.github/renovate.json5

@@ -15,17 +15,17 @@
   //"schedule": ["on saturday"],
   "flux": {
     "fileMatch": [
-      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
     ]
   },
   "helm-values": {
     "fileMatch": [
-      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
     ]
   },
   "kubernetes": {
     "fileMatch": [
-      "(^|/)kubernetes/.+/.+\\.ya?ml(\\.j2)?$"
+      "(^|/)cluster/.+\\.ya?ml(\\.j2)?$"
     ]
   },
   "kustomize": {
@@ -181,11 +181,7 @@
     {
       "matchDatasources": ["helm"],
       "addLabels": ["renovate/helm"]
-    },
+    }
-    {
-      "matchDatasources": ["github-releases", "github-tags"],
-      "addLabels": ["renovate/github-release"]
-    },
   ],
   // custom managers
   "customManagers": [

.taskfiles/Flux/Taskfile.yaml

@@ -1,22 +0,0 @@
----
-# yaml-language-server: $schema=https://taskfile.dev/schema.json
-version: "3"
-
-vars:
-  CLUSTER_SECRET_SOPS_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/sops-key.sops.yaml"
-  GITHUB_DEPLOY_KEY_FILE: "{{.CLUSTERS_DIR}}/common/bootstrap/flux/forgejo-deploy-key.sops.yaml"
-
-tasks:
-  bootstrap:
-    desc: Bootstrap Flux into a Kubernetes cluster
-    cmds:
-      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/common/bootstrap/flux
-      - sops --decrypt {{.CLUSTER_SECRET_SOPS_FILE}} | kubectl apply --server-side --filename -
-      - sops --decrypt {{.GITHUB_DEPLOY_KEY_FILE}} | kubectl apply --server-side --filename -
-      - kubectl apply --server-side --kustomize {{.CLUSTERS_DIR}}/{{.CLUSTER}}/flux/config
-    preconditions:
-      - { msg: "Missing cluster sops key", sh: "gpg -K 687802D4DFD8AA82EA55666CF7DADAC782D7663D" }
-
-  reconcile:
-    desc: Force update Flux to pull in changes from the Git repository
-    cmd: flux reconcile --namespace flux-system kustomization cluster --with-source

Taskfile.yaml

@@ -1,18 +0,0 @@
----
-# yaml-language-server: $schema=https://taskfile.dev/schema.json
-version: "3"
-
-vars:
-  CLUSTERS_DIR: "{{.ROOT_DIR}}/kubernetes"
-
-includes:
-  flux: .taskfiles/Flux/Taskfile.yaml
-
-tasks:
-  execPostgres:
-    desc: Exec into the postgres pod as the postgres user
-    cmd: kubectl -n database exec -it postgresql-0 -- psql -d postgres -U postgres
-
-  execMysql:
-    desc: Exec into the mysql pod as the mysql user
-    cmd: kubectl -n database exec -it mysql-0 -- mysql -u root -p

cluster/apps/authentik/helm-release.yaml

@@ -0,0 +1,93 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: authentik
+  namespace: authentik
+  labels:
+    needsDatabase: "yes"
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: authentik
+      version: 2023.3.1
+      sourceRef:
+        kind: HelmRepository
+        name: authentik-charts
+        namespace: flux-system
+  values:
+    containerSecurityContext: &securityContext
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
+    worker:
+      containerSecurityContext: *securityContext
+
+    geoip:
+      containerSecurityContext: *securityContext
+
+    authentik:
+#      secret_key: "${SECRET_AUTHENTIK_SECRET_KEY}"
+      # This sends anonymous usage-data, stack traces on errors and
+      # performance data to sentry.beryju.org, and is fully opt-in
+      #log_level: debug
+      error_reporting:
+        enabled: true
+        environment: "k3s"
+      postgresql:
+        host: "postgresql.database"
+        name: "authentik" # database name
+        user: "authentik"
+#        password: "${SECRET_DATABASE_PGSQL_ADMIN_PASS}"
+#        port: 5432
+      redis:
+        host: "redis-master.database"
+#        password: "${SECRET_DATABASE_REDIS_PASS}"
+    
+#    prometheus:
+#      serviceMonitor:
+#        create: true
+#        labels: 
+#          release: kube-prometheus-stack
+#      rules:
+#        create: true
+#        labels: 
+#          release: kube-prometheus-stack
+
+    env:
+      AUTHENTIK_HOST: &host "auth.${SECRET_NEW_DOMAIN}"
+      AUTHENTIK_HOST_BROWSER: *host
+    
+    envValueFrom:
+      AUTHENTIK_SECRET_KEY:
+        secretKeyRef:
+          key: authentikSecretKey
+          name: authentik-secrets
+      AUTHENTIK_POSTGRESQL__PASSWORD:
+        secretKeyRef:
+          key: pgsqlUserPassword
+          name: authentik-secrets
+      AUTHENTIK_REDIS__PASSWORD:
+        secretKeyRef:
+          key: redisUserPassword
+          name: authentik-secrets
+
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-production
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+      hosts:
+        - host: *host
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - *host
+          secretName: wildcard-main-tls
+
+    monitoring:
+      enabled: false # temporarily disable monitoring

cluster/apps/authentik/helm-repository.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
   name: authentik-charts

cluster/apps/authentik/kustomization.yaml

@@ -8,3 +8,5 @@ resources:
 #- ./network_policy.yaml
 - ./traefik-middleware.yaml
 - ./dashboard.yaml
+- ./service-monitor.yaml
+#- ./ldap-outpost

cluster/apps/authentik/ldap-outpost/helm-release.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: ghcr.io/goauthentik/ldap
+      tag: "2023.6.1"
+
+    env:
+      AUTHENTIK_HOST: "http://authentik.authentik:80"
+      AUTHENTIK_INSECURE: "true"
+      AUTHENTIK_HOST_BROWSER: "https://auth.${SECRET_DOMAIN}"
+
+    envFrom:
+      # Sets AUTHENTIK_TOKEN
+      - secretRef:
+          name: ldap-authentik-secret
+
+    service:
+      main:
+        enabled: true
+        ports:
+          # Disable http port
+          http:
+            enabled: false
+
+          ldap:
+            enabled: true
+            primary: true
+            port: 3389
+            targetPort: 389
+            protocol: TCP
+
+          ldaps:
+            enabled: true
+            primary: false
+            port: 6636
+            targetPort: 636
+            protocol: TCP
+
+    probes:
+      liveness:
+        enabled: false
+      startup:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: false
+
+    resources:
+      requests:
+        cpu: 2m
+        memory: 80Mi
+
+      limits:
+        memory: 500Mi

cluster/apps/authentik/ldap-outpost/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- helm-repos.yaml
+- ./ldap-secret.sops.yaml
-- nfd.yaml
+- ./helm-release.yaml

cluster/apps/authentik/ldap-outpost/ldap-secret.sops.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ldap-authentik-secret
+    namespace: authentik
+stringData:
+    AUTHENTIK_TOKEN: ENC[AES256_GCM,data:qBh9rgEbGBQj9yO1MVdtZtzdyhYdfTpsHUzeQd6RSDZsOEhRB2AMVXANoVh+EHeKnDdL6G4TQrsmIVZc,iv:0sFEKTyZOoR0IFGdroFCuyDBdPszqnlkYtV1nL+FCPE=,tag:bVc2MvsE0ePnBBfdc88Fqg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-04-09T19:41:26Z"
+    mac: ENC[AES256_GCM,data:SV/xyF9z5exA50GG3WJtaaGLaQ4s4eojEWR/UoDOcx09QcDtuRxtS/O0QPptQh4BoF1STIR+JuG9Yod7buVaVtbH8RQ9KimBWIEKHR8kuRl1AAXJiX4/Sr3xyD3k52oM1BIBpLKu4Osw7uG/+7so2l/vEHPlS1g3188yW6ICqH8=,iv:EPltYcBP+j+9z6JTZgrp26JY+yAkamZwUhn7We+hesk=,tag:0iwERzh8mJtSOm78FSQ9Ag==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:35:37Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixARAAnO7KxtJ9tnguhyxu5oSa9HsLsxsxldLjSfMk4nutZfDo
+            vpreFt/KjSrlyTlCro1zIjhZvJGnWaz52FrwTAO8rk/2imId+2V3xyU5Ng2XnQbS
+            +neRZs/jtfMpUNfux/sGXDtBFp01eAzsu2+PqAVXzlZC8nk+WdBGmwGJSUNxKZ3B
+            e0WSFV54Y9j84Zn/4u8bTk2EVth33fY7jQk9gXUH6bxCgWGQS+kZDoxcxiZRd2lF
+            svDfZbefgvTCDMxOIUweA2s4KHwIzhh3fuRRx4hRcTM5dnu/SKHp3dIBLCO/XpOe
+            Ik5VziwKy4GptbxkNfeBSupIcg+ydzEHB8bffW3hx7ZZi6aXZ0YosrUoEczgo7Sq
+            SdFCX139GCm7sCAHFMNe942smnVs/8+lOoFyR/nJ9FtlIWlTQ/tORHHNDyLz12mI
+            7wyRaFSj0+W6XQBFg/Uc0TzNVsU4L5aTKdWz9Xcto7aE4Kwi93ZVFKGSfKmTCeWR
+            7K8/Ghj6majNUPz2TAB//9Jc30QgN+eRbzcSFA40Kwjs71JzcthiSo8OFPJEQox4
+            I5VIHdaxxLIzvCZDZ89Qe8KYHps9sge2/BMP70wSm6i00zuA3EO1cArJchIBtXLB
+            ZtBrCSKRwkatflNTriPCNUIRkn4YUkcVJtlHbamBAK/G3kzE99i137MFf8A2GhvU
+            aAEJAhCgx8blQrlhpPudkC024dlBhTtHI+xhAu8p/6ONvoCKLxcUlCmGcVOgN0z6
+            vG2CVtzzhNBMqSgzBxNzH5e0KdzZTp7dMxxcMHm1deKrQO+B2bpc6ekzMe2fliK0
+            0wr5Pf79W0JA
+            =CYbO
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:35:37Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VARAAkdm5dbHYnPRwvjz72mxFIKDUtExXofUeOvMLAeiO3AKg
+            aoa0TnA8YeuWNYLTsAyPCHxuAmkdqwIfKaOgukLMWYA2PkkjrCXdDhS+w/eAIARU
+            TGDuZaChXgkGPCcupzbanuerIBoJmeyOIRqBtwYLiuOytgZDpoYargMWERMXDCr9
+            otUk/o6z01yoE+cvZgcGdzg3MbcVURLA7PbG8lAuB5sWMeF8hSaV/aWI4dwPRv6V
+            k2YsOIPhApIEcOEVsIziFFhFMVjeTEYnkyY7gYkRi8Z1+TEgI2LZLf+6EFurG4pW
+            KpjK0/NcsuRI48gHwpGYK4fS3GeblsJ4CzklzphZoZ4NsdqHQ5kLV7p8Jf6b9IBf
+            qVqdfrsys4ghoKXVbHK4l3tF3n9WIdKGW/dvaIYcphbPDlWaFnaeElBECJI81DxK
+            Xglu25fWYB0FdYLAbHJ9b54fXbrabKoBHUg6CFPl20J7eg7gwds49HXZngwqSwV7
+            2Hd4cIV/PcLcwpZN9RWVSUsqQAiutZb5zNV3CWfjNLozOWJ6QhY1YUbMvp/tgkZJ
+            97Rq8fjket/21u/cuABjbVMReO00JvSskvXCjFJhpTFzmQABVKNjvbVESzIiI64w
+            KWGcKrgoj5ZQQsAUfBgd68Xw5kp3NdQOSC5nfFgMcUeq1wNZckbPRTj+LZPLDjzU
+            aAEJAhA9lvevq5PKjNBKraWlxIosWyI+SFlJ6KBHpFZWJBKNcz9v796Hne0VtKyP
+            gY/8pAnBwWZqMxCBvTlIZXMCf0JjqfzCXXmbUttCl0fPUI7AEJPm0o+P7oL3SMlI
+            Sk7B5aX752Xe
+            =vnTM
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/authentik/service-monitor.yaml

@@ -0,0 +1,17 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: authentik
+  namespace: authentik
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: authentik
+      app.kubernetes.io/name: authentik
+  endpoints:
+  - port: http-metrics
+    interval: 30s
+    scrapeTimeout: 3s
+    path: /metrics

cluster/apps/authentik/traefik-middleware.yaml

@@ -1,11 +1,11 @@
-apiVersion: traefik.io/v1alpha1
+apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
   name: authentik
   namespace: traefik
 spec:
   forwardAuth:
-    address: http://authentik-server.authentik/outpost.goauthentik.io/auth/traefik
+    address: http://authentik.authentik/outpost.goauthentik.io/auth/traefik
     trustForwardHeader: true
     authResponseHeaders:
       - X-authentik-username

cluster/apps/database/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 resources:
 - ./namespace.yaml
 #- ./network_policy.yaml
-- ./postgresql/ks.yaml
+- ./postgresql
 - ./redis
 - ./minio
-- ./mysql
+#- ./mariadb

cluster/apps/database/mariadb/helm-release.yaml

@@ -0,0 +1,24 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: mariadb
+  namespace: database
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: mariadb
+      version: 11.5.x
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami-charts
+        namespace: flux-system
+
+  values:
+    auth:
+      username: k3scluster
+      existingSecret: "mariadb-secret"
+
+    primary:
+      persistence:
+        existingClaim: mariadb-pv-claim

cluster/apps/database/mariadb/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./self-signed-issuer.yaml
+- ./mariadb-pv.yaml
-- ./ca-cert.yaml
+- ./mariadb.sops.yaml
-- ./ca-issuer.yaml
+- ./helm-release.yaml

cluster/apps/database/mariadb/mariadb-pv.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mariadb-pv
+  namespace: database
+spec:
+  storageClassName: hostpath
+  persistentVolumeReclaimPolicy: Retain
+  capacity:
+    storage: 12Gi
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: "/mnt/MainPool/Kubernetes/databases/mariadb"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mariadb-pv-claim
+  namespace: database
+spec:
+  storageClassName: hostpath
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 12Gi

cluster/apps/database/mariadb/mariadb.sops.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: mariadb-secret
+    namespace: database
+stringData:
+    mariadb-root-password: ENC[AES256_GCM,data:Fv/IBSYJ59NwAXIm4++j9ouW7QXAWMP8Et6qTtYZGWc=,iv:LpoL3VXqRMPR1jdtAG8hVRpslAZx5C4K1fxHyrjnrE0=,tag:0wi3E4snnKIxtDptgOSr4g==,type:str]
+    mariadb-replication-password: ENC[AES256_GCM,data:glOy5LsxWzngOjtH0cUrtH3KGA+6kOe0WJw5ul5BiQ4=,iv:URpyq5Sf3CCAqDOtPfM/EvgkMcejvM71gA69zgePlFM=,tag:OeZbv4wUBcoSVUMz1pSi5w==,type:str]
+    mariadb-password: ENC[AES256_GCM,data:FqraX9l4nFTWrZ3v9LnJJNFuhwURjBSrmMXLT/C9ej8=,iv:CLGc8XHUeLbixBN9Wdx81SJTe8L3HwPaHQ4Lc2iMFvY=,tag:voDFAnniUVshGRuv4+zYGw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-04-17T00:12:38Z"
+    mac: ENC[AES256_GCM,data:v7rimrwed+ElVHZyO7zdIQLoYR2tJrtZVNUgeBMwZUB6+/v52wa/OIIWoPrsXbGQe0W1w/e1t08ekB8tbanzItD1ftg9mYfAsfBkD2XQyyXornV2uDBbmifUq/yH3a89h97j26Ofzx8PZqFYYnFLSCTXHbdmDNsPHza70fYfk40=,iv:2A0pduramwAP4y3UUU73li9hzC5keGuAzmN2euPFSRI=,tag:tSygQLB9UyzFgR89An/j6w==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:35:30Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ/+PYuDQqORZ7FPzlGb8Wm+DmCCKn4dywZQ/3xqVq1G4wYP
+            W8loUvA9mL8Ja5E6USWb+YdqWa95PAk5N/pDf3MVtnHQnQU9Ko5AjC5kEPFIdWNP
+            ShBE0y1sRCUeNw2T4ARa0C3bagL4EaI7C3ef0PxkCbpw4Yz6O9afOySD3u6Nwaa/
+            04ucDMIoH4VANCDgFo8nFkFV+23bm4cHbHwezaz7r0yL7bOzgt40eSw7tJfEN4nq
+            Yq/ak4iVor2zl5NxHtm08VXtDIyD5LyH5+jIrUKDGPOS6OVIQbyc6pyClCm4JAvq
+            NG0XZCIx+AnyQe7d6OmbrKy+ZarQFQOlJS+H0sWrm7DGWPZpNn8LnRDzlcrTlDv1
+            fP2fGz45gvWRFRaiAeGM2DADwuS4HD4o4nsXa/sWy2Vxstn8Ngjg3/GfMZR4CyDB
+            JzNOl4HjaKYi4kP+MJRSedwp5IGlLeG31MKdn7xU+gsYonsG8u2puTfbHQ8Pk92B
+            HjJ1hLoc65MZofQkeKmYjzQ+9yT2g4YYUyWnPX5agrlMhsVqkZiRirRg+uCT59qD
+            OA8BI9tmjtDjVSs4B5XayL4uppv8pHHk3B6LnKfVX61BAEF4LXV3X7RJMBoLACy4
+            v1UbX6J177xIxHCl/tbzZhwAH+NmceioH2OuPUAtnA3TziCjzr9dH8Fpnrlc26jU
+            aAEJAhCSe5Xs1RDXBUfhlqjwDTZbuyLF889WujKIRwopHqDvCpwA6ZqijElAZWS9
+            F8JAIq1PvyQJBvoGzc52jShobDYugzrFEDiF1Rf8/moXRx4VEa9F0049Zfa1U0bD
+            daX+Wf+7VNFs
+            =qkGs
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:35:30Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ/+L3qBw73EbS1WJ/0qpZ4fiaV40Yd5Y0i9g0CXaNzKNc0n
+            qSr0r3yYsbJWcQwWOhORMwXaDChTf/d02kz+HSdAc+u1IdPAb8mtJ39C0Zlnu78y
+            S5CBF6zUg0BDdnzQKKyuzalmaGirRXUikfyRcIAHb/mmhUwCu/ekFg0QnUx1VvGx
+            Su/sAabRT6D10MF8lunZI63E05yxLSrlb/xGAfGBX/MN6qqdRdYZWzTWgiJAgO07
+            53a2SJE5SfTlEpPdacBV4MVxcHj9xstUDTjQYP69UTTEDKq/kwaZ5FubMWFUono5
+            fxeZr0PeYXwWVzHHbGTTagAzG8M/urPLje6IsWwb5TYyjTn7VSUOfyrdHnS8PZ8u
+            YYyJMftlc4EmTQqYxc9D/j2xk0Hja3cb9L9eLTVkikds07ZRTr+IikYpspYb3vEu
+            dhvMULKhNDoW9K83THQdwyqi8EO7RQoEnGzqRqW84WWN90Bo2YrOL/uZyvgKNEY/
+            lSgsPeWWqc8eHnZnm1zedc/0eiRIbKIwzKYTC2dr3ZbsaAlbt0JXXU8GQnvOWFeh
+            RFOt1WdoFv+Ssm4I+gfSvcMSMeqzUC8AOf0hdIXCwf1lQlVPT8GHq1H11aW9O6Gf
+            jPz5dLwMkGVDJ90i005ZdeUXGntRHOKOwag4MfD6JaDQ4hnj15pfQdbIgOKCRTzU
+            aAEJAhB08M0x5nMkguE9Yow9afmKTpzKoIvRFLw0iLy4T6FYxJ1k9+/UMAQ2Wa69
+            UiL0YCFldFzxcq0GGfrkIX+PUvYaYpsAB6Iid5RwPHtzcSv5pxN91uztaUCfOmPZ
+            fPiA+XqbXVzO
+            =DRJp
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/database/minio/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: minio
@@ -85,6 +85,7 @@ spec:
         tls:
           - hosts:
               - *console-host
+            secretName: wildcard-main-tls
 
