chore(kapowarr): change data path of kapowarr

Reviewed-on: #491

.github/renovate.json5

@@ -0,0 +1,209 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "docker:enableMajor",
+    ":disableRateLimiting",
+    ":dependencyDashboard",
+    ":semanticCommits",
+    ":automergeBranch"
+  ],
+  "dependencyDashboard": true,
+  "dependencyDashboardTitle": "Renovate Dashboard 🤖",
+  "suppressNotifications": ["prEditedNotification", "prIgnoreNotification"],
+  "rebaseWhen": "conflicted",
+  //"schedule": ["on saturday"],
+  "flux": {
+    "fileMatch": [
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
+    ]
+  },
+  "helm-values": {
+    "fileMatch": [
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
+    ]
+  },
+  "kubernetes": {
+    "fileMatch": [
+      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
+    ]
+  },
+  "kustomize": {
+    "fileMatch": [
+      "(^|/)kustomization\\.ya?ml(\\.j2)?$"
+    ]
+  },
+  // commit message topics
+  "commitMessageTopic": "{{depName}}",
+  "commitMessageExtra": "to {{newVersion}}",
+  "commitMessageSuffix": "",
+  // package rules
+  "packageRules": [
+    // automerge
+    {
+      "description": "Auto merge Github Actions",
+      "matchManagers": ["github-actions"],
+      "automerge": true,
+      "automergeType": "branch",
+      "ignoreTests": true,
+      "matchUpdateTypes": ["minor", "patch"]
+    },
+    // groups
+    {
+      "description": "Flux Group",
+      "groupName": "Flux",
+      "matchPackagePatterns": ["flux"],
+      "matchDatasources": ["docker", "github-tags"],
+      "versioning": "semver",
+      "group": {
+        "commitMessageTopic": "{{{groupName}}} group"
+      },
+      "separateMinorPatch": true
+    },
+    {
+      "description": "System Upgrade Controller Group",
+      "groupName": "System Upgrade Controller",
+      "matchPackagePatterns": ["rancher/system-upgrade-controller"],
+      "matchDatasources": ["docker", "github-releases"],
+      "group": {
+        "commitMessageTopic": "{{{groupName}}} group"
+      },
+      "separateMinorPatch": true
+    },
+    // custom versioning
+    {
+      "description": "Use custom versioning for k0s/k3s",
+      "matchDatasources": ["github-releases"],
+      "versioning": "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)(?<compatibility>\\+k.s)\\.?(?<build>\\d+)$",
+      "matchPackagePatterns": ["k0s", "k3s"]
+    },
+    // commit message topics
+    {
+      "matchDatasources": ["helm"],
+      "commitMessageTopic": "chart {{depName}}"
+    },
+    {
+      "matchDatasources": ["docker"],
+      "commitMessageTopic": "image {{depName}}"
+    },
+    // commit messages
+    {
+      "matchDatasources": ["docker"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(container)!: "
+    },
+    {
+      "matchDatasources": ["docker"],
+      "matchUpdateTypes": ["minor"],
+      "semanticCommitType": "feat",
+      "semanticCommitScope": "container"
+    },
+    {
+      "matchDatasources": ["docker"],
+      "matchUpdateTypes": ["patch"],
+      "semanticCommitType": "fix",
+      "semanticCommitScope": "container"
+    },
+    {
+      "matchDatasources": ["docker"],
+      "matchUpdateTypes": ["digest"],
+      "semanticCommitType": "chore",
+      "semanticCommitScope": "container"
+    },
+    {
+      "matchDatasources": ["helm"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(helm)!: "
+    },
+    {
+      "matchDatasources": ["helm"],
+      "matchUpdateTypes": ["minor"],
+      "semanticCommitType": "feat",
+      "semanticCommitScope": "helm"
+    },
+    {
+      "matchDatasources": ["helm"],
+      "matchUpdateTypes": ["patch"],
+      "semanticCommitType": "fix",
+      "semanticCommitScope": "helm"
+    },
+    {
+      "matchDatasources": ["github-releases", "github-tags"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(github-release)!: "
+    },
+    {
+      "matchDatasources": ["github-releases", "github-tags"],
+      "matchUpdateTypes": ["minor"],
+      "semanticCommitType": "feat",
+      "semanticCommitScope": "github-release"
+    },
+    {
+      "matchDatasources": ["github-releases", "github-tags"],
+      "matchUpdateTypes": ["patch"],
+      "semanticCommitType": "fix",
+      "semanticCommitScope": "github-release"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["major"],
+      "commitMessagePrefix": "feat(github-action)!: "
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor"],
+      "semanticCommitType": "feat",
+      "semanticCommitScope": "github-action"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["patch"],
+      "semanticCommitType": "fix",
+      "semanticCommitScope": "github-action"
+    },
+    // labels
+    {
+      "matchUpdateTypes": ["major"],
+      "labels": ["type/major"]
+    },
+    {
+      "matchUpdateTypes": ["minor"],
+      "labels": ["type/minor"]
+    },
+    {
+      "matchUpdateTypes": ["patch"],
+      "labels": ["type/patch"]
+    },
+    {
+      "matchDatasources": ["docker"],
+      "addLabels": ["renovate/container"]
+    },
+    {
+      "matchDatasources": ["helm"],
+      "addLabels": ["renovate/helm"]
+    },
+    {
+      "matchDatasources": ["github-releases", "github-tags"],
+      "addLabels": ["renovate/github-release"]
+    },
+  ],
+  // custom managers
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Process various other dependencies",
+      "fileMatch": [
+        "(^|/)kubernetes/.+\\.ya?ml(\\.j2)?$"
+      ],
+      "matchStrings": [
+        // Example:
+        //   k3s_release_version: "v1.27.3+k3s1"
+        "datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( repository=(?<registryUrl>\\S+))?( extractVersion=(?<extractVersion>\\S+))?\n.*?\"(?<currentValue>.*)\"\n",
+        // Example:
+        //   - https://github.com/rancher/system-upgrade-controller/releases/download/v0.11.0/crd.yaml
+        "datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\n.*?-\\s(.*?)\/(?<currentValue>[^/]+)\/[^/]+\n",
+      ],
+      "datasourceTemplate": "{{#if datasource}}{{{datasource}}}{{else}}github-releases{{/if}}"
+    }
+  ]
+}

.sops.yaml

@@ -1,5 +1,7 @@
 creation_rules:
 - encrypted_regex: "^(data|stringData)$"
+  # BD1A: new gpg key
+  # 6878: in cluster key
   pgp: >-
-    2CC2B3631D5C3393901335DB68F95C5D753EE1E5,
+    BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD,
     687802D4DFD8AA82EA55666CF7DADAC782D7663D

.taskfiles/Flux/Taskfile.yaml

@@ -0,0 +1,22 @@
+---
+# yaml-language-server: $schema=https://taskfile.dev/schema.json
+version: "3"
+
+vars:
+  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/sops-key.sops.yaml"
+  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/forgejo-deploy-key.sops.yaml"
+
+tasks:
+  bootstrap:
+    desc: Bootstrap Flux into a Kubernetes cluster
+    cmds:
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/common/bootstrap/flux
+      - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --server-side --filename -
+      - sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --server-side --filename -
+      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/{{.CLUSTER}}/flux/config
+    preconditions:
+      - { msg: "Missing cluster sops key", sh: "gpg -K 687802D4DFD8AA82EA55666CF7DADAC782D7663D" }
+
+  reconcile:
+    desc: Force update Flux to pull in changes from the Git repository
+    cmd: flux reconcile --namespace flux-system kustomization cluster --with-source

Taskfile.yaml

@@ -0,0 +1,18 @@
+---
+# yaml-language-server: $schema=https://taskfile.dev/schema.json
+version: "3"
+
+vars:
+  CLUSTERS_DIR: "{{.ROOT_DIR}}/kubernetes"
+
+includes:
+  flux: .taskfiles/Flux/Taskfile.yaml
+
+tasks:
+  execPostgres:
+    desc: Exec into the postgres pod as the postgres user
+    cmd: kubectl -n database exec -it postgresql-0 -- psql -d postgres -U postgres
+
+  execMysql:
+    desc: Exec into the mysql pod as the mysql user
+    cmd: kubectl -n database exec -it mysql-0 -- mysql -u root -p

cluster/apps/authentik/helm-release.yaml

@@ -1,93 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: authentik
-  namespace: authentik
-  labels:
-    needsDatabase: "yes"
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: authentik
-      version: 2023.3.1
-      sourceRef:
-        kind: HelmRepository
-        name: authentik-charts
-        namespace: flux-system
-  values:
-    containerSecurityContext: &securityContext
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    worker:
-      containerSecurityContext: *securityContext
-
-    geoip:
-      containerSecurityContext: *securityContext
-
-    authentik:
-#      secret_key: "${SECRET_AUTHENTIK_SECRET_KEY}"
-      # This sends anonymous usage-data, stack traces on errors and
-      # performance data to sentry.beryju.org, and is fully opt-in
-      #log_level: debug
-      error_reporting:
-        enabled: true
-        environment: "k3s"
-      postgresql:
-        host: "postgresql.database"
-        name: "authentik" # database name
-        user: "authentik"
-#        password: "${SECRET_DATABASE_PGSQL_ADMIN_PASS}"
-#        port: 5432
-      redis:
-        host: "redis-master.database"
-#        password: "${SECRET_DATABASE_REDIS_PASS}"
-    
-#    prometheus:
-#      serviceMonitor:
-#        create: true
-#        labels: 
-#          release: kube-prometheus-stack
-#      rules:
-#        create: true
-#        labels: 
-#          release: kube-prometheus-stack
-
-    env:
-      AUTHENTIK_HOST: &host "auth.${SECRET_NEW_DOMAIN}"
-      AUTHENTIK_HOST_BROWSER: *host
-    
-    envValueFrom:
-      AUTHENTIK_SECRET_KEY:
-        secretKeyRef:
-          key: authentikSecretKey
-          name: authentik-secrets
-      AUTHENTIK_POSTGRESQL__PASSWORD:
-        secretKeyRef:
-          key: pgsqlUserPassword
-          name: authentik-secrets
-      AUTHENTIK_REDIS__PASSWORD:
-        secretKeyRef:
-          key: redisUserPassword
-          name: authentik-secrets
-
-    ingress:
-      enabled: true
-      annotations:
-        cert-manager.io/cluster-issuer: letsencrypt-production
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-      hosts:
-        - host: *host
-          paths:
-            - path: /
-              pathType: Prefix
-      tls:
-        - hosts:
-            - *host
-          secretName: wildcard-main-tls
-
-    monitoring:
-      enabled: false # temporarily disable monitoring

cluster/apps/authentik/ldap-outpost/helm-release.yaml

@@ -1,70 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/goauthentik/ldap
-      tag: "2023.6.1"
-
-    env:
-      AUTHENTIK_HOST: "http://authentik.authentik:80"
-      AUTHENTIK_INSECURE: "true"
-      AUTHENTIK_HOST_BROWSER: "https://auth.${SECRET_DOMAIN}"
-
-    envFrom:
-      # Sets AUTHENTIK_TOKEN
-      - secretRef:
-          name: ldap-authentik-secret
-
-    service:
-      main:
-        enabled: true
-        ports:
-          # Disable http port
-          http:
-            enabled: false
-
-          ldap:
-            enabled: true
-            primary: true
-            port: 3389
-            targetPort: 389
-            protocol: TCP
-
-          ldaps:
-            enabled: true
-            primary: false
-            port: 6636
-            targetPort: 636
-            protocol: TCP
-
-    probes:
-      liveness:
-        enabled: false
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: false
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 80Mi
-
-      limits:
-        memory: 500Mi

cluster/apps/authentik/ldap-outpost/ldap-secret.sops.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: ldap-authentik-secret
-    namespace: authentik
-stringData:
-    AUTHENTIK_TOKEN: ENC[AES256_GCM,data:qBh9rgEbGBQj9yO1MVdtZtzdyhYdfTpsHUzeQd6RSDZsOEhRB2AMVXANoVh+EHeKnDdL6G4TQrsmIVZc,iv:0sFEKTyZOoR0IFGdroFCuyDBdPszqnlkYtV1nL+FCPE=,tag:bVc2MvsE0ePnBBfdc88Fqg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-04-09T19:41:26Z"
-    mac: ENC[AES256_GCM,data:SV/xyF9z5exA50GG3WJtaaGLaQ4s4eojEWR/UoDOcx09QcDtuRxtS/O0QPptQh4BoF1STIR+JuG9Yod7buVaVtbH8RQ9KimBWIEKHR8kuRl1AAXJiX4/Sr3xyD3k52oM1BIBpLKu4Osw7uG/+7so2l/vEHPlS1g3188yW6ICqH8=,iv:EPltYcBP+j+9z6JTZgrp26JY+yAkamZwUhn7We+hesk=,tag:0iwERzh8mJtSOm78FSQ9Ag==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:35:37Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixARAAnO7KxtJ9tnguhyxu5oSa9HsLsxsxldLjSfMk4nutZfDo
-            vpreFt/KjSrlyTlCro1zIjhZvJGnWaz52FrwTAO8rk/2imId+2V3xyU5Ng2XnQbS
-            +neRZs/jtfMpUNfux/sGXDtBFp01eAzsu2+PqAVXzlZC8nk+WdBGmwGJSUNxKZ3B
-            e0WSFV54Y9j84Zn/4u8bTk2EVth33fY7jQk9gXUH6bxCgWGQS+kZDoxcxiZRd2lF
-            svDfZbefgvTCDMxOIUweA2s4KHwIzhh3fuRRx4hRcTM5dnu/SKHp3dIBLCO/XpOe
-            Ik5VziwKy4GptbxkNfeBSupIcg+ydzEHB8bffW3hx7ZZi6aXZ0YosrUoEczgo7Sq
-            SdFCX139GCm7sCAHFMNe942smnVs/8+lOoFyR/nJ9FtlIWlTQ/tORHHNDyLz12mI
-            7wyRaFSj0+W6XQBFg/Uc0TzNVsU4L5aTKdWz9Xcto7aE4Kwi93ZVFKGSfKmTCeWR
-            7K8/Ghj6majNUPz2TAB//9Jc30QgN+eRbzcSFA40Kwjs71JzcthiSo8OFPJEQox4
-            I5VIHdaxxLIzvCZDZ89Qe8KYHps9sge2/BMP70wSm6i00zuA3EO1cArJchIBtXLB
-            ZtBrCSKRwkatflNTriPCNUIRkn4YUkcVJtlHbamBAK/G3kzE99i137MFf8A2GhvU
-            aAEJAhCgx8blQrlhpPudkC024dlBhTtHI+xhAu8p/6ONvoCKLxcUlCmGcVOgN0z6
-            vG2CVtzzhNBMqSgzBxNzH5e0KdzZTp7dMxxcMHm1deKrQO+B2bpc6ekzMe2fliK0
-            0wr5Pf79W0JA
-            =CYbO
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:35:37Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAkdm5dbHYnPRwvjz72mxFIKDUtExXofUeOvMLAeiO3AKg
-            aoa0TnA8YeuWNYLTsAyPCHxuAmkdqwIfKaOgukLMWYA2PkkjrCXdDhS+w/eAIARU
-            TGDuZaChXgkGPCcupzbanuerIBoJmeyOIRqBtwYLiuOytgZDpoYargMWERMXDCr9
-            otUk/o6z01yoE+cvZgcGdzg3MbcVURLA7PbG8lAuB5sWMeF8hSaV/aWI4dwPRv6V
-            k2YsOIPhApIEcOEVsIziFFhFMVjeTEYnkyY7gYkRi8Z1+TEgI2LZLf+6EFurG4pW
-            KpjK0/NcsuRI48gHwpGYK4fS3GeblsJ4CzklzphZoZ4NsdqHQ5kLV7p8Jf6b9IBf
-            qVqdfrsys4ghoKXVbHK4l3tF3n9WIdKGW/dvaIYcphbPDlWaFnaeElBECJI81DxK
-            Xglu25fWYB0FdYLAbHJ9b54fXbrabKoBHUg6CFPl20J7eg7gwds49HXZngwqSwV7
-            2Hd4cIV/PcLcwpZN9RWVSUsqQAiutZb5zNV3CWfjNLozOWJ6QhY1YUbMvp/tgkZJ
-            97Rq8fjket/21u/cuABjbVMReO00JvSskvXCjFJhpTFzmQABVKNjvbVESzIiI64w
-            KWGcKrgoj5ZQQsAUfBgd68Xw5kp3NdQOSC5nfFgMcUeq1wNZckbPRTj+LZPLDjzU
-            aAEJAhA9lvevq5PKjNBKraWlxIosWyI+SFlJ6KBHpFZWJBKNcz9v796Hne0VtKyP
-            gY/8pAnBwWZqMxCBvTlIZXMCf0JjqfzCXXmbUttCl0fPUI7AEJPm0o+P7oL3SMlI
-            Sk7B5aX752Xe
-            =vnTM
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/authentik/service-monitor.yaml

@@ -1,17 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: authentik
-  namespace: authentik
-  labels:
-    release: kube-prometheus-stack
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: authentik
-      app.kubernetes.io/name: authentik
-  endpoints:
-  - port: http-metrics
-    interval: 30s
-    scrapeTimeout: 3s
-    path: /metrics

cluster/apps/database/mariadb/helm-release.yaml

@@ -1,24 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: mariadb
-  namespace: database
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: mariadb
-      version: 11.5.x
-      sourceRef:
-        kind: HelmRepository
-        name: bitnami-charts
-        namespace: flux-system
-
-  values:
-    auth:
-      username: k3scluster
-      existingSecret: "mariadb-secret"
-
-    primary:
-      persistence:
-        existingClaim: mariadb-pv-claim

cluster/apps/database/mariadb/mariadb-pv.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mariadb-pv
-  namespace: database
-spec:
-  storageClassName: hostpath
-  persistentVolumeReclaimPolicy: Retain
-  capacity:
-    storage: 12Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: "/mnt/MainPool/Kubernetes/databases/mariadb"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: mariadb-pv-claim
-  namespace: database
-spec:
-  storageClassName: hostpath
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 12Gi

