSJ+E8SkU7Bok09k4uXK+ZdSkq2pdI
+            I7ZSJufUmKjhvR9l6nSX0/dOOkkvtyDVdB0pPCz5WdwJBS5lInbbUMB7sU71pXor
+            swpHeQaED/BlDcxFIRKAneAfTpBgVzhoPnDnN1xYriLdsZ9kND3KzsXNaT9JeqWF
+            AgwDXjg0p2IN1X8BEACtnlSJlSqalmdhXWD4lKMiz+uQVGaHJty5Rw7CHiFLI7rU
+            wIMnZXQNCiQY+boTaQNe8VqeZ91ptsaIr+2VTrs2gGFbWccQQHwdPN582V7BSQiv
+            mdkxJhE69TTXyu4R/ycDuIgAtXpRA8pLcWsSRWkYtjzKC9Um8y7S+yqsMKCGyTjd
+            gU1mUPrPCJeh6/bThMiowfkIT1GPh4udBSQp6aFW2MOzFySOgphxXPC866lW42T6
+            aCN3n8/kpkc9SKUklUlxt0SKuoghC9NF5pIKANpKWNLrpHv3Y+UXqQt5FIjQLJe0
+            eUGZEkOpihaldG5ObOY9ddRvbnGhaJiK6UXDa5PSCVYG9Fxk9Tw85TKJNbBqd18W
+            A0cj8+CL5eJo+WM91oVbsr4MwE3lKGogVd/9nnylvy8hamoD08A9EN3uf4aqbsTE
+            S5HvHca80WjjMo6LrwcBz6N0RFwQggNT998Mlvb/JRN0Km8EfgDKBbjABBvCHPg7
+            SALnnZNgQbb3Cg3JS7Z9Fe4pKHyUxf6zJsGui0rmFa4r8xrwIkrHSUGk5I431Nkk
+            RS+ppU+Y/Pew0tE7rc2PkzM6lYexphFnViwQZqpHc9EHy2QffN/YkqaFuvIsSbs/
+            fbnJFNgYyW3l2u4Iiaf1UKKkpHRTF6W8UPTblsec9USJperDADkk5aKMV3W0WNRo
+            AQkCEEpvhrTP6NE+ay6COZGVai/ESvAF7ovx14AS2sMwaB9JPEcUG/S+cbMByDmo
+            sc4vHi3BpDxLgltUyUHC2gGkFbc6s9afM8Bd3Ut8jiLPMayhGGpe0natHoo5xz6p
+            Qktw4dL+mCQ=
+            =jZC7
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-08-05T15:30:54Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VARAAuoptUmFjfyG7uDw42T68nvuetOcF/Zr8hvfcNOtZXFM3
+            L4tgIBc9H5dg1S+XeFM1QweMiJdRhzXsUmLXhIFC9Bj+jaVcS5xHQ4RGcHRYBbeV
+            ssoG7hbgESBAvXW7+AUySp9vyn97dasFlb67uuBeLhTl2NImh5OY1sLsrjBPIJVv
+            SU+LPQqSn37kdrN/Ui3llGv2mVPioMovCEJG2EWykFrk7ameLmkznYYysiJ5WIx2
+            PIavyLm/E4KG3EuV/6mCDnLMocQwLkIyVkOR/GGesaZPpI9OkeN42EXyPUKeWyc5
+            52CbiR8XeRjMuQSF6zqYfat0npz+hO8mdAJLTVcoTzP2BaA78dxg7kpYxVLNTS5b
+            8hv/ndIWQr6P3fi9lzIpQOqHQ5HU7SoZm8oZeXmZWejyn5+j9omTkKmIpzZ91SHW
+            c6eDCeG5Aq5s9Vp6CuQQ+vHpEEEiX8SNdqkEoDtcIVYd1/LZLBdN2JxW9zFi1yGJ
+            HW2Dcef+sN3ide7tIgZ4fHogV9WUaaJBcvXsbDcXxAZk5Kw/ejFwCznZry/u9PQP
+            uaAVKuD9q4XdI4sMBdbr1yqXnkUBVDRVnqNLu5Upu2S2CnPJlOYUvqkR+nqcRdwz
+            W+cGMCyzL+s/8wfi3JRrcrbmnp8aVR9aZEthZnn5M9LPF/PfVOIka9H7QArC+UHU
+            aAEJAhB5SM7t19txEM97n6VHwEYZ4ya9i7ntC1mPx3ORTGAToSQFVvNXtXfsZOYc
+            WRxBcRKBsWj/p1TCh66mvrSDE33bthrvZgWBJunXFOVwXDmVNbWEi20lgu6/IFUJ
+            fMdLui4jsCVY
+            =uQ7o
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

kubernetes/main/apps/database/postgresql/app/helm-release.yaml

@@ -0,0 +1,37 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cloudnative-pg
+  namespace: database
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cloudnative-pg
+      version: 0.22.1
+      sourceRef:
+        kind: HelmRepository
+        name: cloudnative-pg
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  dependsOn:
+    - name: minio
+      namespace: database
+    - name: openebs
+      namespace: openebs-system
+  values:
+    crds:
+      create: true
+    monitoring:
+      podMonitorEnabled: false
+      grafanaDashboard:
+        create: true