       s3:
         enabled: true
@@ -108,6 +109,7 @@ spec:
           - hosts:
               - *api-host
               - *api-host-wildcard
+            secretName: wildcard-main-tls
 
     podSecurityContext:
       runAsUser: 10000

cluster/apps/database/postgresql/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: postgresql
@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: postgresql
-      version: 14.3.x
+      version: 12.2.x
       sourceRef:
         kind: HelmRepository
         name: bitnami-charts
@@ -30,13 +30,33 @@ spec:
 
     primary:
       persistence:
-        existingClaim: "postgresql-pvc"
+        existingClaim: "postgresql-pv-claim"
 
       containerSecurityContext:
         enabled: true
-        runAsUser: 655
+        runAsUser: 10000
+
+      extendedConfiguration: |-
+        huge_pages = off
+      extraVolumeMounts:
+        - name: pg-sample-config
+          mountPath: /opt/bitnami/postgresql/share/postgresql.conf.sample
+          subPath: postgresql.conf.sample
+      extraVolumes:
+        - configMap:
+            name: pg-sample-config
+          name:  pg-sample-config
+
+    extraDeploy:
+      - apiVersion: v1
+        kind: ConfigMap
+        metadata:
+          name: pg-sample-config
+        data:
+          postgresql.conf.sample: |-
+            huge_pages = off
 
     readReplicas:
       containerSecurityContext:
         enabled: true
-        runAsUser: 655
+        runAsUser: 10000

cluster/apps/database/postgresql/pgadmin4/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: pgadmin4
@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: pgadmin4
-      version: "1.33.2"
+      version: "1.18.2"
       sourceRef:
         kind: HelmRepository
         name: runix-charts
@@ -27,6 +27,7 @@ spec:
       tls:
         - hosts:
             - *host
+          secretName: wildcard-main-tls
 
 #    securityContext:
 #      runAsUser: 10000

cluster/apps/database/postgresql/pgadmin4/helm-repository.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
   name: runix-charts

cluster/apps/database/postgresql/pgsql-pv.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: postgresql-pv
+  namespace: database
+spec:
+  storageClassName: hostpath
+  persistentVolumeReclaimPolicy: Retain
+  capacity:
+    storage: 12Gi
+  accessModes:
+    - ReadWriteOnce
+  hostPath:
+    path: "/mnt/MainPool/Kubernetes/databases/postgresql"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgresql-pv-claim
+  namespace: database
+spec:
+  storageClassName: hostpath
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

cluster/apps/database/postgresql/pgsql.sops.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: pgsql-secrets
+    namespace: database
+stringData:
+    adminPassword: ENC[AES256_GCM,data:gJ7rl2V/VlbIIRvRHcwMaZKN87t5n8bVWZCj/tRv8Uw=,iv:b/5eEnOrHzJrtnO+E2IGwJLHy2AdJQwv9WfUR5fUHY4=,tag:nTtaDNHVfYpChQX9UWwdKA==,type:str]
+    userPassword: ENC[AES256_GCM,data:gR7q508lUaRDRJ/z5lH99JLJSS9zWfg0O+TAm2B9uvo=,iv:9DDQxwd/BGtLQDacAH/crfT+qU4Pn5sGkWuEtmMprUI=,tag:tK3WoUd7729LQDVqU7pckQ==,type:str]
+    replicationPassword: ENC[AES256_GCM,data:BSA5IfYhhvN445yp2i3BI5zlIXgdj+LejCPzvlTMnVo=,iv:Qku2NAQPLxt+NUnk2dSx1+WAoyx3aEuA3+piU2mubYk=,tag:MnI+atK6VLZUc3eGS1OE1w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-10-22T16:25:15Z"
+    mac: ENC[AES256_GCM,data:uWVPfKwPpR212js7f2RnCzEsMnxk2JpGPcf2L5i4gJCddJCrRJkdhjWGyVVpp/ociP3JLRTI95+WSEUH0KkPZpY1ptQevCVsUemRytOCtBlR0yR4qsBwEisSu8m4B5dbAYsqlXAndrBNL2WGB7uBv+ILgNxkhlN58unseSWJBDM=,iv:e7QyZSlhpyQ+A8OmV4p1848itIUxyam6CJOI9/N7DDY=,tag:N28mfrAjUTTYkly1hu0OhA==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:35:15Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ//aQdUERyq3G7V29F5rpY6LdDgo8+hqrrZvdI3JnON0VUM
+            Tj3AAYg+xvYh8aPQywF9fJvn6qNw8fqrb2GiuuNTa9ZPCFsD+WXbuYHmQ9z6tAtV
+            opXe3QLNBuo9zEtUfGPbaCp8EH7f1TxQsTJoe9iE/1B2S69cHNUdgXZtfQyhpmlG
+            iyAk/G04kPazweIuFNjOYaN/12J/s2Cf5AZUeROkMxg8/GTPO68LeEBz9v4vl/1z
+            JlxmZyXR/9IeoBlO63asDrR85fcvSDb31K4qE3WVkag20bXClv1lehLVKO4bxA/F
+            lW1tXDR3odC9Ozme884Znd05L0NWkzYKYRta198IV6JuSCeMdjTscGGlMM9wqqKz
+            SZgs81FHXT16YCVupfI22CqMiD0EzQXrGEtJ4NqaBvhZu+MDxszNRzIl73b0HANc
+            8JQqQqOJh7ltrWnf39Xlv73yVC/pYbaV1LWGnMfqWvOcksa9QjOH9Ysfj/RxdaMw
+            VQhydU+21+xeuEQBL7OsiJQUzgJjFREnTRPXcorCtWxocCn5zwdct1SFchFzCOTp
+            H0ubpD+MP4RTWxuYbZRhE5ty6GJU9liRH7dUJtVaQiv8V+G1DungTqq36AbbnHzd
+            9cy+4cM3wZx2VYElL7DBom8nqqm7Xhffr0UaaY8VFuV5bBry3BmM5rOr8vDYqf7U
+            aAEJAhC/4yiBMuhEB+fwXIq/dBjMzW+p8SotK2QK03yaTFQchnBDknwVdqcKQxIZ
+            di3kupnjB+KllWOZhl121tT9L35ymL53BUu1FKCTFdIS2wXxy6UlIS98n0bvWJYN
+            c5WTfk81xmbT
+            =UE14
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:35:15Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ/9G2JDsJw6YJMjstWPrv07tnU0ErWZx5WGcNUGhw6T5tOJ
+            kXCAuaZax8NxoTtZnQ9Cd+WgJr7R0FuVPEPTc4G2RsfntSZq5rBgCpT0fgwyASFX
+            64b6YTbLcCL+G6sg/FwIi9SRqqCsaljATjoU685vrjaxYYfAdhyUoM3qSNjMMaMl
+            zVjn0kbWrQn4GqfuRMqcr+zCIQdHNTTJ12+c6UUo/zJp4zzjA68Yur9aiw1iHtR1
+            rYCPHX2/ZmQjADTHXqwpuMdb5j0VDcd5JcZabdcJkhn/6MRJiN+XryZN/Neq9UbF
+            5WrMaZz5v0iRnMUCr8HMw29P0ttu5Sma+RyCOZuWlpsXj+C84pJ8CjBbFhzSJzGP
+            cKI8Syn0CPLN3X6vKs+LJXEHg1jxJ9kuN+RgW+SQRctUX3A0JtFg2tWplkptNtLl
+            hN5rW+fWxk7BV9dP7wouwVJiKcW3Y/OMCF5H8YHwL/KVHvANBwNM+nmFPrHaqN2s
+            0RghznmZMVG+9IYedSM6d8ZJLnO/QsNTE0QTGM/3dmBAn9jcndCLTgcgThAtvcmw
+            lFJYaMN3W455Cccaif93xnb44yn47actgEuM6GOuP15GGJaHD2iBQ2atHcaQhNQR
+            mxhIIouu+Kaa6g34MA/VGDNoN0eNYI5RZIUSSBl7bgaOXs9/3j1Uvap9yesCaOTU
+            aAEJAhDDqjX7RUazeEByAiKjv5TxpQzsi8gR4zyrhf6tTx34jHzQNoVjYEtLMEVl
+            ZlAJ06RoxOj8O6+8RGYd/ZUE+TQPQ4jx+PgWrZPUQx8TSxevuduw5XZ1lKytUSCZ
+            GFDjOxp0lMGV
+            =LHSB
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.0

cluster/apps/database/redis/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: redis
@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: redis
-      version: 20.3.x
+      version: 17.9.x
       sourceRef:
         kind: HelmRepository
         name: bitnami-charts
@@ -18,6 +18,11 @@ spec:
       existingSecret: "redis-secrets"
       existingSecretPasswordKey: "password"
 
+    serviceMonitor:
+      enabled: true
+      additionalLabels:
+        release: kube-prometheus-stack
+
     master:
       podSecurityContext:
         enabled: true
@@ -27,11 +32,6 @@ spec:
         enabled: true
         runAsUser: 10000
 
-      persistence:
-        enabled: true
-        storageClass: mainpool-hostpath
-        size: 8Gi
-
     replica:
       podSecurityContext:
         enabled: true
@@ -41,7 +41,15 @@ spec:
         enabled: true
         runAsUser: 10000
 
-      persistence:
+    sentinel:
+      containerSecurityContext:
+        enabled: true
+        runAsUser: 10000
+
+    metrics:
+      containerSecurityContext:
+        enabled: true
+        runAsUser: 10000
+
+    volumePermissions:
       enabled: true
-        storageClass: mainpool-hostpath
-        size: 8Gi

cluster/apps/default/cdn/helm-release.yaml

@@ -0,0 +1,66 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: nginx-cdn
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: oci.seedno.de/seednode/nginx
+      tag: latest
+
+    args:
+    - -c
+    - /config/nginx.conf
+
+    service:
+      main:
+        ports:
+          http:
+            port: 6544
+
+    probes:
+      liveness:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        hosts:
+          - host: &host "cdn.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
+            
+    persistence:
+      data:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/cdn/data
+        readOnly: true
+        mountPath: /data
+      config:
+        enabled: true
+        type: configMap
+        name: nginx-cdn-configmap
+
+    resources:
+      requests:
+        cpu: 1m

cluster/apps/default/dendron/dendron-config.yaml

@@ -0,0 +1,10 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: dendron-config
+  namespace: default
+data:
+  config.yaml: |
+    bind-addr: 127.0.0.1:8080
+    auth: none
+    cert: false