cluster/apps/database/mariadb/mariadb.sops.yaml

@@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: mariadb-secret
-    namespace: database
-stringData:
-    mariadb-root-password: ENC[AES256_GCM,data:Fv/IBSYJ59NwAXIm4++j9ouW7QXAWMP8Et6qTtYZGWc=,iv:LpoL3VXqRMPR1jdtAG8hVRpslAZx5C4K1fxHyrjnrE0=,tag:0wi3E4snnKIxtDptgOSr4g==,type:str]
-    mariadb-replication-password: ENC[AES256_GCM,data:glOy5LsxWzngOjtH0cUrtH3KGA+6kOe0WJw5ul5BiQ4=,iv:URpyq5Sf3CCAqDOtPfM/EvgkMcejvM71gA69zgePlFM=,tag:OeZbv4wUBcoSVUMz1pSi5w==,type:str]
-    mariadb-password: ENC[AES256_GCM,data:FqraX9l4nFTWrZ3v9LnJJNFuhwURjBSrmMXLT/C9ej8=,iv:CLGc8XHUeLbixBN9Wdx81SJTe8L3HwPaHQ4Lc2iMFvY=,tag:voDFAnniUVshGRuv4+zYGw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-04-17T00:12:38Z"
-    mac: ENC[AES256_GCM,data:v7rimrwed+ElVHZyO7zdIQLoYR2tJrtZVNUgeBMwZUB6+/v52wa/OIIWoPrsXbGQe0W1w/e1t08ekB8tbanzItD1ftg9mYfAsfBkD2XQyyXornV2uDBbmifUq/yH3a89h97j26Ofzx8PZqFYYnFLSCTXHbdmDNsPHza70fYfk40=,iv:2A0pduramwAP4y3UUU73li9hzC5keGuAzmN2euPFSRI=,tag:tSygQLB9UyzFgR89An/j6w==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:35:30Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ/+PYuDQqORZ7FPzlGb8Wm+DmCCKn4dywZQ/3xqVq1G4wYP
-            W8loUvA9mL8Ja5E6USWb+YdqWa95PAk5N/pDf3MVtnHQnQU9Ko5AjC5kEPFIdWNP
-            ShBE0y1sRCUeNw2T4ARa0C3bagL4EaI7C3ef0PxkCbpw4Yz6O9afOySD3u6Nwaa/
-            04ucDMIoH4VANCDgFo8nFkFV+23bm4cHbHwezaz7r0yL7bOzgt40eSw7tJfEN4nq
-            Yq/ak4iVor2zl5NxHtm08VXtDIyD5LyH5+jIrUKDGPOS6OVIQbyc6pyClCm4JAvq
-            NG0XZCIx+AnyQe7d6OmbrKy+ZarQFQOlJS+H0sWrm7DGWPZpNn8LnRDzlcrTlDv1
-            fP2fGz45gvWRFRaiAeGM2DADwuS4HD4o4nsXa/sWy2Vxstn8Ngjg3/GfMZR4CyDB
-            JzNOl4HjaKYi4kP+MJRSedwp5IGlLeG31MKdn7xU+gsYonsG8u2puTfbHQ8Pk92B
-            HjJ1hLoc65MZofQkeKmYjzQ+9yT2g4YYUyWnPX5agrlMhsVqkZiRirRg+uCT59qD
-            OA8BI9tmjtDjVSs4B5XayL4uppv8pHHk3B6LnKfVX61BAEF4LXV3X7RJMBoLACy4
-            v1UbX6J177xIxHCl/tbzZhwAH+NmceioH2OuPUAtnA3TziCjzr9dH8Fpnrlc26jU
-            aAEJAhCSe5Xs1RDXBUfhlqjwDTZbuyLF889WujKIRwopHqDvCpwA6ZqijElAZWS9
-            F8JAIq1PvyQJBvoGzc52jShobDYugzrFEDiF1Rf8/moXRx4VEa9F0049Zfa1U0bD
-            daX+Wf+7VNFs
-            =qkGs
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:35:30Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ/+L3qBw73EbS1WJ/0qpZ4fiaV40Yd5Y0i9g0CXaNzKNc0n
-            qSr0r3yYsbJWcQwWOhORMwXaDChTf/d02kz+HSdAc+u1IdPAb8mtJ39C0Zlnu78y
-            S5CBF6zUg0BDdnzQKKyuzalmaGirRXUikfyRcIAHb/mmhUwCu/ekFg0QnUx1VvGx
-            Su/sAabRT6D10MF8lunZI63E05yxLSrlb/xGAfGBX/MN6qqdRdYZWzTWgiJAgO07
-            53a2SJE5SfTlEpPdacBV4MVxcHj9xstUDTjQYP69UTTEDKq/kwaZ5FubMWFUono5
-            fxeZr0PeYXwWVzHHbGTTagAzG8M/urPLje6IsWwb5TYyjTn7VSUOfyrdHnS8PZ8u
-            YYyJMftlc4EmTQqYxc9D/j2xk0Hja3cb9L9eLTVkikds07ZRTr+IikYpspYb3vEu
-            dhvMULKhNDoW9K83THQdwyqi8EO7RQoEnGzqRqW84WWN90Bo2YrOL/uZyvgKNEY/
-            lSgsPeWWqc8eHnZnm1zedc/0eiRIbKIwzKYTC2dr3ZbsaAlbt0JXXU8GQnvOWFeh
-            RFOt1WdoFv+Ssm4I+gfSvcMSMeqzUC8AOf0hdIXCwf1lQlVPT8GHq1H11aW9O6Gf
-            jPz5dLwMkGVDJ90i005ZdeUXGntRHOKOwag4MfD6JaDQ4hnj15pfQdbIgOKCRTzU
-            aAEJAhB08M0x5nMkguE9Yow9afmKTpzKoIvRFLw0iLy4T6FYxJ1k9+/UMAQ2Wa69
-            UiL0YCFldFzxcq0GGfrkIX+PUvYaYpsAB6Iid5RwPHtzcSv5pxN91uztaUCfOmPZ
-            fPiA+XqbXVzO
-            =DRJp
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/database/postgresql/pgsql-pv.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: postgresql-pv
-  namespace: database
-spec:
-  storageClassName: hostpath
-  persistentVolumeReclaimPolicy: Retain
-  capacity:
-    storage: 12Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: "/mnt/MainPool/Kubernetes/databases/postgresql"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: postgresql-pv-claim
-  namespace: database
-spec:
-  storageClassName: hostpath
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

cluster/apps/database/postgresql/pgsql.sops.yaml

@@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: pgsql-secrets
-    namespace: database
-stringData:
-    adminPassword: ENC[AES256_GCM,data:gJ7rl2V/VlbIIRvRHcwMaZKN87t5n8bVWZCj/tRv8Uw=,iv:b/5eEnOrHzJrtnO+E2IGwJLHy2AdJQwv9WfUR5fUHY4=,tag:nTtaDNHVfYpChQX9UWwdKA==,type:str]
-    userPassword: ENC[AES256_GCM,data:gR7q508lUaRDRJ/z5lH99JLJSS9zWfg0O+TAm2B9uvo=,iv:9DDQxwd/BGtLQDacAH/crfT+qU4Pn5sGkWuEtmMprUI=,tag:tK3WoUd7729LQDVqU7pckQ==,type:str]
-    replicationPassword: ENC[AES256_GCM,data:BSA5IfYhhvN445yp2i3BI5zlIXgdj+LejCPzvlTMnVo=,iv:Qku2NAQPLxt+NUnk2dSx1+WAoyx3aEuA3+piU2mubYk=,tag:MnI+atK6VLZUc3eGS1OE1w==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-04-07T01:57:23Z"
-    mac: ENC[AES256_GCM,data:wvjHgGOMyuVpy4klW5/aO434NKABQJc0907BIwLOXMxSOuIsedAeRhCWdi70IJfv5m8gIcRCb/jWVtDgQePd6CALglH72VlA3NiZI5EQrdBLQUmpGSglLNScrLDOjqNrXG/UgmikATskO5R0vl/203jt1S4OupuEHiPqPRHSSdc=,iv:qHHpufOzzjk8NCuldShenJbC1BlzhMpy4Tz2wWBolvw=,tag:HpoB7PM1gZfv6qfun7ucRw==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:35:15Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//aQdUERyq3G7V29F5rpY6LdDgo8+hqrrZvdI3JnON0VUM
-            Tj3AAYg+xvYh8aPQywF9fJvn6qNw8fqrb2GiuuNTa9ZPCFsD+WXbuYHmQ9z6tAtV
-            opXe3QLNBuo9zEtUfGPbaCp8EH7f1TxQsTJoe9iE/1B2S69cHNUdgXZtfQyhpmlG
-            iyAk/G04kPazweIuFNjOYaN/12J/s2Cf5AZUeROkMxg8/GTPO68LeEBz9v4vl/1z
-            JlxmZyXR/9IeoBlO63asDrR85fcvSDb31K4qE3WVkag20bXClv1lehLVKO4bxA/F
-            lW1tXDR3odC9Ozme884Znd05L0NWkzYKYRta198IV6JuSCeMdjTscGGlMM9wqqKz
-            SZgs81FHXT16YCVupfI22CqMiD0EzQXrGEtJ4NqaBvhZu+MDxszNRzIl73b0HANc
-            8JQqQqOJh7ltrWnf39Xlv73yVC/pYbaV1LWGnMfqWvOcksa9QjOH9Ysfj/RxdaMw
-            VQhydU+21+xeuEQBL7OsiJQUzgJjFREnTRPXcorCtWxocCn5zwdct1SFchFzCOTp
-            H0ubpD+MP4RTWxuYbZRhE5ty6GJU9liRH7dUJtVaQiv8V+G1DungTqq36AbbnHzd
-            9cy+4cM3wZx2VYElL7DBom8nqqm7Xhffr0UaaY8VFuV5bBry3BmM5rOr8vDYqf7U
-            aAEJAhC/4yiBMuhEB+fwXIq/dBjMzW+p8SotK2QK03yaTFQchnBDknwVdqcKQxIZ
-            di3kupnjB+KllWOZhl121tT9L35ymL53BUu1FKCTFdIS2wXxy6UlIS98n0bvWJYN
-            c5WTfk81xmbT
-            =UE14
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:35:15Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ/9G2JDsJw6YJMjstWPrv07tnU0ErWZx5WGcNUGhw6T5tOJ
-            kXCAuaZax8NxoTtZnQ9Cd+WgJr7R0FuVPEPTc4G2RsfntSZq5rBgCpT0fgwyASFX
-            64b6YTbLcCL+G6sg/FwIi9SRqqCsaljATjoU685vrjaxYYfAdhyUoM3qSNjMMaMl
-            zVjn0kbWrQn4GqfuRMqcr+zCIQdHNTTJ12+c6UUo/zJp4zzjA68Yur9aiw1iHtR1
-            rYCPHX2/ZmQjADTHXqwpuMdb5j0VDcd5JcZabdcJkhn/6MRJiN+XryZN/Neq9UbF
-            5WrMaZz5v0iRnMUCr8HMw29P0ttu5Sma+RyCOZuWlpsXj+C84pJ8CjBbFhzSJzGP
-            cKI8Syn0CPLN3X6vKs+LJXEHg1jxJ9kuN+RgW+SQRctUX3A0JtFg2tWplkptNtLl
-            hN5rW+fWxk7BV9dP7wouwVJiKcW3Y/OMCF5H8YHwL/KVHvANBwNM+nmFPrHaqN2s
-            0RghznmZMVG+9IYedSM6d8ZJLnO/QsNTE0QTGM/3dmBAn9jcndCLTgcgThAtvcmw
-            lFJYaMN3W455Cccaif93xnb44yn47actgEuM6GOuP15GGJaHD2iBQ2atHcaQhNQR
-            mxhIIouu+Kaa6g34MA/VGDNoN0eNYI5RZIUSSBl7bgaOXs9/3j1Uvap9yesCaOTU
-            aAEJAhDDqjX7RUazeEByAiKjv5TxpQzsi8gR4zyrhf6tTx34jHzQNoVjYEtLMEVl
-            ZlAJ06RoxOj8O6+8RGYd/ZUE+TQPQ4jx+PgWrZPUQx8TSxevuduw5XZ1lKytUSCZ
-            GFDjOxp0lMGV
-            =LHSB
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/default/cdn/helm-release.yaml

@@ -1,66 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: nginx-cdn
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: oci.seedno.de/seednode/nginx
-      tag: latest
-
-    args:
-    - -c
-    - /config/nginx.conf
-
-    service:
-      main:
-        ports:
-          http:
-            port: 6544
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "cdn.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-            
-    persistence:
-      data:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/cdn/data
-        readOnly: true
-        mountPath: /data
-      config:
-        enabled: true
-        type: configMap
-        name: nginx-cdn-configmap
-
-    resources:
-      requests:
-        cpu: 1m

cluster/apps/default/dendron/dendron-config.yaml

@@ -1,10 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: dendron-config
-  namespace: default
-data:
-  config.yaml: |
-    bind-addr: 127.0.0.1:8080
-    auth: none
-    cert: false

cluster/apps/default/dendron/dendron-secret.sops.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: dendron-secret
-    namespace: default
-stringData:
-    config: ENC[AES256_GCM,data:NxmEkvQaTeN535bFrFBs92pe59zmcqmxwH+3vwcgtnD35z0GzFDqUzgsQkY4suwkjekvZPiWxaoWNQ5GnQ==,iv:5kkHxRSSGQS4jDx+xZYTr1Xjn3vqcZIIy4JF4AWjcpg=,tag:1GDd1vtWx2C8J9zCKV+Yrg==,type:str]
-    id_rsa.pub: ENC[AES256_GCM,data:e/+K6q8dZqhydoaUHNfRsVOYBxL9RPWQEy/EaSJag+1GK26yY773MYAo+rbdCZnFMuDjGa2xN+Y5S+Bjcj8YMxZ8CCBFnqshfQa6FmDb1j0s46c4mjbRdxLAOXyl0ehwdq1YI0kslh19SK1/V+t96NDn9PQi1m7jTmw0k2FP74ooFx0d+DinDq4OpsAQ8XKj1twBXLf8YLxs1/qqDzAnB3jCh3ADmpAGGllJFzXPMR+uQjGhN04RnPZY81ofTFn2v4QucIFFf4HQCAvqMicc2haZk1+t6tKOqsSqM5LfBLlmOGZDUygauKZb22iECEUG9UXUUf52gcHINKBGKlN9ba+JEUEZaScod6AKceSOJoi9Dnfhqm6q9zYfjnkqSYKH+mFOS36VqTBbc+Vy7+MRfkDwu7uE3XFrDmar17eTesiWYDi91L/1eQSlGmmOhWcMkqgW4jWvsDCP1hSOOxZ1ke6UyLnzeqTm1a/gT+U6BtF3t7KZgR0gb+ygJ3ieX7PZFxoJf6urc5TDK5X8dT+VZkMMUZATbhlM3m0GdCZuBq+t2yCv9bGOAVvUIa2/rjZ02FtmBIoeuRAeBNdArw027eTYa02pXgmWy1RrDm08Aopzbe+Q3AVDo0MK4QyhFkr0RA61nLCqSh6WSSyFyCxHaeWv7s9EZF3MG2vKteWsz1/xGiFB7KuTSUbE8WArtPNStVLjF4UiRV5+PfJ15gySGNzImsT0MpKVSNxKSWafrPe+SpGQMQOWV4Mhekr29SxgNDziGDhmMAYmbr/Y95mSbIzXGtOmgT8p20fjcqHMAiA/xTcLNLDcB8QPB1EXZ5mZtdmnQsuvPaHQ/HMOmX5zOKbvNwBnOuznH3I3+kDWeEFLPlcYeRXXzFt7iw50yT7AEG9h6wKIHnLQm4HVPVP0z+HcNzJzSFOa4yElnnbcyWH3HiVttOXPAyI5PKIihyLZGB8XR78GULToup+aBW4TqeEXZFnMqyFPagn1y39tuCYgsFA=,iv:V3eSPCb9Mx00SksaoIQv0ACqMI0R06ZTLpJgkhHZxqA=,tag:3Pp0apL1vBdfNz09ctgwHg==,type:str]
-    id_rsa: ENC[AES256_GCM,data:na8KTV3ub1Cj30ss/iRJDFRghq1wGWyiE1GAGV2QPLPkJcGMySWQaU1VLtMW4aUVzLT6oG3Oj2tHrnls26VSlgD5dUgO6bJj38w0NqhFrl+FxBQyyeGhkO4/Rgo3m3IUnE4NhcFyxxP9BPXuMrSr82iWk3qaB/NHPSHyf71NT9C/aE/nJKpycj4RSbT59DYF08jti5rWzPnGDmgBO9K5gEtsZgzvVdthjvGdS2JFaV68hxOYWNxfdbBtxMuZNvXsdFhXHUKs6G0L1vA053kT26B/JLQzKG4pxeHikIneEsM9m9syL1OTHtoCqpg++usxxOKCioVgUsrNI0AyQX1Ywfq1l4AXQfQY3MKG9y+1Evssc0tlG4O5wRTojUkcyalcPZ26epLeFJehk3AeBB+uI0l/cSVrmOch+ax5k2UXLldk6qI3e3AT67tM0lIC92QXj3pUKa7qWog9thp1Nle0Gei/rGVY5Qf9jv8UYB7BzHROAzi3yO5oJPVQKMiAUAIOZhnIAGFFKL//3FSoWI3D9n9DWVrqjOM73M1NgKefVCywDQb8Fkgid6BMTArGqUn/V2fRHUS4rQGbsgc0QEl+cBilAXEQFdHQSkWP25H3ppH5Qxtz1/B3SgeR8Xnm84f4ED+F4xeospaV+DN//FnnPehEpIxtPJpB4PWxCRYzyTzXh+/sQ3YQbfOo4pH4yLgdWoR462E35VVa2GaZKG9ykTeRnALMI5hgf0HNW9CIcCfNVfRxxy/idQ7CoMI7QAwSwL433JPM0Al7tUTtUlk25jBh78IcDtHkK2WQeP4n2qTrBWbA5HqTEvPhPh1ip/z0NNsPUI1PoTdiEC56zpwJIbJ76L5+7A1OcJlCUbZXSMkjKnPGU0FIgRx8+qNJDO+IztYRoM5B/6pINbcWaAIFSSnu+zsNfyoZNxxeJJgs1JqQTvfCMM8jhnEWuTG72YscygDoTNWihsF3+Ie5yIX3L9+Cx9NkATjpUZjJFusKzGaY6PZ/UjYjSKDO9yVq8Qk95+3LJl8SAUgIVBKOuguTNbECu4khBJT+qt7SXnR0HfvcJ4VdN8iHZJBZFVJd/sIo3jSNpkQj046hBmN6XjjfHBdSIoBMcNAZQohYKV0Pw0DAsfn0xS25V2+heyKnxsPWpu4FcwXrsADMIuZUMjyos1F2cpK/b3eJCh4JHGTppwIyFVnLvMo0xYGaqn1CtF5Ju6Cr0bJXaDHqfZBWmFDPopPsOGRsNRXAmcO50zEZ8kYg0yPZHli/X/Q6to65+mQL/sgRiodzvJjecctG2G8558/e8gEWrGNCT5fgpUizzo59j517yQccKRsyftKqpH1ZQXQKyBn42JeqAr49IGqTMB3wt6KW1S+5WPUVsZIy0/C7UnwexmBSQ7MOixYybr1rlQClnIroViog2cdNPfQ05fv9Cry1Npo6z76UJRhWSyrXVaBzhBpTSxl0pix/4ZQouMwujb12spzo4PlXYeh039YKFRruSu5NZx+ELRGpeQvcn/FXJODlh63bI9BKb1jNkz77PcUJudrmQxIAm8dmCsyR6m+GizMm17673i/FWmqILLRE3NOPHepM6iyhEYu/WHb48/N9h4hvP0u7Qt0nS9k1FK3Ywbra1EQ3suj8kbF5cJ/jv0TP+WDaybTkzzb5Peb/OoJI6FIW++uvtqSmQ9fYOmE+cllh5cxkybm3LYfio2TLhUm5qclcEO+C0KmQ0PqUDI0VLPc1PukbYFxE/1o6+zpCDHPABItNjim2tAtm33ABooFcpvIBKmKnho5cT6iO5Rwdx24+YGN8pzb9bAsKbDkL+tpQ2R3xjz/lFptcSj3o5Ewee4EetJO03NpZ36qP50GBKT1CSNH1EfKocHIst1hLBL1E11caVEnoPX0mbBaxuA1hTEpIy0gE6axokn/xxkxbOSVu1zLNS6xtwW++L6td3yLfeDadAi0mOyJAkbpP3cZySJBNGxPJIePhC7/ALjhFMNJijZIgVYbv9YCYpHg3AF1gresocoDrQFHTqAWpPWXh1srBPA2Ke45AwRxE4/MDHu/QI4GH+nSX20VkbM53avuhAQrLXflirlDDMVsI0SPOJzEu90Yl3oZif+wXEL2clLUCq36uQCCRHx+Nvw32Ik5IhSo1ayQO0wCObCRT/HrT2ZAJxsHnS86QU+dgHSQcGCEawzUdta7FpoZcOec9ZH1RDPsmpKhd8Ry3rDrxURWoNwTfEZIrYghfuP4jqos+XJpO67sSzvlVW1PSElMTtcXWWoq0H5lHTYRV/wpothkc1MFWCgVqxJ+ynyhg2PHPOwNBas3rGKW3m2VK2rkHW2nnoavHLNNzLkjhyK3HLSdhCz2hzASdgO1Ae2fxgOOmaI04p6dB8un2ciEaTcMp0Q9Jj7+fxvTCVikLTBMeqmLe4gwRSfQ0N2k20vKoevKEX8CtAOXxLHXmRpIzadEFMVHIaaura76zXKLdSC295eWxXyHKDcnY6LQChrZIIbs3ymw9DSNuW0q4t0IcaN7SCg/weKE6ZVhc6Vm0fO0GmAOyTrky42GW/5L2DBxRonAQwOsCjIeUHhaetVzp+MFeQvAxpUEM6kwo1BDk+v1yS4oNGizNR44bSa7EjzLP3qQXcVfHt0FM/bwD2ajMmU4aYfd4yIFROaY89d1KHhnqwIbdeWKZrtxzyDl/b+i45clE+RG9FTRzKFyNCuB5CPqejKDyMa/q9XoppPABrX1MCi/0Q2jiwiir9EFc9rN6hdouU7N8BBt6lNOXycsgoyDB9v7QF+mTmpggfuB4lWmJSt3/vLqlaBOIlWf2LWaSNgm+O3XPUfkaSfa5IvtN5IusU8lfEabH8QY1DfAIIRL0IZfIezVWrnTvjbH8iJd6ZKDqfIN/GY8eItb3355giO4tNXJH//LnJrXFytXqGfxWT7tHLxij4alP9qSaG1DASXk7GOzrs9+nnLATK1Rfe8Cd2mK1n2AKLJeop5iXrAsiKaiRd6gXBciK7n6DZFDPRLb+TZLHoS/Az3QOvsVuoZASwB3CnJF/2GzrljkBH1DH2wpY0F1lGKk9zkqPs3kURs9Y3A0o7V6uf/JtqUA13sQyoY4SqdUHjxFBvrEn+qUe6ySsIgPTysUc/G+uwOcCRuaKCKPMF/tv/GiqSaUV0Otc3rlJwWiiAKLKpc0VXj0nq9Q1aW++h5OJrO1YIfFi8t21JOyLPs+W3kA0Yd9RY30DqWlFtyKrVDa6Sp+J/OX+NkqzgXARGGlaCZIkpIZ8oc7zUAga0j+2Jz8DNV0OZhWEf6zsTVntO7bCGseLeU95YQiwaRX7fopStoO0NydIxNfjp+LiZnLsockeRBuZTmghv6pch7EHNpr4WVn9/qbIQfZCRXOJChu8VB5i7diZXIW0Apr4DpnALyo1GcjyaOjmdyBOQN/mabE8SFLC1e6jr7+uRzFvxfJqka0RQBTbu/XlWcjFrDYSL8Pyg+LmN8yl7f4afl5YEa8mUvZ33xRgHYQvex4hB9EYwaiOe6HaMeAd+dnZouU1GxLblzTDjH8HQeAm+kMW26n4BM+jatz8PQyodGkFZN8zdyA2WE5dasifCYf21MosjwfJqgLTROXguBGPWBebDNI6NuB0Nwvif4C9Wai1r+CFQ3yz17huSfXTLpNaXiWVXAzRm73RpL2M/upJR6pCZOapHqTtQm1yEEBDn2KZuO5nGUIX6uB3ubIrgRBdHDO1mM0Au/IYeCZZlnIHoPzKPofEiVidVk3aeZqlfJ3TGFbKOG9LanjO702P0nvCHNcoQfHyTXghaiDtoHERrCIrRDoOUDDjt16V3EDSsZlNqYyQEw9jZ1cCm7OY26lFWDh69PU8UgV+DfK1aq1Dc/6S8gi4NnodGMGrw7Glja1XKEAzSG8cR6Jr8QErQY3YmagIQmHsdZ4hJxVRu/etohWVpwfw8R/PdmriOxwx+uZb0YFhAXICxSTKVA3ubWaVZRmrebnuyl1iFA9CE9H+e3MOQtnwosa0S4Tyd47gdASVKsru03nTJw1UmhpauXXjGRGq8aUoDi1GNXel8oLWILWQaVSKhdhIWLhfHsVg/TJwtm023fsBi/RBM7UkonikrFJ1s5KgM88oJaAavTUbwRmMsUjfpKnZw+Bm0Yemwb73IP1KPJrU4orVxDjffyzzMAorg6ifGDWHAiTsoSbHXjbCD4W7FxEjtT42spb2+FqPigLHhAVV3TG56CCCMPLRaw6xIi7lCYNVFt1jRUAWNlegzc1fRvBTf8YsqrOToIXu04Wwu3+nG3fcr5+2mWETShPDAd+NDPkxBc+ux3XfM5yYKiRPh2O5HNSX5LQG3zHY7yEU8ZXEiHdZWZPhc1N3wBVNlXh6srkuC3/BWt6PcAyZsDXIrBEc6zY3zbZ4qdYdXazMbhNunaRi3Mlull2CgJquwGsHQY098fUJVngmbrTXHqGMTBCFtCr9+q7vgA42GFevfNsCPLYg9u2MiaZqcmKPY4SWU4U2Roz8fv2BKBpmaxg1e79/sBzmTnjgsy2313D/T2zyhWzeWn1Oq9OeVuqcaELHkaxpySSCw5TkNYvSTwWJxLHw1ccXOQVNdNn1mgTsIA==,iv:8DWFQG4uoooU0U4yKYYiism0p6kGJVd4pwuhVyA7hIM=,tag:zTBz5yhUaM0h/hlR/Yh2gQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-07-25T05:01:34Z"
-    mac: ENC[AES256_GCM,data:+L/f2vsSjkpEzb8qUXCusMdYPbQO+we+SpE7sbbiiWAPjbkVgOg5ah3BzXvGIIWzZsXt4/Y5BXfB/54am42/WYQhnfzZdTWvFCUSK0bDiBEuybCej/Y0eGes7WchpBBvIRuVU0jly1m25MmCFXRLR15DjXIbIYeTA1WIsgSsBvk=,iv:pOIwEXCYIhZF2AJ5FcdbrtmWkNOSuTkP6dIVyHNdoWo=,tag:UO+ieaZ7Zdv0JJcBHKBpzA==,type:str]
-    pgp:
-        - created_at: "2023-07-25T05:01:33Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//eAJDYoFRZsEMBwInHBRnW6Bu7yVhqnun2f4EVWA8Ob/a
-            +DO3ojrh0oezmQA6Ttqv00gJLNGfsPPgVlF3f9bfSFulTYS37UggIOLpLmH2z4Vs
-            JElLDPgOAsNQ6+PYb92/ErqFg0vhOkDWSw0ILYL6TazQD3hj7iUathyJIW0CoOgO
-            qedmW1/1L3lV3Mg87cRR1gvBK/V20Dx90Y+MGNg88P3IYMIP0mSslNwvA59k61Ht
-            RXL8w8C+Ax6tigaOFlDeaarzDxdIwCrs4MWQYggXMjQzO/ohEfDospRitoxYnj8/
-            LY3BsRSFkIEeYz/ERW+EY23Skc7UGGfWPrvZbj334iceiZ34X8KMe7aU8oh7gkwu
-            bm4FsIW/HAfgcRbVir/3TffFTinqTBMi4G8GU4Q2M1JorkqrOJXtlvzA68b12b5w
-            0pPGMowWN2Xc3HzY40yVQ/9RPmDNBAFCaP3n1QjXz0jBgNOKVwmJKoNxi8m7hM2V
-            KOUseS80v0sDM+gJAwRGhZTmyphLP1v6116Duh8l4ZAhgz3Zw2gJ9nf9kCItL1if
-            g5u7pvpcVwuaxkm4UloZggHan6weHGutppO+rEUu6hM/JlMrtGz5iAQtOG8OdvWE
-            su0KZFRAHUayAltL1u0eQcQVzXQWVvWAgY0f7YYjjxkCygAAR4O+jS+IlTlIBEDS
-            XgGpYLZja758jdjkJx0Rt98Un4MWoXW/3zE2qKHmfQVu9T3uyPIn/ES2tN2O2WDp
-            kmacHAcz09Hfz55MPU7T63yF3+2xqwlNnnxdebXBI3HO9pIXNoKHNO4c55yh1f0=
-            =1D3U
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-07-25T05:01:33Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//TilqHh3NXeTVeHfTv+engCARGuSv6aWIDfSl2PM0hdO6
-            kgvxRubWFbTc/EH7JXZmdNmVYM7vnpSKBuGE2xyc1MxIFHmRgotzz6liM0H+Enen
-            BMeNunT5A3hZ3aZ9iaqUzSCjYgMoQy5XRKuS/DVp+o7qhXLcYBBPxsxLuxanEsE7
-            ZAMc2EYEDY+ZP4csY6RvEYBOjn5QWjOjgo7AGpcji3OsnHYc1RCIud8ZXhLKs29a
-            IkcdKYqRuDob82RivhhqcTjf8iL3LGUE9cR912RSmP5908DvVtOZzY8luw9VSlmx
-            fQF0HKrsN/VXTNZGuqIO/GFzL/21nOxNTgxRAwtg19urQ4/lGvobh0r52lJyX0Bj
-            tEggeZbq1Pa1UOEaRvIV70L73TzjzrQurDoqvbv7Brz0hjR/iu/U3Ry2IlPZNBQd
-            IJMNn9uYuIaO+9EnLwS2Jor9K8GrME51gv52B9RCQgAfC7jHlCmW/qCdcXGkW1Lv
-            l9tOsu/KDL6rNvqzAD0GNIj22m3mJjb4kMYeQxyuzjD+GZcYxpNFGOORhFqfPj8P
-            gelzIHxbH5xJitIqmTYAXgzvVtm0TEEKrUf3yBgd3r2zJtfmwd031PZrCM9XZmbE
-            6kIOUYpx1ZboaLzIVRLbb9eyTqyGlYcVL7Cl1aRtdbQKJPgTZCidzIpBwFd+20LS
-            XgG8Ckst3I0ewGTnokVZqP2bNWTA8KHasdvD69k2KjUqsE1j3xmXZJIqiFq2QAXn
-            zVwtM+I+S4yR+xN0xLowmUYVhh748NxCv3MyATu+EDE0v9OSrk3qiAkndFm9Z8Q=
-            =Cds7
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/default/dendron/helm-release.yaml