cluster/apps/default/dendron/dendron-secret.sops.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: dendron-secret
+    namespace: default
+stringData:
+    config: ENC[AES256_GCM,data:NxmEkvQaTeN535bFrFBs92pe59zmcqmxwH+3vwcgtnD35z0GzFDqUzgsQkY4suwkjekvZPiWxaoWNQ5GnQ==,iv:5kkHxRSSGQS4jDx+xZYTr1Xjn3vqcZIIy4JF4AWjcpg=,tag:1GDd1vtWx2C8J9zCKV+Yrg==,type:str]
+    id_rsa.pub: ENC[AES256_GCM,data:e/+K6q8dZqhydoaUHNfRsVOYBxL9RPWQEy/EaSJag+1GK26yY773MYAo+rbdCZnFMuDjGa2xN+Y5S+Bjcj8YMxZ8CCBFnqshfQa6FmDb1j0s46c4mjbRdxLAOXyl0ehwdq1YI0kslh19SK1/V+t96NDn9PQi1m7jTmw0k2FP74ooFx0d+DinDq4OpsAQ8XKj1twBXLf8YLxs1/qqDzAnB3jCh3ADmpAGGllJFzXPMR+uQjGhN04RnPZY81ofTFn2v4QucIFFf4HQCAvqMicc2haZk1+t6tKOqsSqM5LfBLlmOGZDUygauKZb22iECEUG9UXUUf52gcHINKBGKlN9ba+JEUEZaScod6AKceSOJoi9Dnfhqm6q9zYfjnkqSYKH+mFOS36VqTBbc+Vy7+MRfkDwu7uE3XFrDmar17eTesiWYDi91L/1eQSlGmmOhWcMkqgW4jWvsDCP1hSOOxZ1ke6UyLnzeqTm1a/gT+U6BtF3t7KZgR0gb+ygJ3ieX7PZFxoJf6urc5TDK5X8dT+VZkMMUZATbhlM3m0GdCZuBq+t2yCv9bGOAVvUIa2/rjZ02FtmBIoeuRAeBNdArw027eTYa02pXgmWy1RrDm08Aopzbe+Q3AVDo0MK4QyhFkr0RA61nLCqSh6WSSyFyCxHaeWv7s9EZF3MG2vKteWsz1/xGiFB7KuTSUbE8WArtPNStVLjF4UiRV5+PfJ15gySGNzImsT0MpKVSNxKSWafrPe+SpGQMQOWV4Mhekr29SxgNDziGDhmMAYmbr/Y95mSbIzXGtOmgT8p20fjcqHMAiA/xTcLNLDcB8QPB1EXZ5mZtdmnQsuvPaHQ/HMOmX5zOKbvNwBnOuznH3I3+kDWeEFLPlcYeRXXzFt7iw50yT7AEG9h6wKIHnLQm4HVPVP0z+HcNzJzSFOa4yElnnbcyWH3HiVttOXPAyI5PKIihyLZGB8XR78GULToup+aBW4TqeEXZFnMqyFPagn1y39tuCYgsFA=,iv:V3eSPCb9Mx00SksaoIQv0ACqMI0R06ZTLpJgkhHZxqA=,tag:3Pp0apL1vBdfNz09ctgwHg==,type:str]
+    id_rsa: ENC[AES256_GCM,data:na8KTV3ub1Cj30ss/iRJDFRghq1wGWyiE1GAGV2QPLPkJcGMySWQaU1VLtMW4aUVzLT6oG3Oj2tHrnls26VSlgD5dUgO6bJj38w0NqhFrl+FxBQyyeGhkO4/Rgo3m3IUnE4NhcFyxxP9BPXuMrSr82iWk3qaB/NHPSHyf71NT9C/aE/nJKpycj4RSbT59DYF08jti5rWzPnGDmgBO9K5gEtsZgzvVdthjvGdS2JFaV68hxOYWNxfdbBtxMuZNvXsdFhXHUKs6G0L1vA053kT26B/JLQzKG4pxeHikIneEsM9m9syL1OTHtoCqpg++usxxOKCioVgUsrNI0AyQX1Ywfq1l4AXQfQY3MKG9y+1Evssc0tlG4O5wRTojUkcyalcPZ26epLeFJehk3AeBB+uI0l/cSVrmOch+ax5k2UXLldk6qI3e3AT67tM0lIC92QXj3pUKa7qWog9thp1Nle0Gei/rGVY5Qf9jv8UYB7BzHROAzi3yO5oJPVQKMiAUAIOZhnIAGFFKL//3FSoWI3D9n9DWVrqjOM73M1NgKefVCywDQb8Fkgid6BMTArGqUn/V2fRHUS4rQGbsgc0QEl+cBilAXEQFdHQSkWP25H3ppH5Qxtz1/B3SgeR8Xnm84f4ED+F4xeospaV+DN//FnnPehEpIxtPJpB4PWxCRYzyTzXh+/sQ3YQbfOo4pH4yLgdWoR462E35VVa2GaZKG9ykTeRnALMI5hgf0HNW9CIcCfNVfRxxy/idQ7CoMI7QAwSwL433JPM0Al7tUTtUlk25jBh78IcDtHkK2WQeP4n2qTrBWbA5HqTEvPhPh1ip/z0NNsPUI1PoTdiEC56zpwJIbJ76L5+7A1OcJlCUbZXSMkjKnPGU0FIgRx8+qNJDO+IztYRoM5B/6pINbcWaAIFSSnu+zsNfyoZNxxeJJgs1JqQTvfCMM8jhnEWuTG72YscygDoTNWihsF3+Ie5yIX3L9+Cx9NkATjpUZjJFusKzGaY6PZ/UjYjSKDO9yVq8Qk95+3LJl8SAUgIVBKOuguTNbECu4khBJT+qt7SXnR0HfvcJ4VdN8iHZJBZFVJd/sIo3jSNpkQj046hBmN6XjjfHBdSIoBMcNAZQohYKV0Pw0DAsfn0xS25V2+heyKnxsPWpu4FcwXrsADMIuZUMjyos1F2cpK/b3eJCh4JHGTppwIyFVnLvMo0xYGaqn1CtF5Ju6Cr0bJXaDHqfZBWmFDPopPsOGRsNRXAmcO50zEZ8kYg0yPZHli/X/Q6to65+mQL/sgRiodzvJjecctG2G8558/e8gEWrGNCT5fgpUizzo59j517yQccKRsyftKqpH1ZQXQKyBn42JeqAr49IGqTMB3wt6KW1S+5WPUVsZIy0/C7UnwexmBSQ7MOixYybr1rlQClnIroViog2cdNPfQ05fv9Cry1Npo6z76UJRhWSyrXVaBzhBpTSxl0pix/4ZQouMwujb12spzo4PlXYeh039YKFRruSu5NZx+ELRGpeQvcn/FXJODlh63bI9BKb1jNkz77PcUJudrmQxIAm8dmCsyR6m+GizMm17673i/FWmqILLRE3NOPHepM6iyhEYu/WHb48/N9h4hvP0u7Qt0nS9k1FK3Ywbra1EQ3suj8kbF5cJ/jv0TP+WDaybTkzzb5Peb/OoJI6FIW++uvtqSmQ9fYOmE+cllh5cxkybm3LYfio2TLhUm5qclcEO+C0KmQ0PqUDI0VLPc1PukbYFxE/1o6+zpCDHPABItNjim2tAtm33ABooFcpvIBKmKnho5cT6iO5Rwdx24+YGN8pzb9bAsKbDkL+tpQ2R3xjz/lFptcSj3o5Ewee4EetJO03NpZ36qP50GBKT1CSNH1EfKocHIst1hLBL1E11caVEnoPX0mbBaxuA1hTEpIy0gE6axokn/xxkxbOSVu1zLNS6xtwW++L6td3yLfeDadAi0mOyJAkbpP3cZySJBNGxPJIePhC7/ALjhFMNJijZIgVYbv9YCYpHg3AF1gresocoDrQFHTqAWpPWXh1srBPA2Ke45AwRxE4/MDHu/QI4GH+nSX20VkbM53avuhAQrLXflirlDDMVsI0SPOJzEu90Yl3oZif+wXEL2clLUCq36uQCCRHx+Nvw32Ik5IhSo1ayQO0wCObCRT/HrT2ZAJxsHnS86QU+dgHSQcGCEawzUdta7FpoZcOec9ZH1RDPsmpKhd8Ry3rDrxURWoNwTfEZIrYghfuP4jqos+XJpO67sSzvlVW1PSElMTtcXWWoq0H5lHTYRV/wpothkc1MFWCgVqxJ+ynyhg2PHPOwNBas3rGKW3m2VK2rkHW2nnoavHLNNzLkjhyK3HLSdhCz2hzASdgO1Ae2fxgOOmaI04p6dB8un2ciEaTcMp0Q9Jj7+fxvTCVikLTBMeqmLe4gwRSfQ0N2k20vKoevKEX8CtAOXxLHXmRpIzadEFMVHIaaura76zXKLdSC295eWxXyHKDcnY6LQChrZIIbs3ymw9DSNuW0q4t0IcaN7SCg/weKE6ZVhc6Vm0fO0GmAOyTrky42GW/5L2DBxRonAQwOsCjIeUHhaetVzp+MFeQvAxpUEM6kwo1BDk+v1yS4oNGizNR44bSa7EjzLP3qQXcVfHt0FM/bwD2ajMmU4aYfd4yIFROaY89d1KHhnqwIbdeWKZrtxzyDl/b+i45clE+RG9FTRzKFyNCuB5CPqejKDyMa/q9XoppPABrX1MCi/0Q2jiwiir9EFc9rN6hdouU7N8BBt6lNOXycsgoyDB9v7QF+mTmpggfuB4lWmJSt3/vLqlaBOIlWf2LWaSNgm+O3XPUfkaSfa5IvtN5IusU8lfEabH8QY1DfAIIRL0IZfIezVWrnTvjbH8iJd6ZKDqfIN/GY8eItb3355giO4tNXJH//LnJrXFytXqGfxWT7tHLxij4alP9qSaG1DASXk7GOzrs9+nnLATK1Rfe8Cd2mK1n2AKLJeop5iXrAsiKaiRd6gXBciK7n6DZFDPRLb+TZLHoS/Az3QOvsVuoZASwB3CnJF/2GzrljkBH1DH2wpY0F1lGKk9zkqPs3kURs9Y3A0o7V6uf/JtqUA13sQyoY4SqdUHjxFBvrEn+qUe6ySsIgPTysUc/G+uwOcCRuaKCKPMF/tv/GiqSaUV0Otc3rlJwWiiAKLKpc0VXj0nq9Q1aW++h5OJrO1YIfFi8t21JOyLPs+W3kA0Yd9RY30DqWlFtyKrVDa6Sp+J/OX+NkqzgXARGGlaCZIkpIZ8oc7zUAga0j+2Jz8DNV0OZhWEf6zsTVntO7bCGseLeU95YQiwaRX7fopStoO0NydIxNfjp+LiZnLsockeRBuZTmghv6pch7EHNpr4WVn9/qbIQfZCRXOJChu8VB5i7diZXIW0Apr4DpnALyo1GcjyaOjmdyBOQN/mabE8SFLC1e6jr7+uRzFvxfJqka0RQBTbu/XlWcjFrDYSL8Pyg+LmN8yl7f4afl5YEa8mUvZ33xRgHYQvex4hB9EYwaiOe6HaMeAd+dnZouU1GxLblzTDjH8HQeAm+kMW26n4BM+jatz8PQyodGkFZN8zdyA2WE5dasifCYf21MosjwfJqgLTROXguBGPWBebDNI6NuB0Nwvif4C9Wai1r+CFQ3yz17huSfXTLpNaXiWVXAzRm73RpL2M/upJR6pCZOapHqTtQm1yEEBDn2KZuO5nGUIX6uB3ubIrgRBdHDO1mM0Au/IYeCZZlnIHoPzKPofEiVidVk3aeZqlfJ3TGFbKOG9LanjO702P0nvCHNcoQfHyTXghaiDtoHERrCIrRDoOUDDjt16V3EDSsZlNqYyQEw9jZ1cCm7OY26lFWDh69PU8UgV+DfK1aq1Dc/6S8gi4NnodGMGrw7Glja1XKEAzSG8cR6Jr8QErQY3YmagIQmHsdZ4hJxVRu/etohWVpwfw8R/PdmriOxwx+uZb0YFhAXICxSTKVA3ubWaVZRmrebnuyl1iFA9CE9H+e3MOQtnwosa0S4Tyd47gdASVKsru03nTJw1UmhpauXXjGRGq8aUoDi1GNXel8oLWILWQaVSKhdhIWLhfHsVg/TJwtm023fsBi/RBM7UkonikrFJ1s5KgM88oJaAavTUbwRmMsUjfpKnZw+Bm0Yemwb73IP1KPJrU4orVxDjffyzzMAorg6ifGDWHAiTsoSbHXjbCD4W7FxEjtT42spb2+FqPigLHhAVV3TG56CCCMPLRaw6xIi7lCYNVFt1jRUAWNlegzc1fRvBTf8YsqrOToIXu04Wwu3+nG3fcr5+2mWETShPDAd+NDPkxBc+ux3XfM5yYKiRPh2O5HNSX5LQG3zHY7yEU8ZXEiHdZWZPhc1N3wBVNlXh6srkuC3/BWt6PcAyZsDXIrBEc6zY3zbZ4qdYdXazMbhNunaRi3Mlull2CgJquwGsHQY098fUJVngmbrTXHqGMTBCFtCr9+q7vgA42GFevfNsCPLYg9u2MiaZqcmKPY4SWU4U2Roz8fv2BKBpmaxg1e79/sBzmTnjgsy2313D/T2zyhWzeWn1Oq9OeVuqcaELHkaxpySSCw5TkNYvSTwWJxLHw1ccXOQVNdNn1mgTsIA==,iv:8DWFQG4uoooU0U4yKYYiism0p6kGJVd4pwuhVyA7hIM=,tag:zTBz5yhUaM0h/hlR/Yh2gQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-07-25T05:01:34Z"
+    mac: ENC[AES256_GCM,data:+L/f2vsSjkpEzb8qUXCusMdYPbQO+we+SpE7sbbiiWAPjbkVgOg5ah3BzXvGIIWzZsXt4/Y5BXfB/54am42/WYQhnfzZdTWvFCUSK0bDiBEuybCej/Y0eGes7WchpBBvIRuVU0jly1m25MmCFXRLR15DjXIbIYeTA1WIsgSsBvk=,iv:pOIwEXCYIhZF2AJ5FcdbrtmWkNOSuTkP6dIVyHNdoWo=,tag:UO+ieaZ7Zdv0JJcBHKBpzA==,type:str]
+    pgp:
+        - created_at: "2023-07-25T05:01:33Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ//eAJDYoFRZsEMBwInHBRnW6Bu7yVhqnun2f4EVWA8Ob/a
+            +DO3ojrh0oezmQA6Ttqv00gJLNGfsPPgVlF3f9bfSFulTYS37UggIOLpLmH2z4Vs
+            JElLDPgOAsNQ6+PYb92/ErqFg0vhOkDWSw0ILYL6TazQD3hj7iUathyJIW0CoOgO
+            qedmW1/1L3lV3Mg87cRR1gvBK/V20Dx90Y+MGNg88P3IYMIP0mSslNwvA59k61Ht
+            RXL8w8C+Ax6tigaOFlDeaarzDxdIwCrs4MWQYggXMjQzO/ohEfDospRitoxYnj8/
+            LY3BsRSFkIEeYz/ERW+EY23Skc7UGGfWPrvZbj334iceiZ34X8KMe7aU8oh7gkwu
+            bm4FsIW/HAfgcRbVir/3TffFTinqTBMi4G8GU4Q2M1JorkqrOJXtlvzA68b12b5w
+            0pPGMowWN2Xc3HzY40yVQ/9RPmDNBAFCaP3n1QjXz0jBgNOKVwmJKoNxi8m7hM2V
+            KOUseS80v0sDM+gJAwRGhZTmyphLP1v6116Duh8l4ZAhgz3Zw2gJ9nf9kCItL1if
+            g5u7pvpcVwuaxkm4UloZggHan6weHGutppO+rEUu6hM/JlMrtGz5iAQtOG8OdvWE
+            su0KZFRAHUayAltL1u0eQcQVzXQWVvWAgY0f7YYjjxkCygAAR4O+jS+IlTlIBEDS
+            XgGpYLZja758jdjkJx0Rt98Un4MWoXW/3zE2qKHmfQVu9T3uyPIn/ES2tN2O2WDp
+            kmacHAcz09Hfz55MPU7T63yF3+2xqwlNnnxdebXBI3HO9pIXNoKHNO4c55yh1f0=
+            =1D3U
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-07-25T05:01:33Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ//TilqHh3NXeTVeHfTv+engCARGuSv6aWIDfSl2PM0hdO6
+            kgvxRubWFbTc/EH7JXZmdNmVYM7vnpSKBuGE2xyc1MxIFHmRgotzz6liM0H+Enen
+            BMeNunT5A3hZ3aZ9iaqUzSCjYgMoQy5XRKuS/DVp+o7qhXLcYBBPxsxLuxanEsE7
+            ZAMc2EYEDY+ZP4csY6RvEYBOjn5QWjOjgo7AGpcji3OsnHYc1RCIud8ZXhLKs29a
+            IkcdKYqRuDob82RivhhqcTjf8iL3LGUE9cR912RSmP5908DvVtOZzY8luw9VSlmx
+            fQF0HKrsN/VXTNZGuqIO/GFzL/21nOxNTgxRAwtg19urQ4/lGvobh0r52lJyX0Bj
+            tEggeZbq1Pa1UOEaRvIV70L73TzjzrQurDoqvbv7Brz0hjR/iu/U3Ry2IlPZNBQd
+            IJMNn9uYuIaO+9EnLwS2Jor9K8GrME51gv52B9RCQgAfC7jHlCmW/qCdcXGkW1Lv
+            l9tOsu/KDL6rNvqzAD0GNIj22m3mJjb4kMYeQxyuzjD+GZcYxpNFGOORhFqfPj8P
+            gelzIHxbH5xJitIqmTYAXgzvVtm0TEEKrUf3yBgd3r2zJtfmwd031PZrCM9XZmbE
+            6kIOUYpx1ZboaLzIVRLbb9eyTqyGlYcVL7Cl1aRtdbQKJPgTZCidzIpBwFd+20LS
+            XgG8Ckst3I0ewGTnokVZqP2bNWTA8KHasdvD69k2KjUqsE1j3xmXZJIqiFq2QAXn
+            zVwtM+I+S4yR+xN0xLowmUYVhh748NxCv3MyATu+EDE0v9OSrk3qiAkndFm9Z8Q=
+            =Cds7
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/default/dendron/helm-release.yaml

@@ -0,0 +1,93 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: dendron
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: oci.${SECRET_NEW_DOMAIN}/seanomik/dendron-codeserver
+      tag: v0.0.3
+
+    imagePullSecrets:
+    - name: orca-puller
+
+    service:
+      main:
+        ports:
+          http:
+            port: 8080
+
+    probes:
+      liveness:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "dendron.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
+
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
+    persistence:
+      data:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/dendron/notes
+        mountPath: /notes
+      user-config:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/dendron/code-settings
+        mountPath: /home/coder/.local/share/code-server/User
+      ssh-private:
+        enabled: true
+        type: secret
+        name: dendron-secret
+        readOnly: false
+        mountPath: /home/coder/.ssh/id_rsa
+        subPath: id_rsa
+      ssh-config:
+        enabled: true
+        type: secret
+        name: dendron-secret
+        readOnly: false
+        mountPath: /home/coder/.ssh/config
+        subPath: config
+      codeserver-config:
+        enabled: true
+        type: configMap
+        name: dendron-config
+        readOnly: false
+        mountPath: /home/coder/.config/code-server
+
+    resources:
+      requests:
+        cpu: 1m

cluster/apps/default/dendron/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./dendron-secret.sops.yaml
+- ./dendron-config.yaml
+- ./helm-release.yaml

cluster/apps/default/fireflyiii/daily-cronjob.yaml

@@ -19,7 +19,7 @@ spec:
             command:
             - /bin/bash
             - -c
-            - wget -qO- http://fireflyiii:8080/api/v1/cron/$(cat /etc/crontoken)
+            - wget -qO- http://firefly-iii:8080/api/v1/cron/$(cat /etc/crontoken)
             volumeMounts:
             - name: ff-secret
               mountPath: /etc/crontoken

cluster/apps/default/fireflyiii/env-secret.sops.yaml

@@ -0,0 +1,123 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: firefly-env-secret
+    namespace: default
+stringData:
+    ALLOW_WEBHOOKS: ENC[AES256_GCM,data:qdisaso=,iv:rT7WID3kRMPEGmWJepNmrj1tutxsT5Arw5AN9oVFoXE=,tag:jkYkRaGLEB3iBEjEVIAVCg==,type:str]
+    APP_DEBUG: ENC[AES256_GCM,data:Jyo8QmI=,iv:Gq2Ldh+H+oturcglphQb7ERHX8jD/5j01qtEJDRPAn4=,tag:m96oouPtT9J5zQHPs2QaVw==,type:str]
+    APP_ENV: ENC[AES256_GCM,data:19kiyms=,iv:KLwsQOsDvg/7f18FEsg+e2rgnXSbsxwSNbItmgLGy8M=,tag:mUX/UeXFi0eeZ68bsJpq8Q==,type:str]
+    APP_KEY: ENC[AES256_GCM,data:PI70apm/K8/1el4lW3KR6wLgBDgj0YAQ6KwngqxSv2Y=,iv:S7xrpAeY3wM3moCL/i5R045yst7Zz8ahXbLyNfvacZ0=,tag:hOXR1kKdxVoQxZyjZu+ajg==,type:str]
+    APP_LOG_LEVEL: ENC[AES256_GCM,data:ZwJTcn8y,iv:wk+jX9Zp1TTn1EHv0OLgt+0alm5JBHdWcEtIn1dTI6o=,tag:gR1Ls7dFGyt4hKGiwLU5wQ==,type:str]
+    APP_NAME: ENC[AES256_GCM,data:yfd2OQk6NvjKcA==,iv:jLL2Dt0YlWODwCKSnqR1yuSWJsKySQNZY/pEfxi5jJM=,tag:XoHlMsMuRG6S4Wm0PVjtBA==,type:str]
+    APP_URL: ENC[AES256_GCM,data:+bveNLjanPPMkoMrDO4KsA==,iv:xQWHzRKBMBumi2bFCUKoWLRiuNNV3HQLv1WGEiZ6RRg=,tag:h9IF4XwIK2P8sB4V1Su5Ug==,type:str]
+    AUDIT_LOG_LEVEL: ENC[AES256_GCM,data:OA7nqw==,iv:9BcE5Bf9QDf3kzA4Xbf0XkbkFjGAv6id7vdSI12wRm8=,tag:QN7o1eEbGSTvrGGBzzouSg==,type:str]
+    AUTHENTICATION_GUARD: ENC[AES256_GCM,data:wsQZSzAP0hE4o9DAwNtwSEM=,iv:U6513HaOzDDlCehFuSs8ey0KFWup9S8tAYiSX89EyNg=,tag:i5q9W6uglFZ9bKc2f4QPvQ==,type:str]
+    AUTHENTICATION_GUARD_HEADER: ENC[AES256_GCM,data:0GfWuR+1RhLsED/T5iEDYV3tkmx2wA==,iv:x/6xxFAv5+J8e55a9JnIZ49v/FJRL066rSf2bBxhHHU=,tag:hAhhsDDMeM29b8iMx3xwqA==,type:str]
+    BROADCAST_DRIVER: ENC[AES256_GCM,data:2iYs,iv:5oeuA+08uDRSJyLwwkdFC2q4LZKNs2OSoQjsnIX0aYY=,tag:m2ybfxtY98j39sBnax7IVA==,type:str]
+    CACHE_DRIVER: ENC[AES256_GCM,data:2lv9YGE=,iv:xuk6ih2wApMuWJIlm9clwYCnMR973lG7EOHDUZtlDvc=,tag:cdEh6/zAZ+7IcQMvHojgXQ==,type:str]
+    CACHE_PREFIX: ENC[AES256_GCM,data:OS/jr/Qo5A==,iv:wLeRO4uAo+HHB/1tK3m4MEeefmMRTc0+aTYuUGGrYyg=,tag:8cv8oxfwMkTeZ8+JsCoWVA==,type:str]
+    COOKIE_PATH: ENC[AES256_GCM,data:pQ==,iv:5QR02hlvi9n/gl6LLdSR2HSybzohlCisq51+QzUJv1k=,tag:hpwUD0ctU0pX7S+V6UNz/w==,type:str]
+    COOKIE_SAMESITE: ENC[AES256_GCM,data:HNlS,iv:f/kbAOVyWFEH6yKr+N3zM+9tNQQCpQA7/iKAg8ejFdk=,tag:g1rmzfnWSYIzxFJA0l/uUA==,type:str]
+    COOKIE_SECURE: ENC[AES256_GCM,data:fxJkE2M=,iv:0JXgzyybtMtIgxh6VSwAS5oehpVMFkLKvJFOBDcwhVM=,tag:RAhNUuJKOho6bvXJyNT6cg==,type:str]
+    DB_CONNECTION: ENC[AES256_GCM,data:Y7b+kts=,iv:1vZBNoO4O0Z8LPH3ZPSDpx49jtbQOEl6+BitbKyat4A=,tag:eOUpSlZGZKM0LPHdZMjb+Q==,type:str]
+    DB_DATABASE: ENC[AES256_GCM,data:1rRtAXfMaA==,iv:vErtoqpi1KsHVL0nQ6x2MVNe6JCKxjCxivXXjtUT6Uw=,tag:AYxHWADlGq4NHbcVx8QcHg==,type:str]
+    DB_HOST: ENC[AES256_GCM,data:sjYDEi8q4bAgpdnxin6yDBtNJw==,iv:6rxqBNvXSsE+2oxWbwiztmlxtKP8C0aeYMdmuGTyF/g=,tag:lRB3EwV4vwa64CI3xqi2lQ==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:PeysFTbHeZHTnkn0XlJ58AMZbS3EzANUQ8UnhQXRIoU=,iv:NM8c3dx8TlQkPVJGECnyg2L6JM7CQwlx/LQ59x15dY0=,tag:xuLow/AXp+yOUm4hO2527g==,type:str]
+    DB_PORT: ENC[AES256_GCM,data:yXp98w==,iv:a/jbQI7/3QMKaSJRiZGhdYBzdIzyNA0M3sL83bD/1is=,tag:PxauXvxyQlNo8EaFMzdjKg==,type:str]
+    DB_USERNAME: ENC[AES256_GCM,data:UOz2K8KusA==,iv:75KRLL7F0mtzESvfvVaIJiBqAz1i8JIcS2VwAMm3KVE=,tag:HmjzrLg4hLuAjQ88U3CDbw==,type:str]
+    DEFAULT_LANGUAGE: ENC[AES256_GCM,data:U2qo/Z0=,iv:duSb5g58hXy+BjmU51cWVc2APmz/THtQrmfKyWJL8Xs=,tag:3578FhaZxtyLXjFOJA7sVQ==,type:str]
+    DEFAULT_LOCALE: ENC[AES256_GCM,data:DX3VePo=,iv:d3P66DEPoI3yiZj00YaYVEsu9zCSQ+Nz0vCOxJjfkNk=,tag:JNeGcODHleBBOJrewOWq2w==,type:str]
+    DISABLE_CSP_HEADER: ENC[AES256_GCM,data:mS45ZNE=,iv:7twp7yAggJfGDKnoqoi4OY97uMQuOq1Y3y6LFst9qFY=,tag:mselnIDI/OzNplWsdq2YlA==,type:str]
+    DISABLE_FRAME_HEADER: ENC[AES256_GCM,data:lIO+3IU=,iv:/jCBrh9pxsNouU+glpvXqEXI3veHsqaHWkSDEJcJzHI=,tag:JHWUyPl6Ir+XczlkEm/xsw==,type:str]
+    DKR_BUILD_LOCALE: ENC[AES256_GCM,data:43nBSlc=,iv:pylnsBF4HORItmtHxLxaXjojdyazm1rseMtqgTwwX8k=,tag:mi7eWamr3l/H+foZUJYsJg==,type:str]
+    DKR_CHECK_SQLITE: ENC[AES256_GCM,data:TssvPA==,iv:N6kVxo9w7pjUy5PSt0nF3yPS7imaKaWbizPZdMv7rKQ=,tag:DpWzkfkFbFaQpuLTirsP1g==,type:str]
+    DKR_RUN_MIGRATION: ENC[AES256_GCM,data:6+nNEA==,iv:TxFrPKxoaN/neoRK09F5SJswfh+ULHw/tFQz+ouOOsU=,tag:UsMPAYDhgccBtBUAXxTNaQ==,type:str]
+    DKR_RUN_PASSPORT_INSTALL: ENC[AES256_GCM,data:rA1uHQ==,iv:TKV5pRA65C8FNHOrpzx90qA7maX5ld3aLCv/PrQamII=,tag:bqtT9pqHILiV1AEzkkYk5Q==,type:str]
+    DKR_RUN_REPORT: ENC[AES256_GCM,data:bqE/+A==,iv:PWlGji8/zVoosDeoWaTG4f9rDJwKOilwENI1JtzatPA=,tag:cHCeTgnB7c0TZ+9bSxFW4A==,type:str]
+    DKR_RUN_UPGRADE: ENC[AES256_GCM,data:76w+1w==,iv:XZwFW5WoWRBhfgM8Jf71IAEsWJxaWj6nmzh4arjV9IY=,tag:wm49cS3mMPPj0l7rNRm7nA==,type:str]
+    DKR_RUN_VERIFY: ENC[AES256_GCM,data:GE3u0A==,iv:hZc9+yCN781Hm/M6UrzAnFELJopG/m0PTaHCwJuK4Ic=,tag:SwJ/ujTY9VsrS8payg5FbA==,type:str]
+    ENABLE_EXTERNAL_MAP: ENC[AES256_GCM,data:jwbL3WE=,iv:EmuPlxlldYIK57w44oeiOUx4dNUx88avn/MXGw0khqk=,tag:6UqgxY3eTE/DQ4znx5NNzw==,type:str]
+    ENABLE_EXTERNAL_RATES: ENC[AES256_GCM,data://NWaSg=,iv:l1k7TLg2d4impHiGyHtVmXFBpHSK1X+MIIMEvqHmFCc=,tag:7FX96H6R+ez0corFjpzoWA==,type:str]
+    FIREFLY_III_LAYOUT: ENC[AES256_GCM,data:KGo=,iv:xvBorcd8fPvlGYeomuexZBtORPc7LJRII9pYP1ZNBsg=,tag:ibFX6k0a12rXElxRODc1YA==,type:str]
+    IS_HEROKU: ENC[AES256_GCM,data:Ffu4Sro=,iv:Q5txv1a/DcH+Utlr12zQJUBy4vlcdxcHFsNDWuWVOeU=,tag:NTay0IKz6s7a9dFpx1BZ+w==,type:str]
+    LOG_CHANNEL: ENC[AES256_GCM,data:Njfav/E=,iv:xwccazZYrtARU7xKooAnBKJcCDJH5xUSN0C+nIs8Pos=,tag:jI3pelMMZQQ37uuUmUmENQ==,type:str]
+    MAIL_FROM: ENC[AES256_GCM,data:ILVOrph55Ku8pIfsHtU8DjMuUjo=,iv:c4wzRvDugyRUbKZKq/fgQ2eP3CJ1wJzkQo89tBCZ0WU=,tag:tx2lUsnCBbYIk0h4gL/CBA==,type:str]
+    MAIL_MAILER: ENC[AES256_GCM,data:rdoZ,iv:NBi4YtbtTkDJHQmXBu9lGUfCWhfRgtYLI3UCayMpq2k=,tag:o+cXYLXlJ0bWVQAPr85CJA==,type:str]
+    MAIL_PORT: ENC[AES256_GCM,data:lffjiQ==,iv:GsZWiMZGuhpPJfX6vPcr3PKuq2YXS3oQ8v8NojufyKk=,tag:rHcfDoLZdU5wCQR4g/qV6A==,type:str]
+    MAILGUN_ENDPOINT: ENC[AES256_GCM,data:rrw7Rwjo//tdEyxN98pE,iv:3aeAQM4RV5hDFfZ08voXgk7IrejoM8YACluo75AmRrE=,tag:cAmTiI0vPAnY7NX+YlM6Og==,type:str]
+    MAP_DEFAULT_LAT: ENC[AES256_GCM,data:i8I6LaPPLFoi,iv:sG6dP5GS2G6kGXEsn8P3KJmyEThJ73WIN2gkMJwNDBA=,tag:uefjbg5pZdIIONBklcsSyw==,type:str]
+    MAP_DEFAULT_LONG: ENC[AES256_GCM,data:+ESO4h6cGSE=,iv:hAFNmDfc6XWnQbpLQXjUsdZSOwPu964MlFBXYsNr9O0=,tag:iXfs5Z+Ojojzp2H2u1kHxA==,type:str]
+    MAP_DEFAULT_ZOOM: ENC[AES256_GCM,data:zw==,iv:soYKokimSKxSS0x9nM7GcZfpXtwxjuXVls+KFh61w30=,tag:ryX2Rj1TakKRfynh7bFEtw==,type:str]
+    MYSQL_SSL_CAPATH: ENC[AES256_GCM,data:Mo68CXbhV7kK5ZGi5MS8,iv:pVKSl5Tu8xzZVk4FX0DIA3vpVYZ9V0RXtfkoUTYeAAU=,tag:bez1DYHFlOn5TZ/oz7F6fQ==,type:str]
+    MYSQL_SSL_VERIFY_SERVER_CERT: ENC[AES256_GCM,data:DT7Jow==,iv:ZEOzfc0IepdvDNo2vWanOsYAT4EGLvFnSpL8qiiOwes=,tag:eEilJ8cwgCer7H/8qpDPgg==,type:str]
+    MYSQL_USE_SSL: ENC[AES256_GCM,data:rsKgGpE=,iv:nEJbHiaqOvVauAtCyL6uvfmkAmgvjjSFb28L3/j1PmU=,tag:6d5whsZ30buXkc0W4+5JIg==,type:str]
+    PGSQL_SCHEMA: ENC[AES256_GCM,data:pmFdRyiy,iv:mYXXlj7R7T3RTuK7QNRKiY6HwCezQYaMpn6de0st+FA=,tag:xFs7kAnFuRjDVRjKyyrJOw==,type:str]
+    PGSQL_SSL_MODE: ENC[AES256_GCM,data:/spE//X3,iv:qCBP7fJVFixBrB1ApGti1Nq0S87RcVxpHqmPBW9GuWU=,tag:MyCEseplfPX9PNdoqGLvmw==,type:str]
+    QUEUE_DRIVER: ENC[AES256_GCM,data:tTmRSg==,iv:2KdDPsJ9PlyHsVsFdknC7A4cShE5bBBpRxWslF/0wgY=,tag:7QN0MlfyoDyukmAgmgQvxg==,type:str]
+    REDIS_CACHE_DB: ENC[AES256_GCM,data:9w==,iv:MKfWJO941vxlJ0VP/0ob9JeFnHkI+okOkd/ifxkbKTA=,tag:PyyjVTRCUSvZxpHekP9ENQ==,type:str]
+    REDIS_DB: ENC[AES256_GCM,data:Bw==,iv:h3v/+cO1W7eGDAGjVtgeDh8UekMg+ZvIRkNZx+iE/Es=,tag:nF143FAtE181ZJfAjtau7A==,type:str]
+    REDIS_HOST: ENC[AES256_GCM,data:7hVDI2P+443UGlw/jyBFmNTDBM2p,iv:sbLD+/wdDEiKYpR3ttrey6HTlI5n76trH3wZjU7s3uQ=,tag:qZP1nb9+tOr7Lm4i9HR4wg==,type:str]
+    REDIS_PASSWORD: ENC[AES256_GCM,data:/i9UM5Cx6h61xbDQ//ocmW1BtmT0LILnwwemOwaTTkw=,iv:FINFRW1006Ljnb1JSi+Ctae3Jw9xR5EW73Ut8FCNfHI=,tag:+6raDqY1TgQQgbkcCcbCLg==,type:str]
+    REDIS_PORT: ENC[AES256_GCM,data:ME1O4Q==,iv:FhqTqv645wnhhQdGW0IsemeXOlJuCKjbMa3tBw0kueI=,tag:b7TdkDklkFwE/X3lE6XZGA==,type:str]
+    REDIS_SCHEME: ENC[AES256_GCM,data:puE6,iv:XvOpz9QO7Fn14bbHT8L2p0HquNxIzxomN3Bg3K2NOQY=,tag:qerZcGVGKXW+YAyj6RK9Tg==,type:str]
+    SEND_ERROR_MESSAGE: ENC[AES256_GCM,data:9xoXVw==,iv:m20IvyDsNzw7v3U8Ai34MhhxrIUGnU3OK9LHwZAdlJo=,tag:BgrhqBiqc9RYo9EzOCvSsw==,type:str]
+    SEND_REPORT_JOURNALS: ENC[AES256_GCM,data:+ErZjA==,iv:dcrc2+U7MoSBQ3b7w2qe0wIb50AbLDQ8/N9TK03ub5o=,tag:ub6+5g77qZxq8IjxDmk7og==,type:str]
+    SESSION_DRIVER: ENC[AES256_GCM,data:QlF9bSQ=,iv:I1cjDE4EFVG166ISZaNuM0eFMs6U55y7LUl2cVIONrI=,tag:VxKEC67A3Y0IRNKJ/nZV0g==,type:str]
+    SITE_OWNER: ENC[AES256_GCM,data:KbzTQ/QdlMmxnSDr1mCo4EG9,iv:287MEAzZFE3+zp3bWWA5Y2u3w7iQH+7AAZ812I4Elx0=,tag:TlljmsgLww7EJIBMdDrKvA==,type:str]
+    TRUSTED_PROXIES: ENC[AES256_GCM,data:cAU=,iv:MBL/z8pmM2CxlDT1sY4my2gC3jsDo6O1NSa11w3en5U=,tag:zqzHOR69HT3+U7tQOFQQSw==,type:str]
+    TZ: ENC[AES256_GCM,data:45gLKxH0OsAfMPkgnjKgWQ==,iv:P9CUovVI4WSfZi1nyFHVzHJ7Oioai1FUZRcgBNhQb64=,tag:S7IF8Oxg7hYNcT0mcgkg7Q==,type:str]
+    STATIC_CRON_TOKEN: ENC[AES256_GCM,data:1xck+8s3ifQmregeKU6891pErxZy86fO0I6XPE83l3o=,iv:XSsCSJkkGwG12f2lhd6IDl07OLVCW8J/945acFP99lA=,tag:XNxSQGyHvR/6/A3EVT69gg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-06-17T19:05:29Z"
+    mac: ENC[AES256_GCM,data:GWtQz5/wKpk38ZYLwn+kGyCT8hFo2SmoaI9vuEFju6N9ipJW1MNQONqTx/Qa8Cje8pT7xIxdoTf+23PaFG91v/gcilMCYjE+OFnVBk80d6ZBTXiSmoQ0DYO3hWiXyMfXTJ1OPqExOkY09QSAfXOrN0JphnWpPNZnaVuxMJZS/Og=,iv:/QbEi6hhsPpeSa5bOxPObP8UUpAwA/I6wU8VXQ6NcOc=,tag:FYYj1y/zTl82SVva0oauuA==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:36:01Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ//So248m5bmfJG0gp5ZIAK2dVhH44xEg/6yzZ6TC9W4px2
+            SPqB+gmwswX64NGcGZQ8LQZExyy2poxh7lfQHIdsv2QSTbf0vmOZqG9L7Fv/DSU0
+            EnUpt04K1yyVyW09tlcE/SIyMy9HhWyH0vZfwqHc/pHnaAhZKEuBH+kFiNPz4Bfd
+            xtXeieOGYV9ois2vM2NFNohEagrkbpMb8ZEOrWlB8+ZJZhkIeNc2kA+w0n0TEEtR
+            WefrBwear6YloK89hEfWRdJYksfKvOsU7U+L6MKpMxqGBIpLIV5kTifRAt8pdrNX
+            m7MY/laTWcqTp1VXUMZQUq+tCa/jjIh4MDvmzGcrRfhSLDvkFz8W43yHvy/hTKgc
+            nes55vhrWK9ABcZ5sZ3xdfH3ys3tODUsUkaLALaCbXUdg15cQRwvdNkgHou/oY26
+            jAc38EpeBEtIpkH+nBHLgbflFkElqOcpcS/5OR4mL0dGQ0EhhYTzxES+jcVYg9ka
+            Na163uPvhNnFNMUACKsDU/u2WngU8B5ISjlsiX9EkbKqDgHrLSJywKcoYESgnU/K
+            q+24HIFH8cmghRYJZ7SXDahsEw8VrcqQEWTSMM4YnwJeBZH9pjeUK6RySLHxK9F7
+            rK2djzc6so2Lk/AhYot9FNNwXWqrBKQq7kjFF8Mr6ALydZgst/tSBPtpTxpADZDU
+            aAEJAhDuDefWmaUMfyK+B21JoUTJtAp1icQZrIFg+mTH+qDWPXdpM1qsaci59aq/
+            vkML3TwjiytUNRMVORlLPv2z8adUuXIgPx8yEclTxCDKM3bqIfVs1xj2GAItyO4K
+            XYBV8oIdHegO
+            =GI4b
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:36:01Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VARAApwoZ01GS0soprXAf20Ye1XQVLIFvIuYjub01ibNZmb3m
+            uJiPyClzMqcjy6TKWvCc6sT1W5DQ3aY9E1ARhgwR/yaIZ31WvNcnLczaOACHPlaW
+            7e4o9tauN8CYpQqPmTxDyQehKe1EbWqq+63FRAUV0+9qEY/ACCwNtv1HCa2dgyto
+            0I6v/BmW+KJ10iGCsRv8g5IgPSjYT66a2fsDg24kjtqygHwZ5BPe6xUBJ7zxCmVT
+            z/3WKaNx5Rdv8l45QQcl2fe1qNNdljJNgowCq23uODcQPJPGEY4wOeYHOlGTKE+E
+            JojnysVUhILhZtTZ5/AcP36RCzMDGQX7wYtvwh6bgf4qf4InX8+O/WK3u+jOreUl
+            zbcy/lB7bsQ0usZNPsfy2Qh2LPlziBce9JtkPnWXBwS+lZUCXKDS8pizmj7DZnlo
+            +3L1f26rn21ye/iOyBArzVmqI4QLJzHJI7l6TZgvvv1dZKHyLW5jCHSq4f098roO
+            kIKxRThFvTZ9jqM7uDYGiAsGt1L7p+HJRY5WdAVGEaL8jWADW7jjF8qTF3BJ05A9
+            OgnRxIew6ofB5WeYSrU5dn5di6pTNI6bqHVHbZf3BTrGwdpqsAcniUtDM1FAdU/4
+            QtB7tXNAYV+ZTDez/MMm7l1xKS6FpPbM5ZUtrcv27I51e2HAyYSsj6FNWWyvXEbU
+            aAEJAhCfDkAnvink2rBria46BR0IPWSLaVEpnusa/OED/Xw4EEgiFq3XonPTHaqG
+            iXSfeD0XauMxpLan+YesEv9SRP3ef9iX5OGNwVPpIDlkOyUztBWtf3I7tP2LCf2p
+            /GKlxeQfAlpx
+            =zWYo
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/default/fireflyiii/helm-release.yaml