@@ -1,93 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: dendron
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: oci.${SECRET_NEW_DOMAIN}/seanomik/dendron-codeserver
-      tag: v0.0.3
-
-    imagePullSecrets:
-    - name: orca-puller
-
-    service:
-      main:
-        ports:
-          http:
-            port: 8080
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "dendron.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    persistence:
-      data:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/dendron/notes
-        mountPath: /notes
-      user-config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/dendron/code-settings
-        mountPath: /home/coder/.local/share/code-server/User
-      ssh-private:
-        enabled: true
-        type: secret
-        name: dendron-secret
-        readOnly: false
-        mountPath: /home/coder/.ssh/id_rsa
-        subPath: id_rsa
-      ssh-config:
-        enabled: true
-        type: secret
-        name: dendron-secret
-        readOnly: false
-        mountPath: /home/coder/.ssh/config
-        subPath: config
-      codeserver-config:
-        enabled: true
-        type: configMap
-        name: dendron-config
-        readOnly: false
-        mountPath: /home/coder/.config/code-server
-
-    resources:
-      requests:
-        cpu: 1m

cluster/apps/default/dendron/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./dendron-secret.sops.yaml
-- ./dendron-config.yaml
-- ./helm-release.yaml

cluster/apps/default/fireflyiii/env-secret.sops.yaml

@@ -1,123 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: firefly-env-secret
-    namespace: default
-stringData:
-    ALLOW_WEBHOOKS: ENC[AES256_GCM,data:qdisaso=,iv:rT7WID3kRMPEGmWJepNmrj1tutxsT5Arw5AN9oVFoXE=,tag:jkYkRaGLEB3iBEjEVIAVCg==,type:str]
-    APP_DEBUG: ENC[AES256_GCM,data:Jyo8QmI=,iv:Gq2Ldh+H+oturcglphQb7ERHX8jD/5j01qtEJDRPAn4=,tag:m96oouPtT9J5zQHPs2QaVw==,type:str]
-    APP_ENV: ENC[AES256_GCM,data:19kiyms=,iv:KLwsQOsDvg/7f18FEsg+e2rgnXSbsxwSNbItmgLGy8M=,tag:mUX/UeXFi0eeZ68bsJpq8Q==,type:str]
-    APP_KEY: ENC[AES256_GCM,data:PI70apm/K8/1el4lW3KR6wLgBDgj0YAQ6KwngqxSv2Y=,iv:S7xrpAeY3wM3moCL/i5R045yst7Zz8ahXbLyNfvacZ0=,tag:hOXR1kKdxVoQxZyjZu+ajg==,type:str]
-    APP_LOG_LEVEL: ENC[AES256_GCM,data:ZwJTcn8y,iv:wk+jX9Zp1TTn1EHv0OLgt+0alm5JBHdWcEtIn1dTI6o=,tag:gR1Ls7dFGyt4hKGiwLU5wQ==,type:str]
-    APP_NAME: ENC[AES256_GCM,data:yfd2OQk6NvjKcA==,iv:jLL2Dt0YlWODwCKSnqR1yuSWJsKySQNZY/pEfxi5jJM=,tag:XoHlMsMuRG6S4Wm0PVjtBA==,type:str]
-    APP_URL: ENC[AES256_GCM,data:+bveNLjanPPMkoMrDO4KsA==,iv:xQWHzRKBMBumi2bFCUKoWLRiuNNV3HQLv1WGEiZ6RRg=,tag:h9IF4XwIK2P8sB4V1Su5Ug==,type:str]
-    AUDIT_LOG_LEVEL: ENC[AES256_GCM,data:OA7nqw==,iv:9BcE5Bf9QDf3kzA4Xbf0XkbkFjGAv6id7vdSI12wRm8=,tag:QN7o1eEbGSTvrGGBzzouSg==,type:str]
-    AUTHENTICATION_GUARD: ENC[AES256_GCM,data:wsQZSzAP0hE4o9DAwNtwSEM=,iv:U6513HaOzDDlCehFuSs8ey0KFWup9S8tAYiSX89EyNg=,tag:i5q9W6uglFZ9bKc2f4QPvQ==,type:str]
-    AUTHENTICATION_GUARD_HEADER: ENC[AES256_GCM,data:0GfWuR+1RhLsED/T5iEDYV3tkmx2wA==,iv:x/6xxFAv5+J8e55a9JnIZ49v/FJRL066rSf2bBxhHHU=,tag:hAhhsDDMeM29b8iMx3xwqA==,type:str]
-    BROADCAST_DRIVER: ENC[AES256_GCM,data:2iYs,iv:5oeuA+08uDRSJyLwwkdFC2q4LZKNs2OSoQjsnIX0aYY=,tag:m2ybfxtY98j39sBnax7IVA==,type:str]
-    CACHE_DRIVER: ENC[AES256_GCM,data:2lv9YGE=,iv:xuk6ih2wApMuWJIlm9clwYCnMR973lG7EOHDUZtlDvc=,tag:cdEh6/zAZ+7IcQMvHojgXQ==,type:str]
-    CACHE_PREFIX: ENC[AES256_GCM,data:OS/jr/Qo5A==,iv:wLeRO4uAo+HHB/1tK3m4MEeefmMRTc0+aTYuUGGrYyg=,tag:8cv8oxfwMkTeZ8+JsCoWVA==,type:str]
-    COOKIE_PATH: ENC[AES256_GCM,data:pQ==,iv:5QR02hlvi9n/gl6LLdSR2HSybzohlCisq51+QzUJv1k=,tag:hpwUD0ctU0pX7S+V6UNz/w==,type:str]
-    COOKIE_SAMESITE: ENC[AES256_GCM,data:HNlS,iv:f/kbAOVyWFEH6yKr+N3zM+9tNQQCpQA7/iKAg8ejFdk=,tag:g1rmzfnWSYIzxFJA0l/uUA==,type:str]
-    COOKIE_SECURE: ENC[AES256_GCM,data:fxJkE2M=,iv:0JXgzyybtMtIgxh6VSwAS5oehpVMFkLKvJFOBDcwhVM=,tag:RAhNUuJKOho6bvXJyNT6cg==,type:str]
-    DB_CONNECTION: ENC[AES256_GCM,data:Y7b+kts=,iv:1vZBNoO4O0Z8LPH3ZPSDpx49jtbQOEl6+BitbKyat4A=,tag:eOUpSlZGZKM0LPHdZMjb+Q==,type:str]
-    DB_DATABASE: ENC[AES256_GCM,data:1rRtAXfMaA==,iv:vErtoqpi1KsHVL0nQ6x2MVNe6JCKxjCxivXXjtUT6Uw=,tag:AYxHWADlGq4NHbcVx8QcHg==,type:str]
-    DB_HOST: ENC[AES256_GCM,data:sjYDEi8q4bAgpdnxin6yDBtNJw==,iv:6rxqBNvXSsE+2oxWbwiztmlxtKP8C0aeYMdmuGTyF/g=,tag:lRB3EwV4vwa64CI3xqi2lQ==,type:str]
-    DB_PASSWORD: ENC[AES256_GCM,data:PeysFTbHeZHTnkn0XlJ58AMZbS3EzANUQ8UnhQXRIoU=,iv:NM8c3dx8TlQkPVJGECnyg2L6JM7CQwlx/LQ59x15dY0=,tag:xuLow/AXp+yOUm4hO2527g==,type:str]
-    DB_PORT: ENC[AES256_GCM,data:yXp98w==,iv:a/jbQI7/3QMKaSJRiZGhdYBzdIzyNA0M3sL83bD/1is=,tag:PxauXvxyQlNo8EaFMzdjKg==,type:str]
-    DB_USERNAME: ENC[AES256_GCM,data:UOz2K8KusA==,iv:75KRLL7F0mtzESvfvVaIJiBqAz1i8JIcS2VwAMm3KVE=,tag:HmjzrLg4hLuAjQ88U3CDbw==,type:str]
-    DEFAULT_LANGUAGE: ENC[AES256_GCM,data:U2qo/Z0=,iv:duSb5g58hXy+BjmU51cWVc2APmz/THtQrmfKyWJL8Xs=,tag:3578FhaZxtyLXjFOJA7sVQ==,type:str]
-    DEFAULT_LOCALE: ENC[AES256_GCM,data:DX3VePo=,iv:d3P66DEPoI3yiZj00YaYVEsu9zCSQ+Nz0vCOxJjfkNk=,tag:JNeGcODHleBBOJrewOWq2w==,type:str]
-    DISABLE_CSP_HEADER: ENC[AES256_GCM,data:mS45ZNE=,iv:7twp7yAggJfGDKnoqoi4OY97uMQuOq1Y3y6LFst9qFY=,tag:mselnIDI/OzNplWsdq2YlA==,type:str]
-    DISABLE_FRAME_HEADER: ENC[AES256_GCM,data:lIO+3IU=,iv:/jCBrh9pxsNouU+glpvXqEXI3veHsqaHWkSDEJcJzHI=,tag:JHWUyPl6Ir+XczlkEm/xsw==,type:str]
-    DKR_BUILD_LOCALE: ENC[AES256_GCM,data:43nBSlc=,iv:pylnsBF4HORItmtHxLxaXjojdyazm1rseMtqgTwwX8k=,tag:mi7eWamr3l/H+foZUJYsJg==,type:str]
-    DKR_CHECK_SQLITE: ENC[AES256_GCM,data:TssvPA==,iv:N6kVxo9w7pjUy5PSt0nF3yPS7imaKaWbizPZdMv7rKQ=,tag:DpWzkfkFbFaQpuLTirsP1g==,type:str]
-    DKR_RUN_MIGRATION: ENC[AES256_GCM,data:6+nNEA==,iv:TxFrPKxoaN/neoRK09F5SJswfh+ULHw/tFQz+ouOOsU=,tag:UsMPAYDhgccBtBUAXxTNaQ==,type:str]
-    DKR_RUN_PASSPORT_INSTALL: ENC[AES256_GCM,data:rA1uHQ==,iv:TKV5pRA65C8FNHOrpzx90qA7maX5ld3aLCv/PrQamII=,tag:bqtT9pqHILiV1AEzkkYk5Q==,type:str]
-    DKR_RUN_REPORT: ENC[AES256_GCM,data:bqE/+A==,iv:PWlGji8/zVoosDeoWaTG4f9rDJwKOilwENI1JtzatPA=,tag:cHCeTgnB7c0TZ+9bSxFW4A==,type:str]
-    DKR_RUN_UPGRADE: ENC[AES256_GCM,data:76w+1w==,iv:XZwFW5WoWRBhfgM8Jf71IAEsWJxaWj6nmzh4arjV9IY=,tag:wm49cS3mMPPj0l7rNRm7nA==,type:str]
-    DKR_RUN_VERIFY: ENC[AES256_GCM,data:GE3u0A==,iv:hZc9+yCN781Hm/M6UrzAnFELJopG/m0PTaHCwJuK4Ic=,tag:SwJ/ujTY9VsrS8payg5FbA==,type:str]
-    ENABLE_EXTERNAL_MAP: ENC[AES256_GCM,data:jwbL3WE=,iv:EmuPlxlldYIK57w44oeiOUx4dNUx88avn/MXGw0khqk=,tag:6UqgxY3eTE/DQ4znx5NNzw==,type:str]
-    ENABLE_EXTERNAL_RATES: ENC[AES256_GCM,data://NWaSg=,iv:l1k7TLg2d4impHiGyHtVmXFBpHSK1X+MIIMEvqHmFCc=,tag:7FX96H6R+ez0corFjpzoWA==,type:str]
-    FIREFLY_III_LAYOUT: ENC[AES256_GCM,data:KGo=,iv:xvBorcd8fPvlGYeomuexZBtORPc7LJRII9pYP1ZNBsg=,tag:ibFX6k0a12rXElxRODc1YA==,type:str]
-    IS_HEROKU: ENC[AES256_GCM,data:Ffu4Sro=,iv:Q5txv1a/DcH+Utlr12zQJUBy4vlcdxcHFsNDWuWVOeU=,tag:NTay0IKz6s7a9dFpx1BZ+w==,type:str]
-    LOG_CHANNEL: ENC[AES256_GCM,data:Njfav/E=,iv:xwccazZYrtARU7xKooAnBKJcCDJH5xUSN0C+nIs8Pos=,tag:jI3pelMMZQQ37uuUmUmENQ==,type:str]
-    MAIL_FROM: ENC[AES256_GCM,data:ILVOrph55Ku8pIfsHtU8DjMuUjo=,iv:c4wzRvDugyRUbKZKq/fgQ2eP3CJ1wJzkQo89tBCZ0WU=,tag:tx2lUsnCBbYIk0h4gL/CBA==,type:str]
-    MAIL_MAILER: ENC[AES256_GCM,data:rdoZ,iv:NBi4YtbtTkDJHQmXBu9lGUfCWhfRgtYLI3UCayMpq2k=,tag:o+cXYLXlJ0bWVQAPr85CJA==,type:str]
-    MAIL_PORT: ENC[AES256_GCM,data:lffjiQ==,iv:GsZWiMZGuhpPJfX6vPcr3PKuq2YXS3oQ8v8NojufyKk=,tag:rHcfDoLZdU5wCQR4g/qV6A==,type:str]
-    MAILGUN_ENDPOINT: ENC[AES256_GCM,data:rrw7Rwjo//tdEyxN98pE,iv:3aeAQM4RV5hDFfZ08voXgk7IrejoM8YACluo75AmRrE=,tag:cAmTiI0vPAnY7NX+YlM6Og==,type:str]
-    MAP_DEFAULT_LAT: ENC[AES256_GCM,data:i8I6LaPPLFoi,iv:sG6dP5GS2G6kGXEsn8P3KJmyEThJ73WIN2gkMJwNDBA=,tag:uefjbg5pZdIIONBklcsSyw==,type:str]
-    MAP_DEFAULT_LONG: ENC[AES256_GCM,data:+ESO4h6cGSE=,iv:hAFNmDfc6XWnQbpLQXjUsdZSOwPu964MlFBXYsNr9O0=,tag:iXfs5Z+Ojojzp2H2u1kHxA==,type:str]
-    MAP_DEFAULT_ZOOM: ENC[AES256_GCM,data:zw==,iv:soYKokimSKxSS0x9nM7GcZfpXtwxjuXVls+KFh61w30=,tag:ryX2Rj1TakKRfynh7bFEtw==,type:str]
-    MYSQL_SSL_CAPATH: ENC[AES256_GCM,data:Mo68CXbhV7kK5ZGi5MS8,iv:pVKSl5Tu8xzZVk4FX0DIA3vpVYZ9V0RXtfkoUTYeAAU=,tag:bez1DYHFlOn5TZ/oz7F6fQ==,type:str]
-    MYSQL_SSL_VERIFY_SERVER_CERT: ENC[AES256_GCM,data:DT7Jow==,iv:ZEOzfc0IepdvDNo2vWanOsYAT4EGLvFnSpL8qiiOwes=,tag:eEilJ8cwgCer7H/8qpDPgg==,type:str]
-    MYSQL_USE_SSL: ENC[AES256_GCM,data:rsKgGpE=,iv:nEJbHiaqOvVauAtCyL6uvfmkAmgvjjSFb28L3/j1PmU=,tag:6d5whsZ30buXkc0W4+5JIg==,type:str]
-    PGSQL_SCHEMA: ENC[AES256_GCM,data:pmFdRyiy,iv:mYXXlj7R7T3RTuK7QNRKiY6HwCezQYaMpn6de0st+FA=,tag:xFs7kAnFuRjDVRjKyyrJOw==,type:str]
-    PGSQL_SSL_MODE: ENC[AES256_GCM,data:/spE//X3,iv:qCBP7fJVFixBrB1ApGti1Nq0S87RcVxpHqmPBW9GuWU=,tag:MyCEseplfPX9PNdoqGLvmw==,type:str]
-    QUEUE_DRIVER: ENC[AES256_GCM,data:tTmRSg==,iv:2KdDPsJ9PlyHsVsFdknC7A4cShE5bBBpRxWslF/0wgY=,tag:7QN0MlfyoDyukmAgmgQvxg==,type:str]
-    REDIS_CACHE_DB: ENC[AES256_GCM,data:9w==,iv:MKfWJO941vxlJ0VP/0ob9JeFnHkI+okOkd/ifxkbKTA=,tag:PyyjVTRCUSvZxpHekP9ENQ==,type:str]