@@ -0,0 +1,55 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: firefly-iii
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: fireflyiii/core
+      tag: version-6.0.30
+    
+    envFrom:
+      - secretRef:
+          name: "firefly-env-secret"
+
+    service:
+      main:
+        ports:
+          http:
+            port: 8080
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "budget.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
+            
+    persistence:
+      firefly-uploads:
+        enabled: true
+        type: pvc
+        accessMode: ReadWriteOnce
+        size: 8Gi
+        mountPath: /var/www/html/storage/upload

cluster/apps/default/fireflyiii/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
 - ./env-secret.sops.yaml
 - ./helm-release.yaml
+- ./daily-cronjob.yaml

cluster/apps/default/gitea/gitea-secret.sops.yaml

@@ -0,0 +1,64 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-secret
+    namespace: default
+stringData:
+    GITEA__database__DB_TYPE: ENC[AES256_GCM,data:CxKLDkwWDro=,iv:vMzk5XUyeiUog3uaNWQi3YKOpnhUTUbZLWi8aQe1GOI=,tag:cIa3sjnmZZeqf8RkHaHyCA==,type:str]
+    GITEA__database__HOST: ENC[AES256_GCM,data:SPy0h0kvhTMzbx7IhmOrOZ2RfVF0h2E4,iv:YvrmhhZfPGzjuuppfBumrKjQzGAwmScZ4Kv88bTRTa4=,tag:xnrGbDv0XwhYrCeJ3l+Cvg==,type:str]
+    GITEA__database__NAME: ENC[AES256_GCM,data:K1lM4P8=,iv:5sN41GkSZ4sPLwIyVjiy6JNm20WFq3qNYFZ1gWfqG/4=,tag:hBoBRIgae5QRoMirGgEWmg==,type:str]
+    GITEA__database__USER: ENC[AES256_GCM,data:aQvMk8Y=,iv:SaDZ5fWWbhu66BqYJ+KKs6/zMrdTDoDZvBQKd2IyLck=,tag:4z7jRIT158aUxaOmYWewAQ==,type:str]
+    GITEA__database__PASSWD: ENC[AES256_GCM,data:n6ywTKo/Eb8JU9/MBvwlbLxcPJp1VRRrMKniktMZjS4=,iv:c7DSl3ReYNWoRN2TPeGkxIUo/OXz7EtKr416nBtFUxA=,tag:zEf7GhN3RNkfbSn13WA1Yg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-04-27T23:49:11Z"
+    mac: ENC[AES256_GCM,data:tAs7ev9V8nwDlpUeYC6D79gpT2IztnIppycM3GSmiLwock9XrJilAyaahd+OdmLQXjEqqqOZjLKVCm67xf+3jiPFkmCsIfP9A0incrySEJBVsum9/7i3nbUTf2tJyhj7mlex33KG3Arsinx3oPfY1U5QykYBBLR6dEan69Vg6Fc=,iv:IrrJnQgpyGW6B2Nu2IKetT279/WRDU9yG/A6r+5gtXo=,tag:ZXdVSvVsP3IJECSCguSdVw==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:36:04Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixARAAgNVBrn+y64VuYMkJBTyBQBE3REx7MR+OlX1Rw8gSsyIf
+            A9sSQsNEGuiOVAovuoDbz5uOCEcu6FBh1i17NEQj1f4VYQJ4W2f3+SFkRqfXmXgJ
+            CEW4Ho5M4q30Lztp+8qy4coP6we7KkiFrVdyfWhFhI+J27D4VBpmlRszdDzjKSWn
+            iQ9EYIxSbTnTZlo/79XNB5vmb/JIQz6K7PKjd2X16VJNp/Q6iIJ4pYFD9F0qsnTJ
+            lfeo38cuKYkbx026hg91uTJKRnoKtpJVFmcvZ206/4o3ACp6pMbOMMREq273aFfn
+            c/da8+rpTzK9h2oSLRJA8Xeo8Ki/40VxVerKhxzEFeeV+SGXHSW8wn9hjbq1PFrd
+            9CM15YGBE7ikgllbW87SbcN870Zfo9O8aNSrLFtVYkBVNQGBuJ8WKKLGaHYY9LMl
+            9jBBaNRQG0vKCZ+72cDVLNa+M0U7IU8PO/G05ksHZUFPGLOXIV+k8hzFbcQ+Xy+l
+            2ofNe6v6PDG3kI6V3epizzR4x+zXF4LOKZe124PuQTLnuaAEUQzZfMGHHr9QsAae
+            PmaM9BWZ39pwKETWIDnuYwI5gdJdIBQjNIpCo13qZBk85k36RhoY/TO9Gs6iCyot
+            qXY6TraqnL5o1pda8gDBdl5PvB1A9K0bYF/KZYG3tVz0oFb+3QPNkJ2ThNqwji/U
+            aAEJAhCF1XMZ7b7KXIiArVZU0aWlr1ft+nHLNjQHaj6+8F6trh+Zz3acnvk8YLaK
+            7RweedA8WMtRJY2gRpZaPU6XVLt8IZmnKGSDoAf0mi6+9oCttadxz7Mp1Cvd3sgX
+            ahD5a4xk5FiZ
+            =6Lqx
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:36:04Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VARAAir4hbzyy5fcgrdFcTPcI6uyVRoETFz7VfSdo6pl6zOYc
+            ZYSDO8F+Hg5PBCHbE6LrTf1lMXtRKTOI4sIXGisACd7xdfDXvdvmBTuntovpk10L
+            4uj/umXjxOZVUyQ6642EU6FgxfNYKBOSR2lXoKtXh76GWOBPQ6uKF1VAW0MzFiXq
+            OFgt4U4KqTQoBdb4h8or+z1Yvp9U0hY1JDOUVzT6ymXxzjvjNcRLFpYxbaWynkG/
+            n1NkjY7nMxaDwcZowDfinNOD9VeIvZXthYr3eFuRzxHB8vKZlBLce4YpUL7lT56V
+            VQxt5h9gNJiXevuKUrLB9rnEPUBIqhf5RNH+qa/w7c4VaQlGj6p0Ns6giS+mIjYX
+            6h0yImGLnwCAbLgotVrUlir6a6Qodbote8LKa4G5hIKkF+O6gKjWZ+R4aO0OEQv3
+            tnTptRdVHA0oDiVXJk/RrFQHR7xo24AFAs+OXoBmMUrl5YxigV+qmWG1fnCNj1/l
+            TOMIM2hd9Lbz5iS8TZwKfpoZY8BJQNcd1Wab7F1KboGAAnCRLezMKmVDRzOQ1GIu
+            tY9ub63JqwQ1LgDKaLxgyflixPj+1460Qw2wBK5bT529QZ5EMlUIucKlF1MPWo1t
+            NGRXYR+gI80bb+tq5KvItL6s8JfJYm7HcqslT7/mCepJqCMulGh31Yai6NR+lQrU
+            aAEJAhAPp1uMcNtvlDzZ5ETnOxY39UV7h7RmWXvl5JsfYWXD3E+8O2hY5Z3u8viD
+            K3g41eXvY6+d6qyRQEzrkdTVQVU3bjxxp5cbkSrVWlZa93CjYR4Kypbw2TJspDq/
+            CyoEhvxtdypD
+            =8bDx
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/default/gitea/gitea-sidecar-secret.sops.yaml

@@ -0,0 +1,64 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-sidecar-secret
+    namespace: default
+stringData:
+    GITHUB_USERNAME: ENC[AES256_GCM,data:hf2VmtB4nmo=,iv:g6OflUpWClklphmVsGmNh0dmYWFmP75326yupzU2DFY=,tag:d7pmSAL9ND0V3BtkfTXmnQ==,type:str]
+    GITEA_URL: ENC[AES256_GCM,data:jqGmGnLfz7vwleKXOj1JNt2RdxgtrR9E,iv:QTTajHdzb9mtYY5xCiLzI09pIBE8Dtl7WAR0gB5yOwA=,tag:0KHQ4ezr7diAs7v04ZHPIg==,type:str]
+    GITEA_TOKEN: ENC[AES256_GCM,data:bHjjouHJeYgxE5iLZxeXCqubOj8U3oizxmWZThDj73e7DbLsMoPWOw==,iv:Uh9OGeAw5iuwqFDKB4/Q6xvck2nQWewBMbFoyv/9zPQ=,tag:2U+KD+0qY+iceVhhVNKXuQ==,type:str]
+    GITHUB_TOKEN: ENC[AES256_GCM,data:S5RVGUibveqUoj7mSf+4m9DtHxgd2ybifOkqJTsE1eDGOZwgpWrSZQ==,iv:GMqA/xAHFR5EAhYgnPaJfKVLtdVgtccbBa46g+RBOwI=,tag:fU17aUJC3dsj+aayNEs/zA==,type:str]
+    MIRROR_PRIVATE_REPOSITORIES: ENC[AES256_GCM,data:8ClWoA==,iv:g1N26o9upienKfmd9GPZq/1IvJsKDVsOkvQfU9xyf7E=,tag:C0LBixZWj2o4XJUjf3WX4A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-06-04T16:03:26Z"
+    mac: ENC[AES256_GCM,data:ky6LUNwPWZrQAgQbdcLc9pFPDKuuHQHLT/t4825fzDKT8LZNwfTkr7tjcnrfxp3zt/btdGWDRI3hDL2IqfuccBfcVqofRSE9FnnYKsvGPuUxnxbmWYtO1VNIQ7j0mHWsivQnwoQGPjmHGqg34vaQvNeq+2F0VrnGCHCoSrT5dFw=,iv:BRpJxXVmHPPYVBPK3LX2xRrLlIWd9iKTkaJf/Wm79DI=,tag:rrn6DBaws6hYohE0ObWJ+Q==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:36:07Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixARAAmXw7G2AAr7hRPYMsHwRjv54Vuj7G0fjiNB5cSRgFWgYx
+            0QmLx9yyWMXcXk8HDT0JUINtind1BkaSrmWFWR5BDt0zWBxl7aIBxbpVQX/ngro6
+            GBHoUcmg3mp9JquBhvPPfRFrZ6MeG9YBSlExevK/ibHxJH8KGTX1ZgUhXHt7SFct
+            a2wCU2d/8boN35hhnvuyHk9S7HtC83G+6aMboVJHtTV4XqtJQIkrifTkMfQZ/S/U
+            bxeHrf248GzCOIRkUuWKtLiMSC2eV+oJkcxrX218xZa7lEBL+Qr3StvtXEMoPiN4
+            h7qVmOHyXza6Z3Im+fDFtEVf/OiLDzISxgq373XQONRy5bYI0znTEldREnl6lY9W
+            GMnAdSBDMwyskKUOcpt8UfOM1Lgs77s7/BhfjU3bFHVoIZro090wceBSBKnD5s8Z
+            egHvJUBUcoij8hc6lJwS8HPpj/t0CVJu4p83Hzk71Swgtm3ZYkfops410c05VyoH
+            3JGFT+3dgH70zPqhkn7QHHpJq05dVgZyZq0iG9FRb3qZ/zG+Eh5UPXWoHjec6rGY
+            ElIJZTHB5cLqxuj1+gXXvi8ALXZfK9kUMUlmNTRh/hIMFUcCwrDt03HqVS4hBmFY
+            RGPywtAK12inSqg9OKNm2p0fOADKeAVQe8gGcF9yylVQqqije2IBPRhhUIy1t/3U
+            ZgEJAhDJi+OhQ2vMkt8ym/uhs2zHL3ZdsbC1HpbHcQHfxgJY5f7utKJsp+4emPu5
+            aljIcismK3U/PgB6XN/3NiSCMEGd6KogGrOY4TWmDPhzvEKGsVchk7O6eQKH3CR6
+            pN6JTThdGw==
+            =S1Z/
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:36:07Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ//YwcVVkVzS1lQeX77wGkYEPw/zPnBPWA99eI/+UyvoRaw
+            croZrtQvudBQVuKjMa/JlUhLYp3+skrv/rCNG3xG9L28FQn4fkqP08vLEMH3Q+BV
+            +6m7Z41mqjXvxHzlbQLjtMB+d642LfRyOCgP1VPpA6J5QuD4Gxw2yH1a12lSXCy8
+            1ZnMw2EPIAXoy9uLeX5klzxNGih5aFATzx1oHGWbh7HHQwPQtn6KMoNUYPJrJDku
+            qkPxHewxA9jKTGNIc5N9HTfHm5VjYLwTO9MOsJ2DpkJkFYTgVCgyooHCyQCvfpod
+            SEvntJxvkz0WFHhIQVVqxCCdKwjw1T82EVnqCAN08x+4olHVApoEt0dnFohlt1mL
+            7FXQot0VddnJ6D0ZPowmRl49Yu2U7yyM+Gwg8N0JdDCqwjBEKIFuR5GRAHGBwb4D
+            RotZ0he1lR2arbJBjnIcjgO0Yb8+YzXvVTjmp/TjPx2PRID4B00AsvLdmWdHU57W
+            gWszKwtE3tUAcxGY9T+BiQOTJuFR8bOa1EiUF0p2pbrM/Xc4g4LHNnnH4bZzZm2v
+            oRPWrQunch+sNujlObP2akbmrHZvhj00mN/d+/PKNVaCPQ+j6UGtFyKYfUJyLjsi
+            WWjm/OSc4HmITKG5BI1OjWsIKtCbMLNMHIvPgKeW9qwmMDU3J+/toKZEIz/pIt7U
+            ZgEJAhB4YPeqQgy9FVmDsKNK7iQpM6wZXVR+uj9Tx/KLe4MSBzpG7zYqBUBNW94T
+            Hyq/OxupUWsxSgtly5yEoihyBQhBf0ECXHw5v5xhxFgouqm/NwSixwt6baRr5lmI
+            d3rYPlnimA==
+            =sP0R
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/default/gitea/helm-release.yaml

@@ -0,0 +1,89 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: gitea
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: gitea/gitea
+      tag: "1.19.0"
+
+    podLabels:
+      needsDatabase: "yes"
+      needsAuthentik: "yes"
+
+    env:
+      USER_UID: 1000
+      USER_GID: 1000
+
+    envFrom:
+      - secretRef:
+          name: gitea-secret
+
+    # Sidecar used for mirroring GitHub repos to gitea
+    sidecars:
+      mirror-to-gitea:
+        image: jaedle/mirror-to-gitea:latest
+        imagePullPolicy: Always
+        envFrom:
+        - secretRef:
+            name: gitea-sidecar-secret
+
+    service:
+      main:
+        ports:
+          http:
+            port: 3000
+
+      ssh:
+        enabled: true
+        type: NodePort
+        ports:
+          ssh:
+            enabled: true
+            port: 22
+            protocol: TCP
+            nodePort: 30022
+
+    probes:
+      liveness:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        hosts:
+          - host: &host "git.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
+
+    persistence:
+      storage:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/gitea
+        mountPath: /data
+      dumps:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/gitea-dumps
+        mountPath: /dumps

cluster/apps/default/gitea/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./gitea-secret.sops.yaml
+- ./gitea-sidecar-secret.sops.yaml
+- ./helm-release.yaml

cluster/apps/default/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./fireflyiii
+- ./cdn
+#- ./gitea
+#- ./dendron
+- ./trilium
+#- ./whoami
+#- ./msrewards

cluster/apps/default/msrewards/env-secret.sops.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: msrewards-env-secret
+    namespace: default
+stringData:
+    TZ: ENC[AES256_GCM,data:rIp7EMSrKApRg03l4/59Xw==,iv:A0cFOA2pr7CvjQBiCcequq9WAA77x2k8iqTlMJ9lJBU=,tag:dYdQDtA1H1h/CufVSEbQGw==,type:str]
+    MSAccount_0_USERNAME: ENC[AES256_GCM,data:JIW/ueWXYfgP+rgMR/7aXWWyuRP1YQ==,iv:P69ybwaQPFfMJnfDiVM3TSSlc2YkAUUM6VANdhgFDtY=,tag:GlZwS/nWOJfm7NQzXLkPFA==,type:str]
+    MSAccount_0_PASSWORD: ENC[AES256_GCM,data:nUWE5vW9iSavWPKhVWcn,iv:NWI9ILx+M8EGWi4jaor8MpRWL9SYXibOp9Nct6rVB+U=,tag:CUqpuogj1BJk2ocicaj5vQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-05-15T02:13:48Z"
+    mac: ENC[AES256_GCM,data:q1QBZ3bGr90qXXHKEtKuSfC39pGJ90ss8cJtD8CIZYYB5CQAuz0fZH6nsim6FoyYhWXDzlDo8HH7Z+bLJt1BGXCSa0SDaOe9xcSZtBinSapTQ3sYSRul99xCD7QHGGFXZtYbPjCRv/qj58vRTLXHKejnh8hCbPJsNYCYYuBGXks=,iv:HDIA3WDGZwXhwRjioGnd2KHwWISinLLoxS4LaHLgRAU=,tag:ux9KEs0bYQUzkpnBdrIQAQ==,type:str]
+    pgp:
+        - created_at: "2023-06-19T18:36:09Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ/5AWY3FJu5a6Gdw1bQSYp8vcQM8Y40oEcm7K8VGQITHLvc
+            EFMd0EVZal9czdTuGMjQCMfKYw2PumPbzNUzhejJOVG17vmJ8fAchK3XiF0Ru4pN
+            2zcfzP35WA5/2npx/A7Mqds/BZ/jG1TxzgRH5XH52Rnq7/hJnNlMiLjmLNfTSRA3
+            H3lT3lU6RpQsxXSTzWkuyHmPj/6fl68Yq8pjqJz1dW2wsbE911wHvwYKeT8xeOYa
+            p7JRQSnEssLisIy1PItXX3uNyaEPoLIUUpJjKA8pWIDeR9iVEnytM4UhrPxYNWTQ
+            hqw67pl8sROHNTNNxwJ2mcbvxRareVRMJpQFF9F4c3Qy+Dqfc38bIJWCsBois97x
+            0mqFyAdhDneNdmTUd8Mxvf7lJ1N/ZBXhNIaWmmEyHocadlgkNC2gu23KNU4iH0n5
+            jj1qARSTnoPQGZ7Xo+zS7rPrvN2khILW0LLQWwXYy1Tm2OplApx3R9DmQkCfzO6W
+            cYWbW7ANmk7+6hnopJnNRAn+vVnjoR8GLBieLt3lJQAx76H7IzyLdxgI6Wtkh9Vr
+            vNbg+l0YxkGIqaIvsk5/w/pmSiw37m+tsFLgRZZdLKXdQ9ZSgV9pYzdH2e3wBD8y
+            haQzBZYEPRuVQ5QEiE6/HJSHJEmY15Z7DEwHzb7qoWn0Jg0fyyyfC49jKQt/dZTU
+            aAEJAhD5okv70Fq0Uer6t3fbvyVFqbOkbTLxErN/VYGRJ9xWype9rSEa5jnEPVSe
+            V3KhnB+sU6ROJfxIT0145Hi6+BWK9qYCmUS6Qncupywleda88Qaw+TGT6b+LUNnk
+            e0+sta4SwbYi
+            =9koT
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-06-19T18:36:09Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ/8DgLVCG813l/YHqZqrSKHpQNvolT2fIgxGPwWoCjpiDvL
+            C572dpnQpZ9dAU5J2i0UMYeH2MXnwHqSU+QcWXTcPPjmKdB0Pj4+BCsr/zUdHJbe
+            AMab8vqBuiOR9lL57t8tpV3HmhbKkDbUjL1BPBe+HBfFXjLNXu0HaIbChPAoroke
+            wpbua7lXQKyAle7Do9ROXO5Ol8nL548Kr1hYsZbhLBOJHYdW2O0OpTN80DtNKyhR
+            BEeKUrcAgXFLBXETPKbUgGELHJkn7LBiyxBHQJ7ihBrr8J0uH+4J5ucFm6K8iROs
+            KGjYLtmMWq9MMJTP7/I/XYlwaJvyM85LvBEkCWdEAFy/9JaQ/FXPM8BpqdVdB709
+            dt6smhY0jFd/J//0pSPW+qpyfp5tzY54IkYLM5BgU9G5pyQKV/SFsa446K272V7S
+            +yaBrpnEJXO7Wh2cAI5RKCkPI+YdvVpQUGnLVeMMBw/nMDG8wG3qI1lNGbetoCWr
+            P8K05M1rvKvwXY9mdMtnJ0hisidJwWxk2UohOV95Wpkd/EYsnzxuAsmwb3MrpeSi
+            c5vZluoxgDNZssnKYqOhavBHs15vIdevDB80X2ljeVrODX+HGfNrnTZ9NNe/TF2o
+            1aR6vUZ/rykJfYD2OhqX8hxD2ti9YWhOhD/TWo0mS/zMN1AxRbBRZbIg1YdoRYXU
+            aAEJAhB7B8y40+mMvqS8MEDuK8Bz5CQ75FyXA+hLr71ui95SQHvJgXpO9X8UkRJj
+            kxOXz6h4198C4iiNpcl9oXEtcNZRMUEm0Vr+2RBsK0phOJamlMKBwhExAcspHNr3
+            BiFxA9mIhB6h
+            =0koQ
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/default/msrewards/helm-release.yaml

@@ -0,0 +1,35 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: msrewardfarmer
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: ghcr.io/binaryn3xus/msrewardfarmer
+      tag: latest
+    
+    envFrom:
+      - secretRef:
+          name: "msrewards-env-secret"
+
+    service:
+      main:
+        enabled: false
+
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch

cluster/apps/default/trilium/helm-release.yaml

@@ -0,0 +1,53 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: trilium
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: zadam/trilium
+      tag: 0.61-latest
+
+    env:
+      TRILIUM_PORT: &port 8080
+
+    service:
+      main:
+        ports:
+          http:
+            port: *port
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          #traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "notes.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
+
+    persistence:
+      storage:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/trilium
+        mountPath: /home/node/trilium-data

cluster/apps/default/whoami/helm-release.yaml

@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: whoami
+  namespace: default
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: containous/whoami
+      tag: latest
+
+    service:
+      main:
+        ports:
+          http:
+            port: 80
+
+    probes:
+      liveness:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "whoami.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls

cluster/apps/dev/code/helm-release.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: code
+  namespace: dev
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    # Add init container for pulling znc modules and putting them into the modules directory
+#    initContainers:
+#      pull-module-source:
+#        image: alpine:latest
+#        command:
+#          - "sh"
+#          - "-c"
+#          - "sed -i -e's/ main/ main contrib non-free/g' /etc/apt/sources.list &&"
+#        volumeMounts:
+#          - mountPath: /znc-data
+#            name: config
+
+    image:
+      repository: codercom/code-server
+      tag: "4.16.1"
+    
+    service:
+      main:
+        ports:
+          http:
+            port: 8080
+    
+    probes:
+      liveness:
+        enabled: false
+    
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "code.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
+
+#    persistence:
+#      config:
+#        enabled: true
+#        type: hostPath
+#        hostPath: /mnt/MainPool/Kubernetes/znc
+#        mountPath: /znc-data
+
+    resources:
+      requests:
+        cpu: 1m
+        memory: 4Mi
+#      limits:
+#        memory: 200Mi

cluster/apps/dev/kustomization.yaml

@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - ./namespace.yaml
-- ./network_policy.yaml
+- ./woodpecker

cluster/apps/dev/woodpecker/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: woodpecker
@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: woodpecker
-      version: "1.6.2"
+      version: "1.0.3"
       sourceRef:
         kind: HelmRepository
         name: woodpecker-charts
@@ -20,18 +20,15 @@ spec:
       replicaCount: 4
 
       extraSecretNamesForEnvFrom:
-      - woodpecker
+      - woodpecker-secret
-
-      # https://github.com/woodpecker-ci/helm/issues/154
-      secrets: {}
 
       env:
         WOODPECKER_BACKEND: kubernetes
         WOODPECKER_SERVER: woodpecker-server.dev.svc.cluster.local:9000
         WOODPECKER_BACKEND_K8S_NAMESPACE: dev
-        WOODPECKER_BACKEND_K8S_STORAGE_CLASS: mainpool-hostpath
+        WOODPECKER_BACKEND_K8S_STORAGE_CLASS: longhorn
         WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 5G
-        WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
+        WOODPECKER_BACKEND_K8S_STORAGE_RWX: true
         WOODPECKER_BACKEND_K8S_POD_LABELS: ""
         WOODPECKER_BACKEND_K8S_POD_ANNOTATIONS: ""
         WOODPECKER_CONNECT_RETRY_COUNT: "1"
@@ -44,16 +41,13 @@ spec:
         WOODPECKER_BACKEND_K8S_NAMESPACE: dev
 
       extraSecretNamesForEnvFrom:
-      - woodpecker
+      - woodpecker-secret
-
-      # https://github.com/woodpecker-ci/helm/issues/154
-      secrets: {}
 
       persistentVolume:
         enabled: true
         size: 10Gi
         mountPath: '/var/lib/woodpecker'
-        storageClass: mainpool-hostpath
+        storageClass: ''
 
       prometheus:
         podmonitor:
@@ -70,6 +64,7 @@ spec:
         enabled: true
         
         annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
 
         hosts:
@@ -81,3 +76,4 @@ spec:
         tls:
           - hosts:
               - *host
+            secretName: wildcard-main-tls

cluster/apps/dev/woodpecker/helm-repository.yaml

@@ -1,4 +1,4 @@
-apiVersion: source.toolkit.fluxcd.io/v1
+apiVersion: source.toolkit.fluxcd.io/v1beta2
 kind: HelmRepository
 metadata:
   name: woodpecker-charts