-    REDIS_DB: ENC[AES256_GCM,data:Bw==,iv:h3v/+cO1W7eGDAGjVtgeDh8UekMg+ZvIRkNZx+iE/Es=,tag:nF143FAtE181ZJfAjtau7A==,type:str]
-    REDIS_HOST: ENC[AES256_GCM,data:7hVDI2P+443UGlw/jyBFmNTDBM2p,iv:sbLD+/wdDEiKYpR3ttrey6HTlI5n76trH3wZjU7s3uQ=,tag:qZP1nb9+tOr7Lm4i9HR4wg==,type:str]
-    REDIS_PASSWORD: ENC[AES256_GCM,data:/i9UM5Cx6h61xbDQ//ocmW1BtmT0LILnwwemOwaTTkw=,iv:FINFRW1006Ljnb1JSi+Ctae3Jw9xR5EW73Ut8FCNfHI=,tag:+6raDqY1TgQQgbkcCcbCLg==,type:str]
-    REDIS_PORT: ENC[AES256_GCM,data:ME1O4Q==,iv:FhqTqv645wnhhQdGW0IsemeXOlJuCKjbMa3tBw0kueI=,tag:b7TdkDklkFwE/X3lE6XZGA==,type:str]
-    REDIS_SCHEME: ENC[AES256_GCM,data:puE6,iv:XvOpz9QO7Fn14bbHT8L2p0HquNxIzxomN3Bg3K2NOQY=,tag:qerZcGVGKXW+YAyj6RK9Tg==,type:str]
-    SEND_ERROR_MESSAGE: ENC[AES256_GCM,data:9xoXVw==,iv:m20IvyDsNzw7v3U8Ai34MhhxrIUGnU3OK9LHwZAdlJo=,tag:BgrhqBiqc9RYo9EzOCvSsw==,type:str]
-    SEND_REPORT_JOURNALS: ENC[AES256_GCM,data:+ErZjA==,iv:dcrc2+U7MoSBQ3b7w2qe0wIb50AbLDQ8/N9TK03ub5o=,tag:ub6+5g77qZxq8IjxDmk7og==,type:str]
-    SESSION_DRIVER: ENC[AES256_GCM,data:QlF9bSQ=,iv:I1cjDE4EFVG166ISZaNuM0eFMs6U55y7LUl2cVIONrI=,tag:VxKEC67A3Y0IRNKJ/nZV0g==,type:str]
-    SITE_OWNER: ENC[AES256_GCM,data:KbzTQ/QdlMmxnSDr1mCo4EG9,iv:287MEAzZFE3+zp3bWWA5Y2u3w7iQH+7AAZ812I4Elx0=,tag:TlljmsgLww7EJIBMdDrKvA==,type:str]
-    TRUSTED_PROXIES: ENC[AES256_GCM,data:cAU=,iv:MBL/z8pmM2CxlDT1sY4my2gC3jsDo6O1NSa11w3en5U=,tag:zqzHOR69HT3+U7tQOFQQSw==,type:str]
-    TZ: ENC[AES256_GCM,data:45gLKxH0OsAfMPkgnjKgWQ==,iv:P9CUovVI4WSfZi1nyFHVzHJ7Oioai1FUZRcgBNhQb64=,tag:S7IF8Oxg7hYNcT0mcgkg7Q==,type:str]
-    STATIC_CRON_TOKEN: ENC[AES256_GCM,data:1xck+8s3ifQmregeKU6891pErxZy86fO0I6XPE83l3o=,iv:XSsCSJkkGwG12f2lhd6IDl07OLVCW8J/945acFP99lA=,tag:XNxSQGyHvR/6/A3EVT69gg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-06-17T19:05:29Z"
-    mac: ENC[AES256_GCM,data:GWtQz5/wKpk38ZYLwn+kGyCT8hFo2SmoaI9vuEFju6N9ipJW1MNQONqTx/Qa8Cje8pT7xIxdoTf+23PaFG91v/gcilMCYjE+OFnVBk80d6ZBTXiSmoQ0DYO3hWiXyMfXTJ1OPqExOkY09QSAfXOrN0JphnWpPNZnaVuxMJZS/Og=,iv:/QbEi6hhsPpeSa5bOxPObP8UUpAwA/I6wU8VXQ6NcOc=,tag:FYYj1y/zTl82SVva0oauuA==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:36:01Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//So248m5bmfJG0gp5ZIAK2dVhH44xEg/6yzZ6TC9W4px2
-            SPqB+gmwswX64NGcGZQ8LQZExyy2poxh7lfQHIdsv2QSTbf0vmOZqG9L7Fv/DSU0
-            EnUpt04K1yyVyW09tlcE/SIyMy9HhWyH0vZfwqHc/pHnaAhZKEuBH+kFiNPz4Bfd
-            xtXeieOGYV9ois2vM2NFNohEagrkbpMb8ZEOrWlB8+ZJZhkIeNc2kA+w0n0TEEtR
-            WefrBwear6YloK89hEfWRdJYksfKvOsU7U+L6MKpMxqGBIpLIV5kTifRAt8pdrNX
-            m7MY/laTWcqTp1VXUMZQUq+tCa/jjIh4MDvmzGcrRfhSLDvkFz8W43yHvy/hTKgc
-            nes55vhrWK9ABcZ5sZ3xdfH3ys3tODUsUkaLALaCbXUdg15cQRwvdNkgHou/oY26
-            jAc38EpeBEtIpkH+nBHLgbflFkElqOcpcS/5OR4mL0dGQ0EhhYTzxES+jcVYg9ka
-            Na163uPvhNnFNMUACKsDU/u2WngU8B5ISjlsiX9EkbKqDgHrLSJywKcoYESgnU/K
-            q+24HIFH8cmghRYJZ7SXDahsEw8VrcqQEWTSMM4YnwJeBZH9pjeUK6RySLHxK9F7
-            rK2djzc6so2Lk/AhYot9FNNwXWqrBKQq7kjFF8Mr6ALydZgst/tSBPtpTxpADZDU
-            aAEJAhDuDefWmaUMfyK+B21JoUTJtAp1icQZrIFg+mTH+qDWPXdpM1qsaci59aq/
-            vkML3TwjiytUNRMVORlLPv2z8adUuXIgPx8yEclTxCDKM3bqIfVs1xj2GAItyO4K
-            XYBV8oIdHegO
-            =GI4b
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:36:01Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAApwoZ01GS0soprXAf20Ye1XQVLIFvIuYjub01ibNZmb3m
-            uJiPyClzMqcjy6TKWvCc6sT1W5DQ3aY9E1ARhgwR/yaIZ31WvNcnLczaOACHPlaW
-            7e4o9tauN8CYpQqPmTxDyQehKe1EbWqq+63FRAUV0+9qEY/ACCwNtv1HCa2dgyto
-            0I6v/BmW+KJ10iGCsRv8g5IgPSjYT66a2fsDg24kjtqygHwZ5BPe6xUBJ7zxCmVT
-            z/3WKaNx5Rdv8l45QQcl2fe1qNNdljJNgowCq23uODcQPJPGEY4wOeYHOlGTKE+E
-            JojnysVUhILhZtTZ5/AcP36RCzMDGQX7wYtvwh6bgf4qf4InX8+O/WK3u+jOreUl
-            zbcy/lB7bsQ0usZNPsfy2Qh2LPlziBce9JtkPnWXBwS+lZUCXKDS8pizmj7DZnlo
-            +3L1f26rn21ye/iOyBArzVmqI4QLJzHJI7l6TZgvvv1dZKHyLW5jCHSq4f098roO
-            kIKxRThFvTZ9jqM7uDYGiAsGt1L7p+HJRY5WdAVGEaL8jWADW7jjF8qTF3BJ05A9
-            OgnRxIew6ofB5WeYSrU5dn5di6pTNI6bqHVHbZf3BTrGwdpqsAcniUtDM1FAdU/4
-            QtB7tXNAYV+ZTDez/MMm7l1xKS6FpPbM5ZUtrcv27I51e2HAyYSsj6FNWWyvXEbU
-            aAEJAhCfDkAnvink2rBria46BR0IPWSLaVEpnusa/OED/Xw4EEgiFq3XonPTHaqG
-            iXSfeD0XauMxpLan+YesEv9SRP3ef9iX5OGNwVPpIDlkOyUztBWtf3I7tP2LCf2p
-            /GKlxeQfAlpx
-            =zWYo
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/default/fireflyiii/helm-release.yaml

@@ -1,73 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: firefly-iii
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: fireflyiii/core
-      tag: version-6.0.19
-    
-    envFrom:
-      - secretRef:
-          name: "firefly-env-secret"
-
-    service:
-      main:
-        ports:
-          http:
-            port: 8080
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "budget.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-            
-    persistence:
-      firefly-uploads:
-        enabled: true
-        type: pvc
-        accessMode: ReadWriteOnce
-        size: 8Gi
-        mountPath: /var/www/html/storage/upload
-
-#    podSecurityContext:
-#      runAsNonRoot: true
-#      runAsUser: 10000
-#      runAsGroup: 10000
-#      fsGroup: 10000
-#      fsGroupChangePolicy: OnRootMismatch
-
-#    resources:
-#      requests:
-#        cpu: 1m
-#        memory: 275Mi
-#      limits:
-#        memory: 500Mi

cluster/apps/default/gitea/gitea-secret.sops.yaml

@@ -1,64 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: gitea-secret
-    namespace: default
-stringData:
-    GITEA__database__DB_TYPE: ENC[AES256_GCM,data:CxKLDkwWDro=,iv:vMzk5XUyeiUog3uaNWQi3YKOpnhUTUbZLWi8aQe1GOI=,tag:cIa3sjnmZZeqf8RkHaHyCA==,type:str]
-    GITEA__database__HOST: ENC[AES256_GCM,data:SPy0h0kvhTMzbx7IhmOrOZ2RfVF0h2E4,iv:YvrmhhZfPGzjuuppfBumrKjQzGAwmScZ4Kv88bTRTa4=,tag:xnrGbDv0XwhYrCeJ3l+Cvg==,type:str]
-    GITEA__database__NAME: ENC[AES256_GCM,data:K1lM4P8=,iv:5sN41GkSZ4sPLwIyVjiy6JNm20WFq3qNYFZ1gWfqG/4=,tag:hBoBRIgae5QRoMirGgEWmg==,type:str]
-    GITEA__database__USER: ENC[AES256_GCM,data:aQvMk8Y=,iv:SaDZ5fWWbhu66BqYJ+KKs6/zMrdTDoDZvBQKd2IyLck=,tag:4z7jRIT158aUxaOmYWewAQ==,type:str]
-    GITEA__database__PASSWD: ENC[AES256_GCM,data:n6ywTKo/Eb8JU9/MBvwlbLxcPJp1VRRrMKniktMZjS4=,iv:c7DSl3ReYNWoRN2TPeGkxIUo/OXz7EtKr416nBtFUxA=,tag:zEf7GhN3RNkfbSn13WA1Yg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-04-27T23:49:11Z"
-    mac: ENC[AES256_GCM,data:tAs7ev9V8nwDlpUeYC6D79gpT2IztnIppycM3GSmiLwock9XrJilAyaahd+OdmLQXjEqqqOZjLKVCm67xf+3jiPFkmCsIfP9A0incrySEJBVsum9/7i3nbUTf2tJyhj7mlex33KG3Arsinx3oPfY1U5QykYBBLR6dEan69Vg6Fc=,iv:IrrJnQgpyGW6B2Nu2IKetT279/WRDU9yG/A6r+5gtXo=,tag:ZXdVSvVsP3IJECSCguSdVw==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:36:04Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixARAAgNVBrn+y64VuYMkJBTyBQBE3REx7MR+OlX1Rw8gSsyIf
-            A9sSQsNEGuiOVAovuoDbz5uOCEcu6FBh1i17NEQj1f4VYQJ4W2f3+SFkRqfXmXgJ
-            CEW4Ho5M4q30Lztp+8qy4coP6we7KkiFrVdyfWhFhI+J27D4VBpmlRszdDzjKSWn
-            iQ9EYIxSbTnTZlo/79XNB5vmb/JIQz6K7PKjd2X16VJNp/Q6iIJ4pYFD9F0qsnTJ
-            lfeo38cuKYkbx026hg91uTJKRnoKtpJVFmcvZ206/4o3ACp6pMbOMMREq273aFfn
-            c/da8+rpTzK9h2oSLRJA8Xeo8Ki/40VxVerKhxzEFeeV+SGXHSW8wn9hjbq1PFrd
-            9CM15YGBE7ikgllbW87SbcN870Zfo9O8aNSrLFtVYkBVNQGBuJ8WKKLGaHYY9LMl
-            9jBBaNRQG0vKCZ+72cDVLNa+M0U7IU8PO/G05ksHZUFPGLOXIV+k8hzFbcQ+Xy+l
-            2ofNe6v6PDG3kI6V3epizzR4x+zXF4LOKZe124PuQTLnuaAEUQzZfMGHHr9QsAae
-            PmaM9BWZ39pwKETWIDnuYwI5gdJdIBQjNIpCo13qZBk85k36RhoY/TO9Gs6iCyot
-            qXY6TraqnL5o1pda8gDBdl5PvB1A9K0bYF/KZYG3tVz0oFb+3QPNkJ2ThNqwji/U
-            aAEJAhCF1XMZ7b7KXIiArVZU0aWlr1ft+nHLNjQHaj6+8F6trh+Zz3acnvk8YLaK
-            7RweedA8WMtRJY2gRpZaPU6XVLt8IZmnKGSDoAf0mi6+9oCttadxz7Mp1Cvd3sgX
-            ahD5a4xk5FiZ
-            =6Lqx
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:36:04Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAir4hbzyy5fcgrdFcTPcI6uyVRoETFz7VfSdo6pl6zOYc
-            ZYSDO8F+Hg5PBCHbE6LrTf1lMXtRKTOI4sIXGisACd7xdfDXvdvmBTuntovpk10L
-            4uj/umXjxOZVUyQ6642EU6FgxfNYKBOSR2lXoKtXh76GWOBPQ6uKF1VAW0MzFiXq
-            OFgt4U4KqTQoBdb4h8or+z1Yvp9U0hY1JDOUVzT6ymXxzjvjNcRLFpYxbaWynkG/
-            n1NkjY7nMxaDwcZowDfinNOD9VeIvZXthYr3eFuRzxHB8vKZlBLce4YpUL7lT56V
-            VQxt5h9gNJiXevuKUrLB9rnEPUBIqhf5RNH+qa/w7c4VaQlGj6p0Ns6giS+mIjYX
-            6h0yImGLnwCAbLgotVrUlir6a6Qodbote8LKa4G5hIKkF+O6gKjWZ+R4aO0OEQv3
-            tnTptRdVHA0oDiVXJk/RrFQHR7xo24AFAs+OXoBmMUrl5YxigV+qmWG1fnCNj1/l
-            TOMIM2hd9Lbz5iS8TZwKfpoZY8BJQNcd1Wab7F1KboGAAnCRLezMKmVDRzOQ1GIu
-            tY9ub63JqwQ1LgDKaLxgyflixPj+1460Qw2wBK5bT529QZ5EMlUIucKlF1MPWo1t
-            NGRXYR+gI80bb+tq5KvItL6s8JfJYm7HcqslT7/mCepJqCMulGh31Yai6NR+lQrU
-            aAEJAhAPp1uMcNtvlDzZ5ETnOxY39UV7h7RmWXvl5JsfYWXD3E+8O2hY5Z3u8viD
-            K3g41eXvY6+d6qyRQEzrkdTVQVU3bjxxp5cbkSrVWlZa93CjYR4Kypbw2TJspDq/
-            CyoEhvxtdypD
-            =8bDx
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/default/gitea/gitea-sidecar-secret.sops.yaml