cluster/apps/dev/woodpecker/secret.sops.yaml

@@ -0,0 +1,64 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: woodpecker-secret
+    namespace: dev
+stringData:
+    WOODPECKER_ADMIN: ENC[AES256_GCM,data:TXqVhenIfPfwv1WZs3w=,iv:SxyUU9W+V/NBVqyjuMdWgrMpekp8apg7zV5XQUv8/Uk=,tag:TE4vesnF4ptKHumu9Rt69w==,type:str]
+    WOODPECKER_OPEN: ENC[AES256_GCM,data:GOD8OA==,iv:39gfTyWXmsUoRg8GuMP73bM16cN0CkY7AhJ7mKX35LI=,tag:j/L+C/O9WnWgexL29HznjA==,type:str]
+    WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:8jjlVX8rqX4YVUNj7pbwPCo+hYMGEwSl/KQ68yRi4R2aj8p5yddxQ8UH8hvRXEEhU3DX5lFW5mXfN+8EROsQuw==,iv:6y6ygCjT+stF3ObFZzNS8Qi2grJJCUSPzus/ebf0qcw=,tag:vCF4jrkT/h4PoOt5IGy6dw==,type:str]
+    WOODPECKER_GITEA: ENC[AES256_GCM,data:dLlVKw==,iv:wASS5ZoS0sBGuVB6pjygbPwp+33rDwV2x1intu2uguA=,tag:HumjgcBce0rXT377OhA3bA==,type:str]
+    WOODPECKER_GITEA_URL: ENC[AES256_GCM,data:cxw/whpjJ+FtymS6lT+M6Ayiz8T1ZZ6Bsw==,iv:6C3oTJ0FOXSKV5Sh5YHI5mFMH3azqBgCARWyKijnDdE=,tag:yt17NnyDlgyfrPJ6VLHjaQ==,type:str]
+    WOODPECKER_GITEA_CLIENT: ENC[AES256_GCM,data:OlwxTSfjtmk5MuHZ4qo+o3OkDfUOspBgS99q26doMrqC5Nj9,iv:mTH7jclMu47GoTlJstwTWXh+6ZnFwUSy3JBn1Y0dusU=,tag:KgHThNxIj8wRQdimtlv7EA==,type:str]
+    WOODPECKER_GITEA_SECRET: ENC[AES256_GCM,data:Six91NP9wP3HFFIHP4o2Q8k+JLEDbrhRKC520giheJbcFlpwWwN3FBwAApKDCIuV7/UrjKPs++E=,iv:yv8b5+PQ/eiLOBNV+OJ+WlCVIrZz+oPAcsNu8wfFU94=,tag:joSpLIzSAx79v/1kobMnyQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-09-07T16:43:19Z"
+    mac: ENC[AES256_GCM,data:JreywI1w6bDLlCntqpTfX+kNGO3GN4FT0egf6zi4dUwhIUOXRmVH0AXs3pYm8/1fMUrovG0W7uRXfHu5C28k+scEdLjuMhJbjz1yz6Gc9ewByN/nFGxS4vWdMkMQmPzi3Xnt7teVNkRXvlVODE9Qsn0pD627B+2sBboHar92kmI=,iv:hZ8B/oeuhT3DM7YENXbdYXI5toSG4xtp2iEyCSTxJQA=,tag:pHAE5CVr9xEMuAByANrrbA==,type:str]
+    pgp:
+        - created_at: "2023-09-07T16:27:38Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixARAAhfLs8yfYdUsm2H1rpnJ+s7IDvmPJfz1Zw6/IGxHKkXhJ
+            jeciJZX3D/Xkit5TTL8Rn8dj897bCORWd7Cr9hNj7sae5ZANiIQJAfraF4vsZEV4
+            GUBrxNOp+pdCqOc3NhE3p5jceZ4COgeMbIR0MFuOip6KOJR9Xi3y9UmdSpQn8T1V
+            SH5RpBpgmNk9P2q2I/m9+XtIBcvN1nXWRbblsrZ5g6JTacatBcjXInmvmEeMoABd
+            SE0BT2HHa+0i71MlkJl8qNcg5YWQAOPPa2NS0uJWBGwjn7M13eaiDIgmFLGXWd+k
+            UrAfAatrG7psg3bwGztpsTKoA6TvwJxfm3hba7FwsfhsWLlikmh3cOvaoS9w0Edk
+            WuIFrIjHnoHTGfTz63fUg+zyQHwCgxi17FKyVaz/zt4JgXQRw9OLwz1xurRjb2NG
+            INbkLShkQHNSvqG8kQNfjs5q34EE33N0C2TY9Fl4O243UdAd/jRM+3+QsDVQaEAZ
+            KYF/ZA/Df31dk637fQZABKdpmXqU32Gk/ZFGJhYe8GDLafI/tdUZQTeL/UA7NuQ8
+            D65at6vbpIgmOIfIAxuGPtNRksj0KEnJnqVj2U7dw/7rqNoZHPue36vQt/ic/dYO
+            f6jsX5fXExvSmI1w67sr2u/PPIPBn+ZSzRlUgUe38QZdDwxWq4GC7PcsDWVuMxHS
+            XgF/ki/LVMK6bI6FVJR/Cdrj5I9CjBwdQsmrMHoEoJXgpKY36E3hKK1Ryqs0qLE5
+            l/SpCEF8p6UBYd4Qlpx6Vc79PC7LbyWFENZvdPK9dIP1d8ssXsul1fUVHBPD4g8=
+            =wLQl
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-09-07T16:27:38Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ//QYrbS6xfuWOrZ+NRwfqXJsDC0mVoDujFHUL8clhIB2dT
+            Kh1DGcqthw9cKRgkEc7Bz46GFak01XNP3EC/tl+B4Zwye6FSoGVabzC1jB8PwP2k
+            MeFtVFGQa9iBC/w+67wng2ELypLCVVye9Fd91Dzm7ezk6FuU/PprXRrCcW9UHyXj
+            9cMP87OE3Be/lMTuN9iz2PkNVg6EgHWtz6EIjDQYH3UFE2aAWeG4FuuYy2mdES4c
+            HO1/D2pf21LUAOkABe4ifgyeWfUfTSnshUzegvShQRohMdLohSF9lbH9l+o8Hvwx
+            ECYfq9jW3vkRpleZA87hsVyhBD8TCuGRByVgQbYRlrnC/kTyJllRdesYEuFN9Cqj
+            QEoD1nCrhU/vdNLR0o7WWIxl6jFYmroXLW5q8SP8XX1KPYIXzupWq9tHu6CHfmtr
+            /yBq4rbZOtAFitntg+FCMld2lmw1kr2H4VDxBGXdoC+va9PkjIS/ayorSWgmogck
+            tgR3wJzFA1Bi7slxyJfZhRxTbPCbrny54j4291ZcBbB8pzkACQErvomXTdZwaclq
+            laMQzrGoLF4MdmDnKcMQvAvgFimEd2BpPCJsxtH2wLgEfRodUzbb8dIZM+EEVbaw
+            XVwFzjOLnHSLp2JtkGDW6eNEJYCk7kxQtkqFZ2etTtO3E0JKiIHatX4wygMcWoLS
+            XgFyASgFilpOZpv2rE8A/90Mt4lVZrQO2c7dIRMaEqAOcCKWYxjshQ+/spkKe9eB
+            froZsj2oV5ZtVwfpLG7Pw8R2taPu5DQ8uZHi9XdFPmYwmqpjEj3uZA+oo/NjgEY=
+            =XD7x
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3

cluster/apps/download/bazarr/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: bazarr
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: ghcr.io/onedr0p/bazarr
-      tag: "1.4.5"
+      tag: "1.2.4"
 
     env:
       TZ: America/New_York
@@ -47,6 +47,7 @@ spec:
         tls:
           - hosts:
               - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/download/flaresolverr/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: flaresolverr
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: ghcr.io/flaresolverr/flaresolverr
-      tag: v3.3.21
+      tag: v3.3.2
 
     env:
       LOG_LEVEL: info

cluster/apps/download/kustomization.yaml

@@ -5,14 +5,12 @@ resources:
 #- ./network_policy.yaml
 - ./qbittorrent
 - ./qbit-manage
-- ./radarr/ks.yaml
+- ./radarr
-- ./sonarr/ks.yaml
+- ./sonarr
 - ./prowlarr
 - ./bazarr
 - ./readarr
-#- ./mylar3
+- ./mylar3
 - ./unpackerr
 - ./media-dashboard.yaml
 - ./flaresolverr
-- ./kapowarr/ks.yaml
-- ./sabnzbd

cluster/apps/download/mylar3/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: mylar3
@@ -17,7 +17,7 @@ spec:
   values:
     image:
       repository: lscr.io/linuxserver/mylar3
-      tag: "0.8.0"
+      tag: "0.7.3"
 
     env:
       TZ: America/New_York
@@ -51,6 +51,7 @@ spec:
         tls:
           - hosts:
               - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/download/namespace.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: openebs-system
+  name: download
   labels:
-    name: openebs-system
+    name: download

cluster/apps/download/prowlarr/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: prowlarr
@@ -17,12 +17,12 @@ spec:
   values:
     image:
       repository: ghcr.io/onedr0p/prowlarr-develop
-      tag: "1.26.1.4844"
+      tag: "1.8.1.3837"
 
     # Metrics sidecar
     sidecars:
       exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.0.1
+        image: ghcr.io/onedr0p/exportarr:v1.5.3
         args:
         - prowlarr
         ports:
@@ -91,6 +91,7 @@ spec:
         tls:
           - hosts:
               - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/download/qbit-manage/config.yaml

@@ -14,7 +14,7 @@ data:
       tag_update: True
       rem_unregistered: False
       tag_tracker_error: True
-      rem_orphaned: False
+      rem_orphaned: True
       tag_nohardlinks: True
       share_limits: False
       skip_qb_version_check: False
@@ -50,7 +50,7 @@ data:
       #remote_dir: "/storage/Torrents/"
       recycle_bin: "/storage/Torrents/.RecycleBin"
       #torrents_dir: "/storage/Torrents/BT_backup"
-      #orphaned_dir: "/storage/Torrents/orphaned_data"
+      orphaned_dir: "/storage/Torrents/orphaned_data"
 
     cat:
       # Category & Path Parameters
@@ -241,8 +241,7 @@ data:
         - "**/.DS_Store"
         - "**/Thumbs.db"
         - "**/@eaDir"
-        - "/storage/Torrents/incomplete/**"
+        - "/storage/Torrents/.incomplete/**"
-        - "/storage/Torrents/files/**"
         - "**/*.!qB"
         - "**/*_unpackerred"
 

cluster/apps/download/qbit-manage/helm-release.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: qbit-manage
@@ -19,7 +19,7 @@ spec:
       # this init container copies the read only config from the configmap volume, into
       # an emptydir volume mount that the pod can write to.
       copy-config:
-        image: alpine:3.20
+        image: alpine:3.18
         command:
         - /bin/sh
         - -c
@@ -35,7 +35,7 @@ spec:
 
     image:
       repository: bobokun/qbit_manage
-      tag: "v4.1.13"
+      tag: "v4.0.6"
 
     env:
       QBT_STARTUP_DELAY: 45 # seconds

cluster/apps/download/qbittorrent/cookie-secret.sops.yaml

@@ -0,0 +1,61 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cookie-secret
+    namespace: download
+stringData:
+    mam-id: ENC[AES256_GCM,data:0GnVYb1YnIDW1tAJkzznzrgf+CaSHWwUfB0FtZv4SHNglFctWOqj9O8Hb0rJZcCzXiGmbD51kIZ+JKCBvgtW7p70Nc/VipjtoHWz4gFHvK8/iFHqlNodpVga8inpfONwwVvo0yNwBG/SE1pmFJBn8NW4nJ7SmNwiy9a0qWuUJ5aW/PG6qegz9++V5sKrO8OrpBsANmniK3YECegDuY5g0VIhRacnVX25CsqxWFGrB6OEMzp6gs/kdkAFZ3HTK5QTLPUhQC7mEmFq7jCPnCDKG7OFG14dcm7xg+h31A9S00+36P75cS7bjALNPAXl6ZhR49N2bIYZw84wunTmYuiCxXZRDdMOiqkb0lHLyWBZhKlhJRzSd3WJ4QVZoA/iqE0t8F0MYg==,iv:afLS0Gb1z+bSjjmZnXeOeZmmHHs49k1MaHs1fBWgXhU=,tag:aenXjG0FaUSMbz34AKFrMQ==,type:str]
+    mam.cookies: ENC[AES256_GCM,data:08DGP+qmIx88ihmi7DtpLsn+W/2AsuP7HQNp9N8rdU3VXxaLAo/pLh4CKsvbe0DZaa31yzowu7WQnuVuYEIqHPRjNZZtmE8rYVvaxZXe/8UzHoaSjVsWMEh/663YALmwdzqvVMylCUpJLJWS0emFs8dyfNlogix9Bk0f2yDy6A/oqcJ4VymJQtjLILNdp8l4pjgjiX0KiVmXB2jKcItOky4x1wASD/dziEO0FQ/60ZCjnJMPzLUAnlIV1ewccjCSbb2Ls5rcbDJSlW9PTK55P9K8kB4mqBkF1WAZ1PXeNxvPK4zmYxY6eNSBchU6j+yEd08YmNqxnaXPfMRPOUUt7Fplze1Bvnl8Sd6ByC5v14M1SMqGctIJN4ymmA4pCGzEYQH5spztbeGjtU75nQekpvtk7XVIX2x0daqGAntIpuaxB8Bw1IDMaHEr6Hg3eBT1RAU/XWIZ8dSu1Sq9ZkxUZz77nRdCTpl5koW5q/u0llEJw7Td9TseutvR2yHnhezRoJ1DUx6qTSdKTEZL7/AOCIIvcvf5rg5v1YReSOUETfL2OBf0WmAYW5nYhKUVc5UgVOXpqaN8qvQyeqWmmrKmhPxMnKaHpRUKSCzCnDMTF/oyda0uNNY3YjVzt237A7rddgSg7X2nkPXXmG01niK6Tvw87m1AqoQMhMPhT/AU8gmdtSXhKr9X2Fdr0AuyTV/6uYR5yQJieZ8HZSL2yEO836evyI+pZnu7eGxXhR2nYfkylqNzownRRXxGkoFbZdAoY4jSLCRde/MU,iv:7P5xM87hTzTYT3dmkqJLdKg6HzrjqlSE4e49eaaeyjI=,tag:489l1E1/huFqakqj0wIOMw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-12-14T03:44:40Z"
+    mac: ENC[AES256_GCM,data:i2metUiGmjOM+BRcLmNHjqpUVdavKawF9wRWxCejfuEfEH/3ZYrsNg7zZ/0Pg08R4h1LkvEsoP5IN+/EOUknGce6icQBujXmqm0apnKpSVMB7319BD71D2OY/LRNUOnyLp9ueEwG8dojt0Qua0PCLXuxdeotkizQEQ9gQxs+6Mw=,iv:vPVdxDpQQvZERkmc1b+i1KiNanmOe9GEMs1jDQXkUuY=,tag:9LncpCcmOpSMMc3FeOoeCQ==,type:str]
+    pgp:
+        - created_at: "2023-12-14T03:44:40Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ//c7dllubouH3Gr5pm80lr+ZRi5/4zYV+6HdXNCwwsk67q
+            LSOjA6jqXRE/uGxQ7psSNYYMqHnJuHavkC31bIRJzTRHAVqtHfu+JZOu7XsgYmI6
+            9ZuohlrepzEFt0DWR6PjeWUx1Xz7SqLA413Np9gT+wpt1eOlu4QwmipzdX9XyEHC
+            LZjUAElg7k3OGj7yJhiIgL29R9ZyOaObr0KUDNy7KH7DRtfLTBsLFbk1QqLS9yvo
+            aQRMQwNyfkZvodn1TwL8GcNG/ZVgPlLMLbbwn+XfK+yod/0B3Tl8hgYSn29yZtvy
+            5OSZ6gLzt/FyBra+LW2nHPfgbB3/sLRjonAo+e8D+fuBAHJ/t/+lIpeHc8RWrlLU
+            6gxyexrVd7CmjyCfCfbmQ/dwpnC9Iu2dyVzCYwopWDdnZb4u8mYe0h9NvIkmXMUX
+            o0ItVgvh4U1lDr5nAyAo+PIg4kKHllgWoqnUNS+n1Y066fxGFnzlaTYexJyjQDW7
+            ehqLAOoSjm0vmdt3G6IH2dTUPjV3ZPVf4xgbYvcHgMyw0wyCCnNydAgVD+hffW94
+            M1bqZJakVjKu27ooVStHa4UMD5JzKiEdXVj1clnHwyKWNKIqYT/dm7ZpZglurdvN
+            NwNYLUsQ/n5agrbX7RbZ7ppxIkw8xpgnmdXYqCAf/BG+u2KKXPdaoS/lVX7CTvDU
+            aAEJAhAQJoYO9Hp7GyTxIRKLNdnH1YpxmUiewHIP7vjjIxloSkRWLNSHtL21IKRG
+            HiVm4OMW97WYTobEry7BPO6uIcCJSDoETmqJ3Ql2jBtoZJ5bUkaBg+6mGRIa/FS8
+            jD3jCc73NcOR
+            =47Hn
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-12-14T03:44:40Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VARAAuw6LctL+0mP9HAULlxz46RyvKqvHMXNGjr9KXH2StmC5
+            CxIXLoqXn+1yQX2DovIIlYOsu9WXnHNOVAtNxMuqR3e+Oca2wUlhANCfge85N83M
+            Mk1jNWo7ENeyJvOpYidu5AxLXRNPHkSLwpXbSdn6lwVvDm7k7L25EGZsqCHQec0j
+            VE4GDplPNL9NSiDKz7f3CIeLlfBm5TJ2ucm2UfQWICetQn+Zi6CtE9ls+c/GRHm8
+            SLbylcSON8jCEsUoTgv+YEXNEexIpxWpqo3tiY2m0DcAZdbXFrvq4jiLSMZLy6Ut
+            TJiEUyReAiTTdyYGQ3b+1TBudFZSlZUka0ZtXs3EHeSO+Kz21FBonFmZwjk9/LmT
+            j5UO+PXzAgDbRoHuhdPwLERSQ2o72WXxuwM6RibiPXC0ATbQMjCSwHHnkOf8odPA
+            xZprFNgd7iM5rAV1gr0yhz/OZxrsXcjO5N/ERJCk/hUm0ara36JRpjS0ew/gyD+y
+            sK7a0EiIUGq3KhUBJ6QvNUFPl5jhPmHNOCvu1UHhZ/QvjyvN+LrxAX/a/CCeP2GK
+            9r1eWnd2uNSDHUnzVipzAKjbEUR8FNauLvv0Kyur2vIyyJYExPahXBtkRiZAINkK
+            V/xiMWwnjDs70fi8h7O/UShvCd2n5iL6L2628b2ksxUbjrYKJ53CFOxwSSGD5MXU
+            aAEJAhDam/T8dl4pIklOUf9t0APsUzpfuox+n5/9X1uUkEJ142YgcAICNALpuM5C
+            MbqfQFUQGHc/fVyqMKYcXjj/Y2WrRLDuYWMHZkljxrEK2lVyckJp191d09KrsapU
+            tWaSRHojoBDF
+            =9cAX
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

cluster/apps/download/qbittorrent/helm-release.yaml

@@ -0,0 +1,126 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: qbittorrent
+  namespace: download
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: lscr.io/linuxserver/qbittorrent
+      tag: "4.5.4"
+
+    sidecars:
+      gluetun:
+        image: qmcgaw/gluetun:v3.36
+        env:
+        - name: FIREWALL_INPUT_PORTS
+          value: "8080,17871" # 17871 is the prometheus exporter
+        envFrom:
+        - secretRef:
+            name: qbittorrent-secrets
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+        volumeMounts:
+        - name: gluetun-tmp
+          mountPath: /tmp/gluetun/
+
+      port-manager:
+        image: git.seanomik.net/seanomik/gluetun-qbit-port-updater:v0.1.1
+        imagePullPolicy: Always
+        env:
+          PORT_UPD_QBITTORRENT_HOST: localhost
+          PORT_UPD_QBITTORRENT_PORT: "8080"
+          # safe to have in plain text since qbittorrent is exposed through authentik.
+          PORT_UPD_QBITTORRENT_LOGIN: &qbitLogin admin
+          PORT_UPD_QBITTORRENT_PASSWORD: &qbitPass adminadmin
+          PORT_UPD_PORT_FILE: /tmp/gluetun/forwarded_port
+        volumeMounts:
+        - name: gluetun-tmp
+          mountPath: /tmp/gluetun/
+
+      metrics:
+        image: caseyscarborough/qbittorrent-exporter:v1.3.2
+        env:
+          QBITTORRENT_BASE_URL: "http://localhost:8080"
+          # safe to have in plain text since qbittorrent is exposed through authentik.
+          QBITTORRENT_LOGIN: *qbitLogin
+          QBITTORRENT_PASSWORD: *qbitPass
+        ports:
+        - name: metrics
+          containerPort: 17871
+
+    env:
+      TZ: America/New_York
+      PGID: "10000"
+      PUID: "10000"
+      WEBUI_PORT: "8080"
+
+    service:
+      main:
+        labels:
+          app: qbittorrent-service
+
+        ports:
+          http:
+            port: 8080
+
+          metrics:
+            enabled: true
+            port: 17871
+            protocol: HTTP
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+        - host: &host "qbit.${SECRET_NEW_DOMAIN}"
+          paths:
+          - path: /
+            pathType: Prefix
+        tls:
+        - hosts:
+          - *host
+          secretName: wildcard-main-tls
+
+    persistence:
+      storage:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Media/Torrents
+        mountPath: /storage/Torrents
+      config:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/qbittorrent
+        mountPath: /config
+      cookies:
+        enabled: true
+        type: secret
+        name: cookie-secret
+        mountPath: /etc/tokens
+      gluetun-tmp:
+        enabled: true
+        type: emptyDir
+      
+    resources:
+      requests:
+        cpu: 10m
+        memory: 250Mi
+      limits:
+        memory: 6000Mi