@@ -1,64 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: gitea-sidecar-secret
-    namespace: default
-stringData:
-    GITHUB_USERNAME: ENC[AES256_GCM,data:hf2VmtB4nmo=,iv:g6OflUpWClklphmVsGmNh0dmYWFmP75326yupzU2DFY=,tag:d7pmSAL9ND0V3BtkfTXmnQ==,type:str]
-    GITEA_URL: ENC[AES256_GCM,data:jqGmGnLfz7vwleKXOj1JNt2RdxgtrR9E,iv:QTTajHdzb9mtYY5xCiLzI09pIBE8Dtl7WAR0gB5yOwA=,tag:0KHQ4ezr7diAs7v04ZHPIg==,type:str]
-    GITEA_TOKEN: ENC[AES256_GCM,data:bHjjouHJeYgxE5iLZxeXCqubOj8U3oizxmWZThDj73e7DbLsMoPWOw==,iv:Uh9OGeAw5iuwqFDKB4/Q6xvck2nQWewBMbFoyv/9zPQ=,tag:2U+KD+0qY+iceVhhVNKXuQ==,type:str]
-    GITHUB_TOKEN: ENC[AES256_GCM,data:S5RVGUibveqUoj7mSf+4m9DtHxgd2ybifOkqJTsE1eDGOZwgpWrSZQ==,iv:GMqA/xAHFR5EAhYgnPaJfKVLtdVgtccbBa46g+RBOwI=,tag:fU17aUJC3dsj+aayNEs/zA==,type:str]
-    MIRROR_PRIVATE_REPOSITORIES: ENC[AES256_GCM,data:8ClWoA==,iv:g1N26o9upienKfmd9GPZq/1IvJsKDVsOkvQfU9xyf7E=,tag:C0LBixZWj2o4XJUjf3WX4A==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-06-04T16:03:26Z"
-    mac: ENC[AES256_GCM,data:ky6LUNwPWZrQAgQbdcLc9pFPDKuuHQHLT/t4825fzDKT8LZNwfTkr7tjcnrfxp3zt/btdGWDRI3hDL2IqfuccBfcVqofRSE9FnnYKsvGPuUxnxbmWYtO1VNIQ7j0mHWsivQnwoQGPjmHGqg34vaQvNeq+2F0VrnGCHCoSrT5dFw=,iv:BRpJxXVmHPPYVBPK3LX2xRrLlIWd9iKTkaJf/Wm79DI=,tag:rrn6DBaws6hYohE0ObWJ+Q==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:36:07Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixARAAmXw7G2AAr7hRPYMsHwRjv54Vuj7G0fjiNB5cSRgFWgYx
-            0QmLx9yyWMXcXk8HDT0JUINtind1BkaSrmWFWR5BDt0zWBxl7aIBxbpVQX/ngro6
-            GBHoUcmg3mp9JquBhvPPfRFrZ6MeG9YBSlExevK/ibHxJH8KGTX1ZgUhXHt7SFct
-            a2wCU2d/8boN35hhnvuyHk9S7HtC83G+6aMboVJHtTV4XqtJQIkrifTkMfQZ/S/U
-            bxeHrf248GzCOIRkUuWKtLiMSC2eV+oJkcxrX218xZa7lEBL+Qr3StvtXEMoPiN4
-            h7qVmOHyXza6Z3Im+fDFtEVf/OiLDzISxgq373XQONRy5bYI0znTEldREnl6lY9W
-            GMnAdSBDMwyskKUOcpt8UfOM1Lgs77s7/BhfjU3bFHVoIZro090wceBSBKnD5s8Z
-            egHvJUBUcoij8hc6lJwS8HPpj/t0CVJu4p83Hzk71Swgtm3ZYkfops410c05VyoH
-            3JGFT+3dgH70zPqhkn7QHHpJq05dVgZyZq0iG9FRb3qZ/zG+Eh5UPXWoHjec6rGY
-            ElIJZTHB5cLqxuj1+gXXvi8ALXZfK9kUMUlmNTRh/hIMFUcCwrDt03HqVS4hBmFY
-            RGPywtAK12inSqg9OKNm2p0fOADKeAVQe8gGcF9yylVQqqije2IBPRhhUIy1t/3U
-            ZgEJAhDJi+OhQ2vMkt8ym/uhs2zHL3ZdsbC1HpbHcQHfxgJY5f7utKJsp+4emPu5
-            aljIcismK3U/PgB6XN/3NiSCMEGd6KogGrOY4TWmDPhzvEKGsVchk7O6eQKH3CR6
-            pN6JTThdGw==
-            =S1Z/
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:36:07Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//YwcVVkVzS1lQeX77wGkYEPw/zPnBPWA99eI/+UyvoRaw
-            croZrtQvudBQVuKjMa/JlUhLYp3+skrv/rCNG3xG9L28FQn4fkqP08vLEMH3Q+BV
-            +6m7Z41mqjXvxHzlbQLjtMB+d642LfRyOCgP1VPpA6J5QuD4Gxw2yH1a12lSXCy8
-            1ZnMw2EPIAXoy9uLeX5klzxNGih5aFATzx1oHGWbh7HHQwPQtn6KMoNUYPJrJDku
-            qkPxHewxA9jKTGNIc5N9HTfHm5VjYLwTO9MOsJ2DpkJkFYTgVCgyooHCyQCvfpod
-            SEvntJxvkz0WFHhIQVVqxCCdKwjw1T82EVnqCAN08x+4olHVApoEt0dnFohlt1mL
-            7FXQot0VddnJ6D0ZPowmRl49Yu2U7yyM+Gwg8N0JdDCqwjBEKIFuR5GRAHGBwb4D
-            RotZ0he1lR2arbJBjnIcjgO0Yb8+YzXvVTjmp/TjPx2PRID4B00AsvLdmWdHU57W
-            gWszKwtE3tUAcxGY9T+BiQOTJuFR8bOa1EiUF0p2pbrM/Xc4g4LHNnnH4bZzZm2v
-            oRPWrQunch+sNujlObP2akbmrHZvhj00mN/d+/PKNVaCPQ+j6UGtFyKYfUJyLjsi
-            WWjm/OSc4HmITKG5BI1OjWsIKtCbMLNMHIvPgKeW9qwmMDU3J+/toKZEIz/pIt7U
-            ZgEJAhB4YPeqQgy9FVmDsKNK7iQpM6wZXVR+uj9Tx/KLe4MSBzpG7zYqBUBNW94T
-            Hyq/OxupUWsxSgtly5yEoihyBQhBf0ECXHw5v5xhxFgouqm/NwSixwt6baRr5lmI
-            d3rYPlnimA==
-            =sP0R
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/default/gitea/helm-release.yaml

@@ -1,84 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: gitea
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: gitea/gitea
-      tag: "1.19.0"
-
-    podLabels:
-      needsDatabase: "yes"
-      needsAuthentik: "yes"
-
-    env:
-      USER_UID: 1000
-      USER_GID: 1000
-
-    envFrom:
-      - secretRef:
-          name: gitea-secret
-
-    # Sidecar used for mirroring GitHub repos to gitea
-    sidecars:
-      mirror-to-gitea:
-        image: jaedle/mirror-to-gitea:latest
-        imagePullPolicy: Always
-        envFrom:
-        - secretRef:
-            name: gitea-sidecar-secret
-
-    service:
-      main:
-        ports:
-          http:
-            port: 3000
-
-      ssh:
-        enabled: true
-        type: NodePort
-        ports:
-          ssh:
-            enabled: true
-            port: 22
-            protocol: TCP
-            nodePort: 30022
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "git.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    persistence:
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/gitea
-        mountPath: /data

cluster/apps/default/gitea/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./gitea-secret.sops.yaml
-- ./gitea-sidecar-secret.sops.yaml
-- ./helm-release.yaml

cluster/apps/default/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./fireflyiii
-- ./cdn
-- ./gitea
-- ./dendron
-#- ./whoami
-#- ./msrewards

cluster/apps/default/msrewards/env-secret.sops.yaml

@@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: msrewards-env-secret
-    namespace: default
-stringData:
-    TZ: ENC[AES256_GCM,data:rIp7EMSrKApRg03l4/59Xw==,iv:A0cFOA2pr7CvjQBiCcequq9WAA77x2k8iqTlMJ9lJBU=,tag:dYdQDtA1H1h/CufVSEbQGw==,type:str]
-    MSAccount_0_USERNAME: ENC[AES256_GCM,data:JIW/ueWXYfgP+rgMR/7aXWWyuRP1YQ==,iv:P69ybwaQPFfMJnfDiVM3TSSlc2YkAUUM6VANdhgFDtY=,tag:GlZwS/nWOJfm7NQzXLkPFA==,type:str]
-    MSAccount_0_PASSWORD: ENC[AES256_GCM,data:nUWE5vW9iSavWPKhVWcn,iv:NWI9ILx+M8EGWi4jaor8MpRWL9SYXibOp9Nct6rVB+U=,tag:CUqpuogj1BJk2ocicaj5vQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-05-15T02:13:48Z"
-    mac: ENC[AES256_GCM,data:q1QBZ3bGr90qXXHKEtKuSfC39pGJ90ss8cJtD8CIZYYB5CQAuz0fZH6nsim6FoyYhWXDzlDo8HH7Z+bLJt1BGXCSa0SDaOe9xcSZtBinSapTQ3sYSRul99xCD7QHGGFXZtYbPjCRv/qj58vRTLXHKejnh8hCbPJsNYCYYuBGXks=,iv:HDIA3WDGZwXhwRjioGnd2KHwWISinLLoxS4LaHLgRAU=,tag:ux9KEs0bYQUzkpnBdrIQAQ==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:36:09Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ/5AWY3FJu5a6Gdw1bQSYp8vcQM8Y40oEcm7K8VGQITHLvc
-            EFMd0EVZal9czdTuGMjQCMfKYw2PumPbzNUzhejJOVG17vmJ8fAchK3XiF0Ru4pN
-            2zcfzP35WA5/2npx/A7Mqds/BZ/jG1TxzgRH5XH52Rnq7/hJnNlMiLjmLNfTSRA3
-            H3lT3lU6RpQsxXSTzWkuyHmPj/6fl68Yq8pjqJz1dW2wsbE911wHvwYKeT8xeOYa
-            p7JRQSnEssLisIy1PItXX3uNyaEPoLIUUpJjKA8pWIDeR9iVEnytM4UhrPxYNWTQ
-            hqw67pl8sROHNTNNxwJ2mcbvxRareVRMJpQFF9F4c3Qy+Dqfc38bIJWCsBois97x
-            0mqFyAdhDneNdmTUd8Mxvf7lJ1N/ZBXhNIaWmmEyHocadlgkNC2gu23KNU4iH0n5
-            jj1qARSTnoPQGZ7Xo+zS7rPrvN2khILW0LLQWwXYy1Tm2OplApx3R9DmQkCfzO6W
-            cYWbW7ANmk7+6hnopJnNRAn+vVnjoR8GLBieLt3lJQAx76H7IzyLdxgI6Wtkh9Vr
-            vNbg+l0YxkGIqaIvsk5/w/pmSiw37m+tsFLgRZZdLKXdQ9ZSgV9pYzdH2e3wBD8y
-            haQzBZYEPRuVQ5QEiE6/HJSHJEmY15Z7DEwHzb7qoWn0Jg0fyyyfC49jKQt/dZTU
-            aAEJAhD5okv70Fq0Uer6t3fbvyVFqbOkbTLxErN/VYGRJ9xWype9rSEa5jnEPVSe
-            V3KhnB+sU6ROJfxIT0145Hi6+BWK9qYCmUS6Qncupywleda88Qaw+TGT6b+LUNnk
-            e0+sta4SwbYi
-            =9koT
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:36:09Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ/8DgLVCG813l/YHqZqrSKHpQNvolT2fIgxGPwWoCjpiDvL
-            C572dpnQpZ9dAU5J2i0UMYeH2MXnwHqSU+QcWXTcPPjmKdB0Pj4+BCsr/zUdHJbe
-            AMab8vqBuiOR9lL57t8tpV3HmhbKkDbUjL1BPBe+HBfFXjLNXu0HaIbChPAoroke
-            wpbua7lXQKyAle7Do9ROXO5Ol8nL548Kr1hYsZbhLBOJHYdW2O0OpTN80DtNKyhR
-            BEeKUrcAgXFLBXETPKbUgGELHJkn7LBiyxBHQJ7ihBrr8J0uH+4J5ucFm6K8iROs
-            KGjYLtmMWq9MMJTP7/I/XYlwaJvyM85LvBEkCWdEAFy/9JaQ/FXPM8BpqdVdB709
-            dt6smhY0jFd/J//0pSPW+qpyfp5tzY54IkYLM5BgU9G5pyQKV/SFsa446K272V7S
-            +yaBrpnEJXO7Wh2cAI5RKCkPI+YdvVpQUGnLVeMMBw/nMDG8wG3qI1lNGbetoCWr
-            P8K05M1rvKvwXY9mdMtnJ0hisidJwWxk2UohOV95Wpkd/EYsnzxuAsmwb3MrpeSi
-            c5vZluoxgDNZssnKYqOhavBHs15vIdevDB80X2ljeVrODX+HGfNrnTZ9NNe/TF2o
-            1aR6vUZ/rykJfYD2OhqX8hxD2ti9YWhOhD/TWo0mS/zMN1AxRbBRZbIg1YdoRYXU
-            aAEJAhB7B8y40+mMvqS8MEDuK8Bz5CQ75FyXA+hLr71ui95SQHvJgXpO9X8UkRJj
-            kxOXz6h4198C4iiNpcl9oXEtcNZRMUEm0Vr+2RBsK0phOJamlMKBwhExAcspHNr3
-            BiFxA9mIhB6h
-            =0koQ
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/default/msrewards/helm-release.yaml

@@ -1,35 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: msrewardfarmer
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/binaryn3xus/msrewardfarmer
-      tag: latest
-    
-    envFrom:
-      - secretRef:
-          name: "msrewards-env-secret"
-
-    service:
-      main:
-        enabled: false
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch

cluster/apps/default/whoami/helm-release.yaml

@@ -1,47 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: whoami
-  namespace: default
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: containous/whoami
-      tag: latest
-
-    service:
-      main:
-        ports:
-          http:
-            port: 80
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "whoami.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls

cluster/apps/dev/code/helm-release.yaml

@@ -1,73 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: code
-  namespace: dev
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    # Add init container for pulling znc modules and putting them into the modules directory
-#    initContainers:
-#      pull-module-source:
-#        image: alpine:latest
-#        command:
-#          - "sh"
-#          - "-c"
-#          - "sed -i -e's/ main/ main contrib non-free/g' /etc/apt/sources.list &&"
-#        volumeMounts:
-#          - mountPath: /znc-data
-#            name: config
-
-    image:
-      repository: codercom/code-server
-      tag: "4.16.1"
-    
-    service:
-      main:
-        ports:
-          http:
-            port: 8080
-    
-    probes:
-      liveness:
-        enabled: false
-    
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "code.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-#    persistence:
-#      config:
-#        enabled: true
-#        type: hostPath
-#        hostPath: /mnt/MainPool/Kubernetes/znc
-#        mountPath: /znc-data
-
-    resources:
-      requests:
-        cpu: 1m
-        memory: 4Mi
-#      limits:
-#        memory: 200Mi

cluster/apps/download/qbittorrent/helm-release.yaml

@@ -1,102 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: qbittorrent
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: lscr.io/linuxserver/qbittorrent
-      tag: "4.5.4"
-
-    # Metrics sidecar
-    sidecars:
-      gluetun:
-        image: qmcgaw/gluetun:v3.35
-        env:
-          - name: FIREWALL
-            value: "off"
-          - name: DOT
-            value: "off"
-        envFrom:
-        - secretRef:
-            name: qbittorrent-secrets
-        securityContext:
-          capabilities:
-            add:
-              - NET_ADMIN
-
-      metrics:
-        image: caseyscarborough/qbittorrent-exporter:v1.3.2
-        env:
-          - name: QBITTORRENT_BASE_URL
-            value: "http://localhost:8080"
-        ports:
-        - name: metrics
-          containerPort: 17871
-
-    env:
-      TZ: America/New_York
-      PGID: "10000"
-      PUID: "10000"
-      WEBUI_PORT: "8080"
-
-    service:
-      main:
-        labels:
-          app: qbittorrent-service
-
-        ports:
-          http:
-            port: 8080
-
-          metrics:
-            enabled: true
-            port: 17871
-            protocol: HTTP
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-        - host: &host "qbit.${SECRET_NEW_DOMAIN}"
-          paths:
-          - path: /
-            pathType: Prefix
-        tls:
-        - hosts:
-          - *host
-          secretName: wildcard-main-tls
-
-    persistence:
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Torrents
-        mountPath: /storage/Torrents
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/qbittorrent
-        mountPath: /config
-
-    resources:
-      requests:
-        cpu: 10m
-        memory: 250Mi
-      limits:
-        memory: 6000Mi

cluster/apps/download/qbittorrent/qbittorrent-secrets.sops.yaml

@@ -1,65 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: qbittorrent-secrets
-    namespace: download
-stringData:
-    VPN_SERVICE_PROVIDER: ENC[AES256_GCM,data:R8/w2f+rPQ==,iv:jy1iVRtJq9l/fYKjCdSrSneNZh8V9/LHVopGWdjtpNY=,tag:HkzAyAuflvqEcdHGF6jnfw==,type:str]
-    VPN_TYPE: ENC[AES256_GCM,data:Dff2qD9mAVX7,iv:jhLEkfAulvPxN/uRdSF3MR9GbxnRt2cSLqDOkXO7qPA=,tag:dMB6aEhwLssc3JPKdFULTQ==,type:str]
-    WIREGUARD_PRIVATE_KEY: ENC[AES256_GCM,data:tJ4kblrOftyBrYgqDSJ57enBP7mBBEXMrmKJZercTB3fKtMooclg2/n8FCc=,iv:dKWOyUIYm3RvyYG1vff3LRMMD5gwgx+yis7zolmyusA=,tag:5/x3Hf9Ruj/6F+6Tk63WLA==,type:str]
-    WIREGUARD_ADDRESSES: ENC[AES256_GCM,data:pMw8j00STTuwVrt/oj2D,iv:o83njlr35dFg5SiTTxr91l9ox/u3AqQ4iHoozSTd9OY=,tag:ybBGtoEqqJTu4DuJwbEPWw==,type:str]
-    SERVER_COUNTRIES: ENC[AES256_GCM,data:pyid,iv:gItcOstdlJ6t5uICxGHiEFjcz7pu+t62HBhja+mjaT8=,tag:4aNdJXDgyrWHa5LV0D5EfQ==,type:str]
-    SERVER_CITIES: ENC[AES256_GCM,data:XwiVflyqpQA=,iv:9ZAV0kS2WNKBezsAVROh3IEIBw4igkNLJqG44oboTq8=,tag:Z6KJUbiU5WL5QfJcWjFo4A==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-06-06T23:36:59Z"
-    mac: ENC[AES256_GCM,data:dcRFIAQMo6352koEJwcvx9cRx+e2mYebcJdw3sgyMSGQ3i1x5GHu856l4R9Yu9i/t+5v0HLbi1Tsv0+19JnmLN0dpMPb+NkbM7wjtExkMzT+HITOAr8kvyPPwZkyl/hdJSyV3/tF4epC7X+7nvjklyueeZpuIBn1NnKO6Sx+BCQ=,iv:vSYzOh7Lln3O+upSn8y1B0DBLR7pobXCO4DtBLDAzto=,tag:AD7BBAPhvXII1dbEC+8+3A==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:35:06Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ/+LSh/Pcu6Nvg4gon1CiT6yNrOriepFC94bRm35ia1rmhw
-            NqqW40gjTFW1oR2rPV3fKDVozNiCIAxH+wFm8jTqpE9tFYWzSae3gq9ms8KTj8xi
-            EEPX/U+s1a8QCvUC2z2Pg4i4i5+j+rNcmb0capm1zpIP51PfMgvREgdLRgEa8+vq
-            w1h4dLMy+PERXepWZmv3b0VL9irjUHK3kHhBcTrMeL8AmPfHICBUs0zxzvlZsB3d
-            8AIlvHmyuaJg2uae3HKcSWoCGQxFGGSfIgYNT20566GIHckg/hlSymxEw34sA7iR
-            20X+58U7Tzm8ekGyr+y6VOuk0XmvSPSnegpvUFhhJG9r5equUmVJo7zeDwlFSDOd
-            dxi2R0aBitCO7XnhGKvA/x9loyUhm5IekDh1fn5jBeGeBoGdm0zXmpxINH/T8hSp
-            B7BcxhifxnctCRpMVpOLZcDRPzZPPqgGpnM4b8GCiy33T5wt6ufWOJh3JfRQAMpf
-            PnFxPWZiRsbGYMC0+sGeOPOe9oYlhAmJroDn/zn7p5rYKWIYKWfQDnOBzaO6wB6r
-            zG8bEFmj44ikfOTasBMTOtIdkrk33yxYvEUUqu5zDPE6I8hsmjMBQQIQMffyO0Ki
-            Z9eXM/A7XtR5+12D2gEl/C8LP92T2MXFTo7T6WenPBt6D7exwP4NfmHotRRM1eXU
-            aAEJAhD9Z79FLyo0CJwz4P9JDDzz2PBEqnkbxHD7UeNHdIg6kSJz6dRCZpAbixOs
-            mvqyo1PQzwj1ihYdD0fmpUCoqrNYuW/nPes3wEv6JfU6Ez97RHaknHDlOtVs9cX0
-            pNhiuu2eV0V9
-            =vaBY
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:35:06Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//fd7iSVur7i0ontjdR1BuC8mxaxd5grBm4VZpTidySOxU
-            XvKlQ3eEaW5Ekt2aCDsTR0B8oHAxyiq9qjh9492i2nZJhdwZVMgmFuLcLr1YuVGs
-            5j54Rig8Kf47VegFuppq/qR9Se240u5lMyngouU6+fDv7Nz2dkk+tmyvIvuXaXK2
-            xr9coQ89gKTINOFle+dlf1lKam4nMRvnXF/FPoGzt2/T8QFGpRyT6gM4OO8ab+qb
-            Qtw7CYSjX5bzLeo+Yphv6QArC3cyixQJD6CCxbcyyz6W5NOMWqakF3JlqBZvU2XK
-            ypXg7d1884xPEZv6W2ENJ1fgtu88hbsLX/D8BWPGenRoYKAfLJanA+bt8XfCipg6
-            aXYlkRRHkQuEKnZ8H7uEgYgp4IQv7Ae231GRBVXeLwSzX/TX7DpVDDcuyYyRJsV0
-            FNF4/xpgJOhb4DSl5OW6pW3SDTAn/jtC1M0Rrx6dDSCgUUyFXYK+klsu0LXtDbvf
-            e1kRpOrq9urpPnpqdTK0hE4qawWkuAc3CniFJ89zr4rlRdPLFychonr/ELWlt5Hs
-            vyKiGJVj3nFwGzb/FGQm1lWts6j/a+tFSprneMh5hkrVDvIjd+qSLELacGZOkp1C
-            sSMzkurhd3xHedQA261rXfOFxhooWMofFiUEp3CFCHC1n9IA1me2RxfcFu5x/kzU
-            aAEJAhCgz5TIm8pQa1zQIE10FMCkQouhTeimyWOeQRcrZVFZZPQLOFxhUQwFxbtg
-            B+gjo8q2XMq4szzKa6ZEp8C1Qkw9zOXWxmhjug/oGHlGwsh2BK5aAFlvGSkZf9yA
-            yTDIrThWUe1w
-            =lQX5
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/download/radarr/helm-release.yaml

@@ -1,120 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: radarr
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/onedr0p/radarr-develop
-      tag: "4.7.3.7731"
-
-    # Metrics sidecar
-    sidecars:
-      exportarr:
-        image: ghcr.io/onedr0p/exportarr:v1.5.3
-        args:
-        - radarr
-        ports:
-        - name: metrics
-          containerPort: 9000
-        env:
-        - name: URL
-          value: "http://localhost"
-        - name: CONFIG
-          value: "/config/config.xml"
-        - name: PORT
-          value: 9000
-        - name: ENABLE_ADDITIONAL_METRICS
-          value: "true"
-        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-          value: "true"
-        volumeMounts:
-        - name: config
-          mountPath: /config
-          readOnly: true
-      
-    env:
-      TZ: America/New_York
-
-    service:
-      main:
-        labels:
-          app: radarr-service
-
-        ports:
-          http:
-            port: 7878
-
-          metrics:
-            enabled: true
-            port: 9000
-            protocol: HTTP
-
-    probes:
-      liveness:
-        enabled: false
-#        custom: true
-#        spec:
-#          httpGet:
-#            path: /ping
-#            port: 7878
-#          initialDelaySeconds: 10
-#          periodSeconds: 10
-#          timeoutSeconds: 3
-#          failureThreshold: 3
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "radarr.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/radarr
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        mountPath: /storage
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    resources:
-      requests:
-        cpu: 1m
-        memory: 350Mi
-      limits:
-        memory: 1500Mi

cluster/apps/download/sonarr/helm-release.yaml

@@ -1,121 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: sonarr
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/onedr0p/sonarr-develop
-      tag: "4.0.0.610"
-
-    # Metrics sidecar
-    sidecars:
-      exportarr:
-        image: ghcr.io/onedr0p/exportarr:v1.5.3
-        args:
-        - sonarr
-        ports:
-        - name: metrics
-          containerPort: 9000
-        env:
-        - name: URL
-          value: "http://localhost"
-        - name: CONFIG
-          value: "/config/config.xml"
-        - name: PORT
-          value: 9000
-        - name: ENABLE_ADDITIONAL_METRICS
-          value: "true"
-        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-          value: "true"
-        volumeMounts:
-        - name: config
-          mountPath: /config
-          readOnly: true
-
-    env:
-      TZ: America/New_York
-      SONARR__AUTHENTICATION_METHOD: "External"
-
-    service:
-      main:
-        labels:
-          app: sonarr-service
-
-        ports:
-          http:
-            port: 8989
-
-          metrics:
-            enabled: true
-            port: 9000
-            protocol: HTTP
-
-    probes:
-      liveness:
-        enabled: true
-        custom: true
-        spec:
-          httpGet:
-            path: /ping
-            port: 8989
-          initialDelaySeconds: 0
-          periodSeconds: 10
-          timeoutSeconds: 1
-          failureThreshold: 3
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - host: &host "sonarr.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/sonarr
-        mountPath: /config
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        mountPath: /storage
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 350Mi
-      limits:
-        memory: 2500Mi

cluster/apps/download/unpackerr/helm-release.yaml

@@ -1,63 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: unpackerr
-  namespace: download
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/onedr0p/unpackerr
-      tag: "0.12.0"
-
-    service:
-      main:
-        enabled: false
-
-    probes:
-      liveness:
-        enabled: false
-      startup:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: false
-
-    persistence:
-      config:
-        enabled: true
-        type: configMap
-        name: unpackerr-configmap
-        items:
-          - key: unpackerr-conf
-            path: "unpackerr.conf"
-
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media
-        mountPath: /storage
-
-    podSecurityContext:
-      runAsNonRoot: true
-      runAsUser: 10000
-      runAsGroup: 10000
-      fsGroup: 10000
-      fsGroupChangePolicy: OnRootMismatch
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 6Mi
-      limits:
-        memory: 20Mi

cluster/apps/harbor/harbor-ingress.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: harbor-core-ingress
-  namespace: harbor
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  rules:
-    - host: &host "oci.${SECRET_NEW_DOMAIN}"
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: harbor
-                port:
-                  number: 80
-  tls:
-  - hosts:
-    - *host
-    secretName: wildcard-main-tls

cluster/apps/harbor/harbor-pv.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: harbor-pv
-  namespace: harbor
-spec:
-  storageClassName: hostpath
-  persistentVolumeReclaimPolicy: Retain
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: "/mnt/MainPool/Kubernetes/harbor"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: harbor-pv-claim
-  namespace: harbor
-spec:
-  storageClassName: hostpath
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi

cluster/apps/harbor/harbor.sops.yaml

@@ -1,64 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: harbor-secret
-    namespace: harbor
-stringData:
-    REGISTRY_STORAGE_S3_ACCESSKEY: ENC[AES256_GCM,data:1k2KYsDvvQs=,iv:6GEFFeLSKH8+QxDg3rLR7q9h0jglYU4ou1byklt2x8w=,tag:JjFAs/3jsVhSBGJmbul4iQ==,type:str]
-    REGISTRY_STORAGE_S3_SECRETKEY: ENC[AES256_GCM,data:0U40z0y7vn2wPPyGt0dYQx80QuGoj7Ni/uJMtHgrc5U=,iv:YX9acsf2G2B4RLnGez6VLD2UiwKFIqhz2X4S+uTyX50=,tag:hVJVh2aSpVz22BjGGcPOuA==,type:str]
-    #ENC[AES256_GCM,data:JGk1Br4y3LKLTdPHRD4F+hwP,iv:rzYB5JF0SeE9BWwp5btZABpfHgqKfQukXpXAa0Dy2A0=,tag:K9pJFFtcDhmrE4SfYlivwg==,type:comment]
-    password: ENC[AES256_GCM,data:XkJEhaoRRSlxbKP94GN8dIZbj8KCwZFkcpgWNjn4vZE=,iv:Bi0D/T1izvN+l8LoZDwyUrcoN1ViS2Q6ambq2xyJFk8=,tag:ojUu0VOdnXJjbsb0XigkDg==,type:str]
-    REDIS_PASSWORD: ENC[AES256_GCM,data:8kEbWelcGhd4v/yewnM4QshW2hzx+VWX2iFE76sKhYc=,iv:kbGieMQhMbml2SIznBX1pTncnSaxdsZ0PUynCECpjyU=,tag:HfRJA+P57IzpxuFtKD+tTg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-04-16T05:54:57Z"
-    mac: ENC[AES256_GCM,data:c4DP6+KnDOXYubNbf5NqVZPxBik0a0BDiKqNLqm5dlNqjReeQFMa5BJxENelMwLMH2T/pHZ40i1UVfkTDbsy//+oWgUwZDcmN4MVDC+Y0nPqgF48K6obxJ0XgNg5tDqPWyxTMJuslMP3QDCZVyBWODb51Zzfwpd6fuiBogKdlBM=,iv:JiHRd3tFLg+UKcRfKlnyK6CEK6K6EAe/QNc0lm4Lf4w=,tag:wkt+kX3I//yN1Ob2+aiw5A==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:35:58Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ/8DxiD1YIAVNgg45XOY/mTWNfWy/IScUmkxdRygygmPEEX
-            OWU4sR7fW44U0hNRbWZX0Rl99ifn//eAjbTX9vnEj50de5dHW8r17piOaPtYEOqa
-            5woX+O+VgHCw9KM1rao8w34EZEeHKinXYiDhPrlZ3w2UFU+Jzi2DM+n2+dLhpxUU
-            QUYn3l3e/igLo00rA3/HzxRF2U0OaAtbnRENkSpOblAjdlrSpTFRmdvsw6F7RRO1
-            ddVFaVu7+EewH4YEerrP1VeZyuQ5wtSCrGqYNbuDko6/kizAz02JRbTNlPmCVqeI
-            liBIz6DJQWZe+6aN0cARBRi+POP/mFY/aL87vL7n13Oz8OLVwc5nb5ZXWZrJguEb
-            SRIX3m5gR24MIg0y5J0VzE4XQeJHhHv2CFptXqDATi8z05gmgYAaaO63KMh4Ztgw
-            Q9KLyT6RV2ipoUdwE0t+aY5JqKXlIj5iYhLkdkGrVZ5DJWYnxQThZJeE0oEGI7Xa
-            xNxJHONCuOTXXcS8wIpCsHAMKq2CjCa4PT2vGFsgoN5AL/DoU6M44T/YQpBG3vDA
-            /y8AVv6+jhp42iWWlkmqkjhlqOZbRrTqYaQTsMTSdZ5USE+p94TujFcaDWl40tkz
-            lY52y8sQ9iL2MmE2c6VqLvKK4zL/PbOxp8Hmq0wknoFrltJ8ln1PqN8xWYn/IHbU
-            aAEJAhBewFZNfVPgYFQF08q2PxaL5f12yeeDV/r6x66+INJixSFn2KAT8l9B4r3f
-            PMQRIj5HAwVu1pHh02dSqApy5nSFCapxonxFFEhyp5sFnTIAJIYrtOp3qlGiC+DF
-            ISEsf0H2tK5G
-            =1vmu
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:35:58Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ/7BEeLXvCMGrx5tmkipqFlu3z8ERLJ53uqLobFgevs0Cjw
-            gMnC74vQned+UFqwygWYjE1uAmZAx1MEZN64wPKBbin7wpcgdFl5b0BFGr1CoruG
-            tMlvWOtQMfJOPkAAwltqdkYrHMqjYuK8c5UD7k/X7cbf9zviN9L74JdwWrR8/EOO
-            WfhreYnGTyMRIw7nHE+lDoOt0SsW0e/N3beuWZEcYlkYaWQxwMKnNIfOpoyJqIcM
-            KpFTYVLsOGu5BJL6yWGfMFZ3FH/cwbWxOS11I7nVZVHHrQNRyMt/9vomU7+tpye3
-            XW+BESYEyHb7c+8t0zW3Vf7PfBYl434fy5qh3QY1qZPzf0AJeF+am19moebmNmO/
-            ZEi4avaefM7a7ruTbqKJJBMTqfR9Lc/XpTKcmCWyTYu/NGYxJn3CPaXoxyd94PVi
-            UD0caq8xdoDsszlI/iCv0A83CXV8THOT0Ak+vaMYLJ9FsxlTyL8ApcrhV3X7pgTT
-            GOCtPTe5cq1PxIyWnzynBwwbc9iIVduXgrjkbTZrri78T6ySGoj+G4m2CpXFibV5
-            QLoom4t13UROPrFpiPlwHb/yMYIds32FhFuW8wEzd8LXal2U1TgRYu0qa6GmGRqy
-            qkPGuKIZb6ahtJm7rRN6Kd8CuUQo3pV+YwX2ljHde8H3tDeUJijJPAgwZVk5kXLU
-            aAEJAhBA2OUNkgAOFcVgrrym90PW+PnTP2oFLwngZIg5izvCyhTXRoL7D1j/blhx
-            1EDzHzqQKmNoEN46y+sgbJMu9MzjahE7CfcoTCYs3A69eFiD/y6cfY4t/yBMFzWr
-            LDYnqh+p0PBC
-            =sfsx
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/harbor/helm-release.yaml

@@ -1,85 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: harbor
-  namespace: harbor
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: harbor
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: harbor-charts
-        namespace: flux-system
-
-  values:
-    logLevel: debug
-    
-    expose:
-      type: clusterIP
-    
-      tls:
-        enabled: false
-#        secret:
-#          secretName: wildcard-main-tls
-#          notarySecretName: wildcard-main-tls
-#
-#      ingress:
-#        hosts:
-#          core: oci.${SECRET_NEW_DOMAIN}
-#          notary: charts.${SECRET_NEW_DOMAIN}
-#
-#        annotations:
-#          cert-manager.io/cluster-issuer: letsencrypt-production
-#          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-
-    persistence:
-      persistentVolumeClaim:
-        registry:
-          existingClaim: harbor-pv-claim
-          subPath: "registry/"
-        jobservice:
-          jobLog:
-            existingClaim: harbor-pv-claim
-            subPath: "jobservice/"
-        
-#        trivy:
-#          existingClaim:
-#          subPath: "trivy/"
-
-    imageChartStorage:
-      type: s3
-      s3:
-        bucket: harbor
-        existingSecret: "harbor-secret"
-        regionendpoint: https://s3.seanomik.net:9000
-
-    notary:
-      enabled: false
-
-    trivy:
-      enabled: false
-
-    database:
-      type: external
-      external:
-        host: "postgresql.database"
-        port: "5432"
-        username: "k3spostgresql"
-        existingSecret: "harbor-secret"
-        coreDatabase: "harbor-registry"
-    
-    redis:
-      type: external
-      external:
-        addr: "redis-master.database:6379"
-        username: ""
-        existingSecret: "harbor-secret"
-
-    metrics:
-      enabled: true
-
-      serviceMonitor:
-        enabled: true

cluster/apps/harbor/helm-repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: harbor-charts
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://helm.goharbor.io

cluster/apps/management/guacamole/guacamole.sops.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: guacamole-secret
-    namespace: management
-stringData:
-    OPENID_CLIENT_ID: ENC[AES256_GCM,data:rIJWHZ9rJQ1jwXL3+Mg00ZrcUwu4CevdOHRuP/EYjbUR5cKccvgwMg==,iv:NU7HCctec1PJeE9RAi7PhSpsNR9jxSTqh/7IJgKm9aw=,tag:vAPLHnK8HbsTaisLPY/vfQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-04-11T04:35:01Z"
-    mac: ENC[AES256_GCM,data:Q+i2p15dIYxhSIfTxXOJF81GZEUaxBNko++GgP8mZolS4FxlRxRzfN7vTbXcjuUtHvXqhaLj5nkHr3D+DHEkQONdX+iGlQ57P69r54+YooxqN+k8xH0itbhkJOBQXsCWy7/du5O5hcaPKosD1mB8h/t4G6l0hmco6/teIr/H1fU=,iv:huBC55AnGpZZa8DLZrGjrialg4DQs41EvxrDFuUdvGo=,tag:qXsUyu9Rj2jNNJUP3EMA8g==,type:str]
-    pgp:
-        - created_at: "2023-06-19T18:35:41Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixARAAls4GtR9VbIW6MStf+SKBGybWAtexoVH7hrrg/qAbk0tv
-            WwnOmPgaPllMBW9NPTPZK0nYH7OEi++VbrBdZ0Ol69d2pA8SM3mpqg7a8zRKpg1q
-            loXNMsej0S+hMwqyYWc/WJnTqugQNo1UWO2RATFylsBPabaDVV77wU8Sgi6O71kO
-            55LYsB8y8HLbNFCeRafUutEyCbxyfFPXmBvYgy43JND82pfNRe0o3s+ZsTc/gSTd
-            CYoXlvYOMm6J0s/U/rP8L1JU1zC5f9RmvWpM2yKjs4HBB+WQ8zWMZfHyuXfbv8Yw
-            J/fJgpQor+BTWLLh+7E6JAqT0pJUMd31P290M0zfR7OyNIgFPfxinxzldheWziHQ
-            fU9YsPZaYHQoFGlYnUf8Ayb6l2aAl11yUPHcN135kBD6S54Ulm+5GLofS9TMPii3
-            WvDqZzvZo3wQSt/G88m5yNuImXfx/GGaCZUC3uv+ea5byZ9Zt5DtQiSwZ9rtIg49
-            JOCdn6ojdgiv8prFJuKNF55XQvtQZvwRQU8wlY9dOLnMPl/lfxU3cfOw7bZSCMI3
-            SA4XXOBdDOlKDLHI1BtIGm9aFlsItqt2Y7gMskGBBY43FJFlrEuNKKeZXxrlOofH
-            S/eHUK32z8NTor/2jyPF1MwfG458qDHZ99HxgF2fJ/fd3xj8MftWbHT2hqwDKjvU
-            aAEJAhCIQrI1FHAMlo9yFu80xKKfYvaUaUYpd8VL7YugtPjepy9+HIbHhpWISaze
-            oc1cYlQixHUPnLN9Bh2uD8qIx6YN+rocucP37IgYYMweELZg434wMbLFvLhGY+Mz
-            IQm/8YSSAZcK
-            =zmEF
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-06-19T18:35:41Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VARAAr06Bw3F9BG6WGrGDlI80snvLqG45nfeBfWS8MmAvWLf6
-            cbLoj1lp55VrGhfD0Rcl1oYdAaz9dJrhjxBojSbw2Xda8J/Lj9ogftOV5n/vo4Sn
-            nWHj/cCweg4mTu4h4zN4eYc5VhZySftJr6OI/58ba+jELOHpBnFD6ZqRWCZQYeqQ
-            /xgb3LviC7fXD27DD72r5YMqHlvPLThk5VD6bCG6DtWV0bZIp3nr4lCB0nUXIoNN
-            +a5dMsazVvqDY1hXckhRMBujyyo65zLWmo2nywb2BvGRwKiIwStUlKXrTCj0ALiU
-            +hBcie6Q6JrMdnuPqFygqn4JR0a5OF7rxBiQ1epuB4Un2zafgwNQppOuVILbXWss
-            lh9RJD9scauhlEI92S7IJ4YrgaoWHWERIPPABxJinge55+pP4KZqN5IrP5z0KQr2
-            ELfLPBtM5Tj0WbAs2OfcJuSZtybiLPVZ+351EPe03UVEdjK3DKp/cQ1TpO5HdKVy
-            dFndTHwGhAMLoRx2m4WYNb0HUwoRzSfiX7gXaHssjViBEJri34DfIR+Zt5Zvuv9w
-            1ySBIPmbaTC4uh7GtE3m86Dg+q9R69X5wmJOZe0nB96gmBQrMSWGtNOhLtssILwy
-            iQPn7VGRuDn6rAcASNtOO7zL+N9CIm8/kuNkEUUTvjsBNjXjf5JTFmE8htcYzM7U
-            aAEJAhCD6jX/IRbgbamJre1yKjBIzDkHgct4pDMgOMVZCc2c2lWvdheMGmjArCHC
-            D4pzkkocXtIcvBf9L5LeXqDlqlmr9vi5afeBH8me8saPHURPKw19w+1me6Hu1jZb
-            C6AWGnYRFlBW
-            =/Jg7
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

cluster/apps/management/guacamole/helm-release.yaml

@@ -1,72 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: guacamole
-  namespace: management
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: abesnier/guacamole
-      tag: 1.5.0-alpine
-
-    env:
-      EXTENSIONS: "auth-openid"
-      OPENID_AUTHORIZATION_ENDPOINT: "https://auth.${SECRET_NEW_DOMAIN}/application/o/authorize/"
-      OPENID_ISSUER: "https://auth.${SECRET_NEW_DOMAIN}/application/o/apache-guacamole/"
-      OPENID_JWKS_ENDPOINT: "https://auth.${SECRET_NEW_DOMAIN}/application/o/apache-guacamole/jwks/"
-      OPENID_REDIRECT_URI: "https://remote.${SECRET_NEW_DOMAIN}/"
-
-    envFrom:
-      - secretRef:
-          name: guacamole-secret
-
-    service:
-      main:
-        ports:
-          http:
-            port: 8080
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "remote.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/guacamole
-        mountPath: /config
-
-    resources:
-      requests:
-        cpu: 2m
-        memory: 830Mi
-        
-      limits:
-        memory: 1200Mi

cluster/apps/management/guacamole/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./guacamole.sops.yaml
-- ./helm-release.yaml

cluster/apps/media/audiobookshelf/helm-release.yaml

@@ -1,73 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: audiobookshelf
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: ghcr.io/advplyr/audiobookshelf
-      tag: "2.3.3"
-
-    service:
-      main:
-        ports:
-          http:
-            port: 80
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "audiobooks.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/audiobookshelf
-        mountPath: /config
-      
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage
-
-      metadata:
-        enabled: true
-        type: pvc
-        accessMode: ReadWriteOnce
-        size: 8Gi
-        mountPath: /metadata
-
-    resources:
-      requests:
-        cpu: 1m
-        memory: 40Mi
-      limits:
-        memory: 100Mi

cluster/apps/media/jellyfin/helm-release.yaml

@@ -1,84 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: jellyfin
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: jellyfin/jellyfin
-      tag: "10.8.10"
-
-    podLabels:
-      needsAuthentik: "yes"
-
-    service:
-      main:
-        ports:
-          http:
-            port: 8096
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "watch.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/jellyfin
-        mountPath: /config
-
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage/Media
-
-      cache:
-        enabled: true
-        type: pvc
-        accessMode: ReadWriteOnce
-        size: 8Gi
-        mountPath: /cache
-
-      transcodes:
-        enabled: true
-        type: pvc
-        accessMode: ReadWriteOnce
-        size: 24Gi
-        mountPath: /config/transcodes
-
-    resources:
-      requests:
-        cpu: 3m
-        memory: 1500Mi
-        
-      limits:
-        memory: 3000Mi

cluster/apps/media/plex/helm-release.yaml

@@ -1,87 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: plex
-  namespace: media
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-
-    image:
-      repository: lscr.io/linuxserver/plex
-      tag: "1.32.5"
-
-    env:
-      TZ: "America/New_York"
-      PUID: "1000"
-      PGID: "1000"
-      VERSION: "docker"
-
-    service:
-      main:
-        type: LoadBalancer
-
-        annotations:
-          metallb.universe.tf/loadBalancerIPs: "192.168.87.10"
-          metallb.universe.tf/allow-shared-ip: "main-ip-192.168.87.10"
-
-        ports:
-          http:
-            port: 32400
-            targetPort: 32400
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "plex.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    persistence:
-      config:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/plex
-        mountPath: /config
-
-      storage:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Media/Media
-        mountPath: /storage/Media
-
-#      transcodes:
-#        enabled: true
-#        type: pvc
-#        accessMode: ReadWriteOnce
-#        size: 40Gi
-#        mountPath: /transcode
-
-    resources:
-      requests:
-        memory: 720Mi
-        
-      limits:
-        memory: 5000Mi

cluster/apps/monitoring/external-monitors/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./air-quality.yaml
-- ./air-quality-dashboard.yaml

cluster/apps/monitoring/kube-prometheus-stack/helm-release.yaml

@@ -1,145 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: kube-prometheus-stack
-  namespace: monitoring
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: kube-prometheus-stack
-      version: "46.8.0"
-      sourceRef:
-        kind: HelmRepository
-        name: prometheus-community-charts
-        namespace: flux-system
-
-  values:
-    namespaceOverride: "monitoring"
-
-    alertmanager:
-      ingress:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - &alertmanager-host alertmanager.${SECRET_NEW_DOMAIN}
-        paths:
-          - "/"
-        tls:
-          - hosts:
-              - *alertmanager-host
-            secretName: wildcard-main-tls
-
-      alertmanagerSpec:
-        alertmanagerConfiguration:
-          name: alertmanager-config
-                
-    grafana:
-      ingress:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - &grafana-host grafana.${SECRET_NEW_DOMAIN}
-        path: "/"
-        tls:
-          - hosts:
-              - *grafana-host
-            secretName: wildcard-main-tls
-
-      sidecar:
-        datasources:
-          defaultDatasourceEnabled: false
-          isDefaultDatasource: false
-
-      # Add Victoria Metrics as the default datasource
-      additionalDataSources:
-      - name: Victoria
-        uid: victoria-metrics-server
-        type: prometheus
-        jsonData:
-          tlsSkipVerify: true
-        editable: false
-        url: http://victoria-metrics-server.monitoring.svc:8428
-        version: 1
-        isDefault: true
-
-    prometheus:
-      ingress:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
-        hosts:
-          - &prometheus-host metrics.${SECRET_NEW_DOMAIN}
-        paths:
-          - "/"
-        tls:
-          - hosts:
-              - *prometheus-host
-            secretName: wildcard-main-tls
-
-      prometheusSpec:
-        enableAdminAPI: false
-
-        retention: 1d
-
-        remoteWrite:
-        - url: http://victoria-metrics-server.monitoring.svc:8428/api/v1/write
-
-        storageSpec:
-          volumeClaimTemplate:
-            spec:
-              storageClassName: hostpath
-              selector:
-                matchLabels:
-                  app.kubernetes.io/name: kube-prometheus-stack-pv
-              resources:
-                requests:
-                  storage: 30Gi
-
-    kubeControllerManager:
-      enabled: true
-      endpoints:
-      - 192.168.87.250
-      service:
-        enabled: true
-        port: 10257
-        targetPort: 10257
-      serviceMonitor:
-        enabled: true
-        https: true
-        insecureSkipVerify: true
-
-    kubeScheduler:
-      enabled: true
-      endpoints:
-      - 192.168.87.250
-      service:
-        enabled: true
-        port: 10259
-        targetPort: 10259
-      serviceMonitor:
-        enabled: true
-        https: true
-        insecureSkipVerify: true
-
-    kubeProxy:
-      enabled: true
-      endpoints:
-      - 192.168.87.250
-      service:
-        enabled: true
-        port: 10249
-        targetPort: 10249
-      serviceMonitor:
-        enabled: true
-        https: false
-
-    kubeEtcd:
-      enabled: false

cluster/apps/monitoring/kube-prometheus-stack/prom-pv.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: prometheus-pv
-  namespace: monitoring
-  labels:
-    app.kubernetes.io/name: kube-prometheus-stack-pv
-spec:
-  storageClassName: hostpath
-  persistentVolumeReclaimPolicy: Retain
-  capacity:
-    storage: 30Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: "/mnt/MainPool/Kubernetes/prometheus"

cluster/apps/monitoring/victoria-metrics/helm-repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: victoria-metrics-charts
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://victoriametrics.github.io/helm-charts

cluster/apps/tools/vaultwarden/helm-release.yaml

@@ -1,61 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: vaultwarden
-  namespace: tools
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: app-template
-      version: 1.3.x
-      sourceRef:
-        kind: HelmRepository
-        name: bjws-charts
-        namespace: flux-system
-
-  values:
-    image:
-      repository: vaultwarden/server
-      tag: "1.29.1"
-
-    service:
-      main:
-        ports:
-          http:
-            port: 80
-
-    probes:
-      liveness:
-        enabled: false
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-production
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        hosts:
-          - host: &host "bitwarden.${SECRET_NEW_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - *host
-            secretName: wildcard-main-tls
-
-    persistence:
-      data:
-        enabled: true
-        type: hostPath
-        hostPath: /mnt/MainPool/Kubernetes/vaultwarden
-        mountPath: /data
-
-    resources:
-      requests:
-        cpu: 1m
-        memory: 50Mi
-        
-      limits:
-        memory: 200Mi

cluster/base/flux-system/gotk-sync.yaml

@@ -1,32 +0,0 @@
-# This manifest was generated by flux. DO NOT EDIT.
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  ref:
-    branch: main
-  secretRef:
-    name: flux-system
-  url: ssh://git@github.com/SeanOMik/k3s-cluster
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: flux-system
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  path: ./cluster/base
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  # Support decryption
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg

cluster/base/ks.yaml

@@ -1,87 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: cluster-secrets
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  path: ./cluster/secrets
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: crds
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  path: ./cluster/crds
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: core
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  dependsOn:
-    - name: cluster-secrets
-    - name: crds
-  path: ./cluster/core
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substitute: {}
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: apps
-  namespace: flux-system
-spec:
-  timeout: 5m
-  interval: 10m
-  dependsOn:
-    - name: cluster-secrets
-    - name: core
-  path: ./cluster/apps
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  postBuild:
-    substitute: {}
-    substituteFrom:
-      - kind: ConfigMap
-        name: cluster-settings
-      - kind: Secret
-        name: cluster-secrets

cluster/core/cert-manager/helm-release.yaml

@@ -1,28 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: cert-manager
-      version: v1.11.0
-      sourceRef:
-        kind: HelmRepository
-        name: jetstack-charts
-        namespace: flux-system
-  values:
-    installCRDs: false
-#    webhook:
-#      enabled: true
-#    extraArgs:
-#      - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
-#      - --dns01-recursive-nameservers-only
-#    replicaCount: 1
-#    podDnsPolicy: "None"
-#    podDnsConfig:
-#      nameservers:
-#        - "1.1.1.1"
-#        - "9.9.9.9"

cluster/core/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./kube-system
-- ./helm-repositories.yaml
-- ./cert-manager
-- ./networking
-- ./storage
-- ./kube-replicator

cluster/core/networking/calico/calico-helm.yaml

@@ -1,15 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: calico
-  namespace: calico-system
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: calico
-      version: 3.25.x
-      sourceRef:
-        kind: HelmRepository
-        name: calico-charts
-        namespace: flux-system

cluster/core/networking/calico/helm-repo.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: calico-charts
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://docs.tigera.io/calico/charts

cluster/core/networking/calico/namespace.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: calico-system
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tigera-operator

cluster/core/networking/calico/tigera-helm.yaml

@@ -1,15 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: tigera-operator
-  namespace: tigera-operator
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: tigera-operator
-      version: 3.25.x
-      sourceRef:
-        kind: HelmRepository
-        name: calico-charts
-        namespace: flux-system

cluster/core/networking/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- ./traefik
-#- ./calico
-- ./metallb
-#- ./vpn-gateway

cluster/core/storage/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources: []
-#- ./longhorn
-#- ./local-path-provisioner

cluster/core/storage/local-path-provisioner/helm.yaml

@@ -1,82 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: GitRepository
-metadata:
-  name: local-path-provisioner
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://github.com/rancher/local-path-provisioner.git
-  ref:
-    tag: v0.0.24
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: local-path-provisioner
-  namespace: kube-system
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: ./deploy/chart/local-path-provisioner
-      sourceRef:
-        kind: GitRepository
-        name: local-path-provisioner
-        namespace: flux-system
-  maxHistory: 3
-  install:
-    createNamespace: true
-    remediation:
-      retries: 3
-  upgrade:
-    cleanupOnFail: true
-    remediation:
-      retries: 3
-  uninstall:
-    keepHistory: false
-  values:
-    helperImage:
-      repository: public.ecr.aws/docker/library/busybox
-      tag: latest
-    storageClass:
-      defaultClass: false
-    nodePathMap:
-      - node: DEFAULT_PATH_FOR_NON_LISTED_NODES
-        paths: ["/var/lib/rancher/k3s/storage"]
-    # Note: Do not enable Flux variable substitution on this HelmRelease
-    configmap:
-      setup: |-
-        #!/bin/sh
-        while getopts "m:s:p:" opt
-        do
-            case $opt in
-                p)
-                absolutePath=$OPTARG
-                ;;
-                s)
-                sizeInBytes=$OPTARG
-                ;;
-                m)
-                volMode=$OPTARG
-                ;;
-            esac
-        done
-        mkdir -m 0777 -p ${absolutePath}
-        chmod 701 ${absolutePath}/..
-      teardown: |-
-        #!/bin/sh
-        while getopts "m:s:p:" opt
-        do
-            case $opt in
-                p)
-                absolutePath=$OPTARG
-                ;;
-                s)
-                sizeInBytes=$OPTARG
-                ;;
-                m)
-                volMode=$OPTARG
-                ;;
-            esac
-        done
-        rm -rf ${absolutePath}

cluster/core/storage/longhorn/helm.yaml

@@ -1,178 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: longhorn-charts
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://charts.longhorn.io
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: kyverno-charts
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://kyverno.github.io/kyverno
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: raw-charts
-  namespace: flux-system
-spec:
-  interval: 1m
-  url: https://buttahtoast.github.io/helm-charts/
----
-# ================= Release for longhorn =================
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: longhorn
-      version: '1.4.x'
-      sourceRef:
-        kind: HelmRepository
-        name: longhorn-charts
-        namespace: flux-system
-      interval: 1m
----
-# ================= Release for kyverno =================
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: kyverno
-  namespace: longhorn-system
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: kyverno
-      version: '2.6.x'
-      sourceRef:
-        kind: HelmRepository
-        name: kyverno-charts
-        namespace: flux-system
-      interval: 1m
----
-# ================= Release for incubator/raw =================
-#apiVersion: helm.toolkit.fluxcd.io/v2beta1
-#kind: HelmRelease
-#metadata:
-#  name: raw
-#  namespace: longhorn-system
-#spec:
-#  interval: 5m
-#  dependsOn:
-#    - name: kyverno
-#      namespace: longhorn-system
-#  chart:
-#    spec:
-#      chart: raw
-#      version: '2.0.0'
-#      sourceRef:
-#        kind: HelmRepository
-#        name: raw-charts
-#        namespace: flux-system
-#      interval: 1m
-#  values:
-#    resources:
-#      - apiVersion: v1
-#        kind: ConfigMap
-#        metadata:
-#          name: longhorn-custom-path
-#          namespace: longhorn-system
-#        data:
-#          PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin
-#      - apiVersion: kyverno.io/v1
-#        kind: ClusterPolicy
-#        metadata:
-#          name: add-host-path-to-longhorn
-#          annotations:
-#            policies.kyverno.io/title: Add Environment Variables from ConfigMap
-#            policies.kyverno.io/subject: Pod
-#            policies.kyverno.io/category: Other
-#            policies.kyverno.io/description: >-
-#              Longhorn invokes executables on the host system, and needs
-#              to be aware of the host systems PATH. This modifies all
-#              deployments such that the PATH is explicitly set to support
-#              NixOS based systems.
-#        spec:
-#          rules:
-#            - name: add-env-vars
-#              match:
-#                resources:
-#                  kinds:
-#                    - Pod
-#                  namespaces:
-#                    - longhorn-system
-#              mutate:
-#                patchStrategicMerge:
-#                  spec:
-#                    initContainers:
-#                      - (name): "*"
-#                        envFrom:
-#                          - configMapRef:
-#                              name: longhorn-custom-path
-#                    containers:
-#                      - (name): "*"
-#                        envFrom:
-#                          - configMapRef:
-#                              name: longhorn-custom-path
-
-
-
-
-
-
-
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: longhorn-custom-path
-  namespace: longhorn-system
-data:
-  PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin
----
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: add-host-path-to-longhorn
-  annotations:
-    policies.kyverno.io/title: Add Environment Variables from ConfigMap
-    policies.kyverno.io/subject: Pod
-    policies.kyverno.io/category: Other
-    policies.kyverno.io/description: >-
-      Longhorn invokes executables on the host system, and needs
-      to be aware of the host systems PATH. This modifies all
-      deployments such that the PATH is explicitly set to support
-      NixOS based systems.
-spec:
-  rules:
-    - name: add-env-vars
-      match:
-        resources:
-          kinds:
-            - Pod
-          namespaces:
-            - longhorn-system
-      mutate:
-        patchStrategicMerge:
-          spec:
-            initContainers:
-              - (name): "*"
-                envFrom:
-                  - configMapRef:
-                      name: longhorn-custom-path
-            containers:
-              - (name): "*"
-                envFrom:
-                  - configMapRef:
-                      name: longhorn-custom-path

cluster/core/storage/longhorn/ingress.yaml

@@ -1,20 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: longhorn-ingress
-  namespace: longhorn-system
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-spec:
-  rules:
-    - host: "longhorn.${SECRET_DOMAIN}"
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: longhorn
-                port:
-                  number: 80

cluster/crds/cert-manager/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - https://github.com/jetstack/cert-manager/releases/download/v1.11.0/cert-manager.crds.yaml

cluster/secrets/orca-registry-puller.sops.yaml

@@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: orca-puller
-    namespace: default
-    annotations:
-        replicator.v1.mittwald.de/replication-allowed: "true"
-        replicator.v1.mittwald.de/replication-allowed-namespaces: '*'
-data:
-    .dockerconfigjson: ENC[AES256_GCM,data:g58h5rYAEZu2W3CYnYHgajsp7wvnFdhyRCt1qWPHbVDC+nwD1TVqTGDga1b2/RTR5tdobqZ9FdP41/1dzZeNBe2lfXOsWhQYd87EhpchFYRgsb9u7ZL32sxERhAxSg+0/AaoIYSHbuBLgRwxqnHOojS7Hcg956L+6Kgh/uiaOGsUrKRjlMAI0aN4agx+n/nU,iv:ichMs+o/3ld90VVq/UatXpAtpD6qjrEIdt0ZRwyh0Gg=,tag:lxvZy9U6sGsndz3sAy3DTQ==,type:str]
-type: kubernetes.io/dockerconfigjson
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2023-07-22T02:12:00Z"
-    mac: ENC[AES256_GCM,data:yFHVGwFdi2n4Ju6SqqxXDxqxZaHKROIsQZtF+AtJY52f0XJif9jP2fi05dnxULnQ+wWOq4FPwVXc/9GiCiYMItecEApS0+6C7sWxKCWzYYAiFyxSajECzNtr4/XN5yoZBJCgsgFAf42jy9Nr5xLHOAVomnNfmDheS/Pe+Uq9v9E=,iv:oFKca0hHR7ERNgJqDp3pOxzQDBlTCF9Fx1yIl3HCj2o=,tag:107vU6pOFE6Na4BO5C5tiA==,type:str]
-    pgp:
-        - created_at: "2023-07-22T02:12:00Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAzKleRwoSoixAQ//QEVgmHtcIVC1afYtQMgD3Kwb+n0nZid3d/enKN64D+fJ
-            bw0xXX9tjO4sy3To49k0EDETLW5paxcNApFYL+zajxNfa+EAZfdYxQqKWraQcxvL
-            /p8bNDyzYDrecWcIdcq4RqrVEA4Ga0K6MmPM0t5l+J/PgguDJWmAxEzlmTb/CdqI
-            MpUmO0RoLHb6m0vfAkEI0LT5E/37pTdqjAq4eMT9n7zxeHr3NmJBIetahENxTKDk
-            Ymw7DhBCLZBPvHyxw/kU7hS/yhJMxmLw9mjHuzWkYVYmZQDB/TwqWsL4cVLFNAVu
-            LqZBHtl2HmaeGefhDij4SfxCj3qTi1e3z1T5wch97XmFanabNizb2oezHYou4h5k
-            AVqWuxUd13am9YhmRMQ32TPPxyAWpV4W87C/XnIrMrfePH2xy54S2ISyL5lQ1I3K
-            5/a4ZMU8hBdCw7FxX6OSAXUd5cCfelJEaRopvwgXF5ZfQjARjQ7iGCedqBQbOsZM
-            vsf5WQvYxp8uivj7gKxhn+KkqJoM225OQKlSwCQ2bj20WsZ3SrjBuK41iO88urej
-            SJLAqG42e+nUjHXn/ql794kCHHG59uRES1wWLvgQ6Siu8TxJK6B+fjOrHBMOeSiD
-            oMKyqWIvziXN5KczkIpOWFCJzHb+AGTUn/a/jCLAqAxAqkWHwwbLdMiUv1053vHS
-            XgHkdbFnWqSekHCdLXu6q1lJhY+VAyzI55Ex2HvdxzBxWQKZAD4c1fFN/88j/Fb4
-            6/IVZvSU45coCyUR3O+py0s6XvBjrJL6W4haNXMl6nVcTxHgby1JTX5vickv400=
-            =cqEc
-            -----END PGP MESSAGE-----
-          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
-        - created_at: "2023-07-22T02:12:00Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMAy5t8IMoPu4VAQ//RAyoi7oTNza3klhojjvUXum9iH3pOl1eqNu3qdJc9L4A
-            rGeo7Q9NTgywAaHQA4N0WPjJfFNkKSFLBxbtRpzlVCNrfontoGoFr5fGFWDh2Kfe
-            LydY3Zz9yUfcQYuGm8onVM6B6ImYUtM9ZPix808jxfiuz7rvqNmxqTdCa9o5oMHK
-            TqQ5u26MBR9cFf+W7bxKdDsqm4vEhxxWpEf5wgX+iZboA4O/J8LCVwrp6pb2pJ1q
-            nMA5ElKk/WZbsB6C20DYNXJRsdHjC1Huye6NDt1Em2XY9qcfWkQskVtohlYCdDCp
-            TciHgOF32rmN7h1i4j5Ae58AaSQmNRpKZFc192z8+dHdiSlzQEno6XXV11pezz/i
-            0ALvy2Q+r7xFA8xXyrOf7xOU/j9T8XCEAeidtQoZzEcINtg93tKItakzqacxRa2C
-            4Yj3Wic3LGSX13dZ5cpQNT6P3F6UMVAlVEEu1lHdsAjShbmuFWSFNXVo473O3Nwu
-            1imHmfb1xnqbiWS0tKdUX9jMQg+xYPrsAXQESq/9PmPJxl4tsGPzzCu+rMKf9pmF
-            XqGBASdcf9WaB4Hojm6+4UKb7pPDKAC2vLnOV9ilGv/0z+DwxU0x9swPkAYBm9M9
-            KkcaEh8petqyU2J8f91ESU3OafMo2h5OsJvzB2Zte2XIZIZV0h0y8mo6LKOJ1hzS
-            XgFiMVicO02DFcMkSJXA7ZVnV+1qfJl5vPW6Sa0vDikz/k8jYoRSv2skwZcpFIYf
-            Kr6LbZskq2QVBDS50HdpbOfyF+N8/mYuSfjKkuVH8oOq0KrZ38eJROiygPgpUYk=
-            =i9P2
-            -----END PGP MESSAGE-----
-          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

docs/apps/ganymede.md

@@ -0,0 +1,7 @@
+# Ganymede
+
+## Temporal IO
+Temporal IO requires some annoying permissions in the database. It requires permission to create databases.
+```sql
+ALTER USER temporal CREATEDB;
+```

docs/nodeports.md

@@ -0,0 +1,4 @@
+gitea ssh: (ssh) 30022\
+factorio: 30002-30003\
+znc: (irc) 30652\
+traefik: (http) 30080, (https) 30443

docs/setup.md

@@ -1,15 +1,28 @@
 # Cluster Setup
 This document goes over the process of installing the GitOps files into a cluster
 
+1. Install [cilium](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/#install-the-cilium-cli) in the cluster
+2. Install the [Flux CLI](https://fluxcd.io/flux/installation/#install-the-flux-cli)
+3. Install [go-task](https://taskfile.dev/installation/)
+4. Ensure you have a kubeconfig at `$HOME/.kube/config` and that you have the cluster sops GPG key imported.
+5. Bootstrap flux
+    ```sh
+    task flux:bootstrap
+    # namespace/flux-system configured
+    # customresourcedefinition.apiextensions.k8s.io/alerts.notification.toolkit.fluxcd.io created
+    # ...
+    ```
+6. Verify Flux components are running in the cluster
 
-Install [cilium](https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/#install-the-cilium-cli)
-
-Now install the FluxCD stuff:\
-https://github.com/larivierec/home-cluster#installation
-
-1. Bootstrap FluxCD, this will likely fail
-2. After it fails, create the sops secret in the `flux-system` namespace
-3. Now trigger a reconcilation, or resume the fluxcd bootstrap
+    ```sh
+    kubectl -n flux-system get pods -o wide
+    # NAME                                       READY   STATUS    RESTARTS   AGE
+    # helm-controller-5bbd94c75-89sb4            1/1     Running   0          1h
+    # kustomize-controller-7b67b6b77d-nqc67      1/1     Running   0          1h
+    # notification-controller-7c46575844-k4bvr   1/1     Running   0          1h
+    # source-controller-7d6875bcb4-zqw9f         1/1     Running   0          1h
+    ```
+7. After a while all the services should start to come up
 
 # Uninstalling and removing all k3s data in NixOS
 ```shell

kubernetes/common/apps/cert-manager/app/files/helm-release.yaml

@@ -0,0 +1,33 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: cert-manager
+      version: v1.16.1
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack-charts
+        namespace: flux-system
+  values:
+    installCRDs: true
+    webhook:
+      enabled: true
+    extraArgs:
+      - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
+      - --dns01-recursive-nameservers-only
+    replicaCount: 1
+    podDnsPolicy: "None"
+    podDnsConfig:
+      nameservers:
+        - "1.1.1.1"
+        - "9.9.9.9"
+    prometheus:
+      servicemonitor:
+        enabled: false
+        labels:
+          release: kube-prometheus-stack

kubernetes/common/apps/cert-manager/app/files/helm-repository.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
+apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
   name: jetstack-charts

kubernetes/common/apps/cert-manager/app/ks.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/cert-manager/certs/files/ca/ca-cert.yaml

@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: ca-cert
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: cluster-ca
+  secretName: ca-cert-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: self-signed-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

kubernetes/common/apps/cert-manager/certs/files/ca/ca-issuer.yaml

@@ -0,0 +1,7 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ca-issuer
+spec:
+  ca:
+    secretName: ca-cert-secret

kubernetes/common/apps/cert-manager/certs/files/ca/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./mariadb-pv.yaml
-- ./mariadb.sops.yaml
-- ./helm-release.yaml
+- ./self-signed-issuer.yaml
+- ./ca-cert.yaml
+- ./ca-issuer.yaml

kubernetes/common/apps/cert-manager/certs/files/ca/self-signed-issuer.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: self-signed-issuer
+spec:
+  selfSigned: {}

kubernetes/common/apps/cert-manager/certs/files/kustomization.yaml

@@ -1,10 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./namespace.yaml
 - ./cloudflare-cred.sops.yaml
-- ./helm-repository.yaml
-- ./helm-release.yaml
 - ./letsencrypt-prod.yaml
 - ./letsencrypt-stage.yaml
-- ./wildcard-cert.yaml
+- ./ca

kubernetes/common/apps/cert-manager/certs/files/letsencrypt-prod.yaml

@@ -10,9 +10,6 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-production
     solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
       - dns01:
           cloudflare:
             email: "${SECRET_MY_EMAIL}"
@@ -21,4 +18,6 @@ spec:
               key: api-token
         selector:
           dnsZones:
-            - "${SECRET_NEW_DOMAIN}"
+            - "${SECRET_NEW_DOMAIN}"
+            - "internal.${SECRET_NEW_DOMAIN}"
+            - "*.internal.${SECRET_NEW_DOMAIN}"

kubernetes/common/apps/cert-manager/certs/files/letsencrypt-stage.yaml

@@ -10,9 +10,6 @@ spec:
     privateKeySecretRef:
       name: letsencrypt-staging
     solvers:
-#      - http01:
-#          ingress:
-#            class: traefik
       - dns01:
           cloudflare:
             email: "${SECRET_MY_EMAIL}"

kubernetes/common/apps/cert-manager/certs/ks.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-certificates
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/cert-manager/certs/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+    - name: cert-manager
+      namespace: flux-system
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/cert-manager/kustomization.yaml

@@ -2,5 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ./namespace.yaml
-- ./network_policy.yaml
-- ./factorio
+- ./app/ks.yaml
+- ./certs/ks.yaml

kubernetes/common/apps/exim/app/env-secret.sops.yaml

@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: exim-env
+    namespace: default
+stringData:
+    SMARTHOST: ENC[AES256_GCM,data:O29wIilTpKCGVTOv8s/ycWC2rwxhqQ==,iv:8b8xVSkk1N4znFqc8y3entGupQc83bHEFegHFZBcFcA=,tag:7BibE/u7RHWTpP20T58yIw==,type:str]
+    SMTP_USERNAME: ENC[AES256_GCM,data:U6rxuaQ479o5XcTJOpNCG9c=,iv:FPXJngUBcBX6H6DUu7N0q0T5lwNIduDi+8fbT+xAyYc=,tag:QeKXNxMF5fIg1jkyp7lrrQ==,type:str]
+    SMTP_PASSWORD: ENC[AES256_GCM,data:7XXZf3kPAXtyTlX6S7bouA==,iv:xsZxf6QgHLCFpkjJ/ll9kpjs+uhBZ2X3fay8mD1QDZo=,tag:MQPayDpqQT7uZrFLOasmDQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-06-05T21:10:32Z"
+    mac: ENC[AES256_GCM,data:l8ORuc57o2VE6vfAYRd24MzNttT/LWGihcxgbr9N6b0kedH/+OiN+ErnlDdj6tBG7se6vNpobE5bNGDmoyfGVmhqpMiCKyrZi/7B7j8EwFBNn5SxJe4imb5cQ1wKass54CZ31hac54G73yhF3uK9y3EN2jV981UTfxl8dEpouCM=,iv:URDV2brtiM0u/7/UCHFY6/b3QpvIndzbmw65ruSYb48=,tag:ns7SP/wNYXebTl8I2RKrsA==,type:str]
+    pgp:
+        - created_at: "2024-06-05T21:10:32Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAyqlIeyoxYovAQ//V4bJglIyldn9ahkenwBnF8X9wWr7ttTn0MNLeh33iOBK
+            7FbNMUCxpmRh3bfz1mU0s8ojuDskCkpFfyuu5lxWZS8BDnQ/AFqQfu6X0vE+WGmD
+            WSYcaxyPMb9qev+K9rYhJAtOwofnpliD87DUmGwDU9yVHZjf81mRFNYch6jYrNm/
+            7U27jn2t1KUDfksV/dta9pkQSDI6FimYwQpKuAGW3FAS50CvZNCRolluayvlvHEI
+            UpDW+uBBItLmhU7xSoaFGBtMiqwNhy2AItJykpeQM89Z7tdYQiGzdw/e2Qt8cEx8
+            wg65OqhYOaFJqn7oCCTEntnTHBRx7A87ifkzb4S7Wnrlu5+F/z4uq50Sg0NF08qX
+            35YKze5ymLiR6m3bIqzQyeUXBFuYFdwP43BCGEl4ysrh1Hpi2qgP+wd+j7gS4Uw7
+            nIHSZV9OqIO13ZNlPMVQsVVdZhcEZ7ETbeijyZh3lRZXdf4B1p5H9fDkxXNGlPUv
+            44wqLu1cECdb25UtWPLrkAzyQ1eGrDmNZDV2q5uxthRZcokU41VYq7cVzDywsmws
+            HSk7pe/D9zdWGqa8O0U+opyAWWq/No2BBSQ9gYZtCauh18dbpSXyh5zm0W1LNBW8
+            JhskkqEtklE48FiuKMtK037L5seesq0Xl0QK1VLiL/HSaHQXkTwS+It8k4CXMtCF
+            AgwDXjg0p2IN1X8BEADIsu9HnJjfPuMKG7DD+WLzrQPkszawVZefq5d9fu5qIpGX
+            0EjaNUj5P8lmMKIIcnXhOa/A6Owte6KPAEiuOr2vAQw7F6BW9OWovLWHLbhoviwK
+            KmtSCfI4p0/u1rGuu0zI2Q/64ZpqwNLwFAOoR4XdQOOW8zQZDKVaIlH0HMkrdn9q
+            wN4iThjJCYUc/FteFtSTyyrTNn10S4r3bkzkJ0ieyd74+ey7b9R8JkfAwv+Jc0fR
+            f1wJbU3wpeK3rAzMJTtbsjx7O3sPR3rdQ+NXyLhzPxX42rSZokHKb3eetqgXVmmu
+            hfqVx2zCotyLvQFUx+8zlIaCg0C71ex5qwOfFIPUw/RyVruTmSEBAQeYeNZxU5ll
+            quMQmgqlZnsD5Cnei9jeGqZGJf2Fn7ku2A13Z9J7n1NSxAl4kdFXC15e7ItZYK1g
+            7T2ynau63/aMxQF9cbY6VPMyatLqlcG3VKhIbSZakWD22w1DeA1pMDtwppIjlPYm
+            Gb3228P35zNXJMirCEGmLV9MfX9L8qeAxcV2RPNt/RC5EFg4QzPb6S/qT22fO1p5
+            UyZepQj8KYgcqpb2rAV/89voRz6HCg0sd+DYBkgQGs2gKdvNWZGNNedAV/luUTae
+            toVf1+rNPBE73tCjMCzGwemKWcXtvg1P4yntV/r5ydd3v+3816XFrNrhPkZDgdRm
+            AQkCEJ+l1J7vFdsWarvCuZcha00LplVsoHpRIvSkixaBOvzfQr/phy8xXo+c/+Ay
+            F7lEDrd9jHL5UriYN3Jta4/xsOA4/yuq6B1eRxK4Hkt9QhO2FLfHFnL3oUnPg/Vg
+            9LOiF5Qo
+            =xsIt
+            -----END PGP MESSAGE-----
+          fp: BD1AAF9D8170F4BEE437365FF6F0933799CFEBCD
+        - created_at: "2024-06-05T21:10:32Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ/8CidMHABA2L0cuTguu5kCTUvsDbz4xGcpV0zRdiSw4KN9
+            +9OAC2QYYBnCFWsRLIcPaeWnB4GRbZ+EF3UYAmRzFEbqv/Ax1Zn4N1GzH2CowwFh
+            JUSW74e1FCZ+8Lvm/CHmO4VfeHKJTI2c5F0+xGVTdPJHVh30zSJeftrl1ZsOB6/2
+            778fO6WwM83sjSNR3EobrjnyK6bn0XI4xhgWUmmVGUyjZVaSHXnaNZCOs6eMSet/
+            gjsZQGukyLb4IwNdJSXcJ4vGL9UtOas+JBmljBeMHS6+B5rH4qFMw3/YUNGMfxcr
+            HJ9x0TP5HV1JdjQT9QXiTM3D7r7DliCgNN+UXpHSPzzpRTu+ldH7+orIegQQMRcN
+            +RKVmXjy9pCenn/eJGqj0SKWsH+m52fRbcw/CJXUBXOA6epDhL2r5qiFC1nYBnoB
+            UogBSqwDTJY6N85d5Re44d/RqsH9bIOzU8O8QkEIZA9GRDi7tneSDVEySREBnH0u
+            hRtzL1EDwICIRZwhWJ5nxtKoy1OfwKbmAdoo5zGcrv9zRGT/EX/HUNPco8/4w2X0
+            meT0updU846JA9aQRbQPVpy6puqpmvmOS2CZzWPPbivueDY3NDzDeVO79xQu6GRF
+            auhujRjqgQH1hedEIB9Zq0t/SE6aR35Tr/fiGd7V/qPXn3IpvZFtSd+sImeePVrU
+            ZgEJAhAAYm381N+tfGSgNxuEDeU2xCrW1QKgcNb91/Y9nebe2m4gAM4F5HHK2A/a
+            hp9O3VMnuavwEmqZ45tH4Ixhu24PtnhCgUtdZhUFZ21C9YU5/SfqAspiMfAg/bOU
+            W+Tp+QrVbQ==
+            =Nf55
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

kubernetes/common/apps/exim/app/helm-release.yaml

@@ -0,0 +1,41 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: exim
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.1.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    controllers:
+      main:
+
+        containers:
+          main:
+            image:
+              repository: docker.io/devture/exim-relay
+              tag: 4.97.1-r0-0
+
+            env:
+              HOSTNAME: exim.cluster.lab
+
+            envFrom:
+              - secretRef:
+                  name: exim-env
+
+    service:
+      app:
+        controller: main
+
+        ports:
+          smtp:
+            port: 8025

kubernetes/common/apps/exim/ks.yaml

@@ -0,0 +1,26 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: exim
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/exim/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/intel-gpu/files/gpu-plugin.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: intel-gpu-plugin
+  namespace: intel-gpu
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: intel-device-plugins-gpu
+      version: 0.31.1
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+
+  dependsOn:
+  - name: intel-device-operator
+    namespace: intel-gpu
+
+  values:
+    name: intel-gpu-plugin
+    sharedDevNum: 3
+    nodeFeatureRule: true

kubernetes/common/apps/intel-gpu/files/helm-repos.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: intel
+  namespace: flux-system
+spec:
+  interval: 1m
+  url: https://intel.github.io/helm-charts

kubernetes/common/apps/intel-gpu/files/intel-device-plugins-operator.yaml

@@ -0,0 +1,23 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: intel-device-operator
+  namespace: intel-gpu
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: intel-device-plugins-operator
+      version: 0.31.1
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+
+  dependsOn:
+  - name: nfd
+    namespace: kube-system
+
+  values:
+    

kubernetes/common/apps/intel-gpu/files/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- helm-repos.yaml
+- namespace.yaml
+- intel-device-plugins-operator.yaml
+- gpu-plugin.yaml

kubernetes/common/apps/intel-gpu/files/namespace.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: longhorn-system
+  name: intel-gpu

kubernetes/common/apps/intel-gpu/ks.yaml

@@ -0,0 +1,24 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: intel-gpu
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/intel-gpu/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  dependsOn:
+  - name: nfd
+    namespace: flux-system
+  # requires certificates for communications between plugins
+  - name: cert-manager
+    namespace: flux-system

kubernetes/common/apps/metallb/app/files/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
+apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
   name: metallb-charts
@@ -7,7 +7,7 @@ spec:
   interval: 1m
   url: https://metallb.github.io/metallb
 ---
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
+apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: metallb
@@ -17,11 +17,11 @@ spec:
   chart:
     spec:
       chart: metallb
-      version: 0.13.9
+      version: 0.14.8
       sourceRef:
         kind: HelmRepository
         name: metallb-charts
         namespace: flux-system
   values:
     crds:
-      enabled: false
+      enabled: true

kubernetes/common/apps/metallb/app/ks.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb
+  namespace: flux-system
+spec:
+  timeout: 5m
+  interval: 10m
+  path: ./kubernetes/common/apps/metallb/app/files
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  postBuild:
+    substitute: {}
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

kubernetes/common/apps/metallb/kustomization.yaml

@@ -2,5 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ./namespace.yaml
-- ./helm.yaml
-- ./ingress.yaml
+- ./app/ks.yaml
+- ./pool/ks.yaml