cluster/apps/download/qbittorrent/kustomization.yaml

@@ -3,8 +3,8 @@ kind: Kustomization
 resources:
 - ./qbittorrent-secrets.sops.yaml
 - ./helm-release.yaml
-#- ./qbittorrent-metrics.yaml
+- ./qbittorrent-metrics.yaml
 - ./dashboard.yaml
-#- ./cookie-secret.sops.yaml
+- ./cookie-secret.sops.yaml
-#- ./updateip-script.yaml
+- ./updateip-script.yaml
-#- ./updateip-job.yaml
+- ./updateip-job.yaml

cluster/apps/download/qbittorrent/qbittorrent-secrets.sops.yaml

@@ -0,0 +1,75 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: qbittorrent-secrets
+    namespace: download
+stringData:
+    #ENC[AES256_GCM,data:kFKbnk5b5u4W6+RNeXCBEl0/9/pyIiVJMylujxzF6g==,iv:V46eLoZYOtXwaeM024jpB/Bf0J/w+pU6zgIQ6+zivPY=,tag:InrBZbzfo0LCOLmT1SZftg==,type:comment]
+    #ENC[AES256_GCM,data:vSyBvDlFDcmiDEqIj53Ply/fP/6+cH0jjtS0sDIadF0T4v1Y+tkXOZK/xDtTkQ==,iv:iAAt9EYb9mFOtCrzJvSuw+XSBRcOKS/TDrEWL6VfttU=,tag:kcXjQNflSJNLyLN0Ado/Cw==,type:comment]
+    #ENC[AES256_GCM,data:bFItZO2PhRvVUOHKFSGkcnN+0LhLPJQC9lea//e4MTHJuw==,iv:4re3gpzWBqH1OaRdMiuAx1WNCnBgQvmLtcemVmslnrw=,tag:F1oTifDf61DggEi9raR3yA==,type:comment]
+    #ENC[AES256_GCM,data:P6L6Ddf8v6fn4UzJNhhRmv1DykHM3ilUOjfeRNjmnb9lzw5UzyG6P9t90XF/HxDGXv4=,iv:BWcN23aQu+jW+byy/M2VRNbCgfQBRfcxV4VEAL8LSR0=,tag:9c6gUhgdqhoK8JroOcz+VA==,type:comment]
+    #ENC[AES256_GCM,data:ZVZM0vvuiTky9kBv7TcNKl0xCvVtFtULxqnnemzlrg==,iv:HaaAR0xiN8Lss8RoumaUCGfRxyJoJTVTAayHZ/vitGI=,tag:XMDl3T4rLz9NbHlkCOXL0g==,type:comment]
+    #ENC[AES256_GCM,data:s6JYwUMPoK62524G8hcOxwTzhq7iBfSqqA==,iv:+IyjOdVrOyb224D5z5HEKpy9cnmAlLcjB9ZgaCS3DaA=,tag:f7mFWCMDbgI/AlB2GkBKHg==,type:comment]
+    #ENC[AES256_GCM,data:HAB28P9Lh9PVfNhLce3IK6C0PqFnAvQ0bBPTmBC66rbrqSXzhvzF,iv:O/ee2fS1Q1PK9K9U+RHwBHd2UZdSVrw3mVS4lgnGsvU=,tag:/c7Dj+sL8RuaBq2exJ/eXA==,type:comment]
+    VPN_SERVICE_PROVIDER: ENC[AES256_GCM,data:cxJUkG+M,iv:MISXrZPCX9gjd7uyYjvfZ6/hetCVJ8qihIf1tb7ZqgU=,tag:kSXnRIdVsf6eWxc2o7rkig==,type:str]
+    VPN_TYPE: ENC[AES256_GCM,data:ov1gkA28jPcQ,iv:e9PQ0pT3NCsXQJ6ljtNyX2f1affBnVHYFst5S1Uq+nA=,tag:I4GM26sPnvy+a5AqJ9npLg==,type:str]
+    VPN_ENDPOINT_IP: ENC[AES256_GCM,data:Z5CWT5izY6QSleq/7dw=,iv:XMlPatMEuDBM3UUQKXSbzAb05JEicXY5MZv6uwhE3YI=,tag:mud3Nvk6BQSDiv3LuW4JAA==,type:str]
+    VPN_ENDPOINT_PORT: ENC[AES256_GCM,data:1t9FZ4c=,iv:X2clyyWPltvcg/PkGmYIytnLvImUW8ohD4JTuDdJ3Uo=,tag:I1NGPoQ3B1B94bcUay9A3g==,type:str]
+    WIREGUARD_PUBLIC_KEY: ENC[AES256_GCM,data:FanrtxziYQNqPhA87rWbcTkK3EDKkmCFqtNIu9cTRtGdvNdbLfy0Qwf8v44=,iv:p4xgeWOPqW/5d0yNC4gJPlplAX6Owc2xPp77LPtRdPE=,tag:MJj2Nc50OV4odKwt+mEulA==,type:str]
+    WIREGUARD_PRIVATE_KEY: ENC[AES256_GCM,data:kDZdUyyhm2yeuAzbD5XLnJZsdbN0DoLDnWgrp5Y37B2GA4PIvYSjwpZp500=,iv:i8w0luzzCMei+5JUj+6z1R7/Giy1Du8HfZnFCYcYz2M=,tag:pv5YXdImhD36ppyW9ans3Q==,type:str]
+    WIREGUARD_ADDRESSES: ENC[AES256_GCM,data:u9I+AS0TVQu8d4Q=,iv:pLSLO8Esj3PBU1OiudEf1elKlPIYdtS0SJnUO/qpxog=,tag:GM/LS6Uv0MJeA60ro62AbA==,type:str]
+    VPN_PORT_FORWARDING: ENC[AES256_GCM,data:ftg=,iv:CUeC3ShYGR1S0rYlcBP8U56+gP7cmyZECQYSJY6P9qI=,tag:8lEIJWNz4Smthaw0qXw8sA==,type:str]
+    VPN_PORT_FORWARDING_PROVIDER: ENC[AES256_GCM,data:ZqyFgHgTAr1v,iv:zXwTtuGmvNHsOZ1YhfDNY6PUixTi3dFi/UcB9qTbWh4=,tag:JOAoXu275uhyeVIdhJxJfw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2023-12-13T23:08:56Z"
+    mac: ENC[AES256_GCM,data:QDqeaz24ZbRSzQVBaaa2TgEudwtf076ZL+bKSliagZ5IKGTmXB1Diy3hGwqBZGz9VSAU8KtBYC4VgpnAFSWywy7G+lYtwrwmkTW7smqUSlfVOWcaHYEODORFSj1krxEzeUKR2ykwjtNz+4eAp9M8kTL7gc78k5As1gsrcS72hTk=,iv:84D0QpusZCtQ5xJx5lWljtxVFrvZLH9pwboXX0tOKhI=,tag:B9PAuWsIjtl76bwdepIiXA==,type:str]
+    pgp:
+        - created_at: "2023-12-13T23:08:56Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAzKleRwoSoixAQ//XM/Pha1wEbtFtiWrTNL33Q3TqtpFOsNmWZ574SSmgEfC
+            OlfdK1anH0kx6b8Jy02eJ61ZzGyqM1svuvGTxHqfZ92rIm+3tPfNCtLgSydlud76
+            vy6AXVHZkgSrwtj8xUXf7cmHDVIVxzFlassOWq1OEAsLay71IJcYAd9ImuMTSGUh
+            riBNap7rcMctbiHkomnswQxmMza10KXclXUE7HoOrdMK1+Zxpqhj+fS6Y5WOlRoa
+            VAuYP+Tg1nOkjC27rB68aFEGfbcXRvuNSpuflusDFicIwNUZ5LPLZF483VD4LEi9
+            VZETRpRGTmJ9ZFa6+QstHmY2Ky+/2Yrxd9YUURBoGglGlelbIn+vA8RQlqcCth7Y
+            wqFOPNFJf0Ljduioz5jCmcK/eQRuquJKcKX91+XeJ3pNYK86ywcn7JrsKX4cUCWM
+            ZY2+A8xdtpQxA9RQdObIV5DQEFBTnw+4RpVj8qP1kQvKg/7rvmU8mVyFec321BF/
+            vZ4iVfwPuLbvXNsLl2yeD8pP3DlqemxKQrP/sNfRqqTq1sn6rr8xYk+fE+Vw8fHu
+            OUKPNvr9hWrxAxeHmXu1vmJP9HtXjJor9Qnpa4puiQRrUtlHfOWRthmXdfoGbWlt
+            VDM5kj+Kp3OSSmL3Kpb7BUugXrl3qLEs/KB4jIx7Z1UzRKiUIidg3FfNjs6PaKjU
+            aAEJAhB1FKIv1m7toY6rMQ58gdoDXmnuTN92B3fNplAy8GfzYT67mV2Fr7ogVgqL
+            hShXltEayPTRwpHWv7aHSEo2LscIy7THEbYVsWvbEdILLtIvIfpMQwufRG4H/+oy
+            Htp1z9DAxjUg
+            =sjhc
+            -----END PGP MESSAGE-----
+          fp: 2CC2B3631D5C3393901335DB68F95C5D753EE1E5
+        - created_at: "2023-12-13T23:08:56Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMAy5t8IMoPu4VAQ//UXW9kQwk+9tl6yC0BPHlOGyusDQySQThnq6aHtF0lLTh
+            d57Ngz2d/4yV3ADCuDteT9NKqBpnFD5yndD01RfpfrC/LVIIUk3I0StDg1Rwb6/w
+            Q/cfSUX0hJ0qSmR/Bd/zOVPBvGnNSQgu9h73pbjuRwqBYIjV557JB6kq68aAJbi8
+            JvClBjwmdW8r/oraiCLbUXWPF8VHBPwSn210QPML0lRjN7rGtkR88hg+0OKgm9fw
+            Hq51Hr6KvWCh0j6xa70TdHGmahVEqb0l/2LV3yw2WpS5G0A2aL2EWMECdPjS84eI
+            8hK6oNF5sg5D3JwJd74FX+fXQxsRwzZO0B1Pf6Ea6ZYLkVb9wbDKDU30V+LxprLJ
+            Y9WGnLeOoDZVYqMCgEVkzrdRo9LC3UeKQ7yMwXpMHPbNUVv5v9VUjpCfpAf4FNpl
+            nTo1AYV5+Tqvb7XRMraIRR9AzaZ91HQAO/w23vpJCMB+jdcr5UgxhN0apqOAcZlt
+            igpDnj0wRxa6GpHr6TkPx+YRRDoOzlCinot++udmFMsprz4MSz8KM8oiRsD9eM6X
+            QIAR+n8MoyWAVNFGbnTEZqdkfI0VoTRg09BpryB36IEpxBpAq5fcL/w+dL34JROT
+            n/pF7DyKfgtnbUQt6GIQO62Ld2F/Rtg2HkFt3qOw+YuEPnPBLVrtjlrUJbInWsbU
+            aAEJAhB8OvYpr/HfGIZ5wIgG5MsdZ0bWXUOm8kXLnQKu6iNG2Y6ocKGKjzr7ILg5
+            KBneXE+mIO+FkAmvuIcZZAHzaHgYAGxoet4qtVVF0JIz6FF2AMdpqf8ed+f1HIvm
+            WqW5nFqKsDXZ
+            =tLH9
+            -----END PGP MESSAGE-----
+          fp: 687802D4DFD8AA82EA55666CF7DADAC782D7663D
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1

cluster/apps/download/qbittorrent/updateip-job.yaml

@@ -37,13 +37,12 @@ metadata:
   name: updateip-job
   namespace: download
 spec:
-  # every 45 minutes
+  # 0am every day
-  schedule: "0 * * * *"
+  schedule: "0 0 * * *"
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 2
   jobTemplate:
     spec:
-      activeDeadlineSeconds: 60
       template:
         spec:
           serviceAccountName: updateip-sa

cluster/apps/download/qbittorrent/updateip-script.yaml

@@ -9,7 +9,7 @@ data:
     echo 'getting pod name'
     POD_NAME=$(kubectl get pods -n download  --selector "app.kubernetes.io/name=qbittorrent" --output=jsonpath={.items..metadata.name})
     echo $POD_NAME
-    OUTPUT=$(kubectl exec -it $POD_NAME -c app -n download -- /bin/bash -c 'MAM_ID=$(cat /etc/tokens/mam-id); curl -i -c /etc/mam.cookies -b "mam_id=$MAM_ID" https://t.myanonamouse.net/json/dynamicSeedbox.php')
+    OUTPUT=$(kubectl exec -it $POD_NAME -n download -- /bin/bash -c 'MAM_ID=$(cat /etc/tokens/mam-id); curl -i -c /etc/mam.cookies -b "mam_id=$MAM_ID" https://t.myanonamouse.net/json/dynamicSeedbox.php')
     echo $OUTPUT
     if [[ $OUTPUT == *"Success\":true"* ]]; then
       echo "Success"

cluster/apps/download/radarr/helm-release.yaml

@@ -0,0 +1,120 @@
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: radarr
+  namespace: download
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.3.x
+      sourceRef:
+        kind: HelmRepository
+        name: bjws-charts
+        namespace: flux-system
+
+  values:
+    image:
+      repository: ghcr.io/onedr0p/radarr-develop
+      tag: "4.7.3.7731"
+
+    # Metrics sidecar
+    sidecars:
+      exportarr:
+        image: ghcr.io/onedr0p/exportarr:v1.5.3
+        args:
+        - radarr
+        ports:
+        - name: metrics
+          containerPort: 9000
+        env:
+        - name: URL
+          value: "http://localhost"
+        - name: CONFIG
+          value: "/config/config.xml"
+        - name: PORT
+          value: 9000
+        - name: ENABLE_ADDITIONAL_METRICS
+          value: "true"
+        - name: ENABLE_UNKNOWN_QUEUE_ITEMS
+          value: "true"
+        volumeMounts:
+        - name: config
+          mountPath: /config
+          readOnly: true
+      
+    env:
+      TZ: America/New_York
+
+    service:
+      main:
+        labels:
+          app: radarr-service
+
+        ports:
+          http:
+            port: 7878
+
+          metrics:
+            enabled: true
+            port: 9000
+            protocol: HTTP
+
+    probes:
+      liveness:
+        enabled: false
+#        custom: true
+#        spec:
+#          httpGet:
+#            path: /ping
+#            port: 7878
+#          initialDelaySeconds: 10
+#          periodSeconds: 10
+#          timeoutSeconds: 3
+#          failureThreshold: 3
+      startup:
+        enabled: false
+
+    ingress:
+      main:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-production
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.middlewares: traefik-authentik@kubernetescrd
+        hosts:
+          - host: &host "radarr.${SECRET_NEW_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+            secretName: wildcard-main-tls
+
+    persistence:
+      config:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Kubernetes/radarr
+        mountPath: /config
+      storage:
+        enabled: true
+        type: hostPath
+        hostPath: /mnt/MainPool/Media
+        mountPath: /storage
+
+    podSecurityContext:
+      runAsNonRoot: true
+      runAsUser: 10000
+      runAsGroup: 10000
+      fsGroup: 10000
+      fsGroupChangePolicy: OnRootMismatch
+
+    resources:
+      requests:
+        cpu: 1m
+        memory: 350Mi
+      limits:
+        memory: 1500Mi

cluster/apps/download/radarr/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- ./victoria-pv.yaml
 - ./helm-release.yaml
-- ./dashboard.yaml
+- ./radarr-exportarr-metrics.yaml

cluster/apps/download/readarr/audiobook-helm.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: readarr-audiobooks
@@ -17,13 +17,13 @@ spec:
   values:
     image:
       repository: ghcr.io/onedr0p/readarr-develop
-      tag: "0.3.32.2587"
+      tag: "0.3.0.2091"
       pullPolicy: Always
 
     # Metrics sidecar
     sidecars:
       exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.0.1
+        image: ghcr.io/onedr0p/exportarr:v1.5.3
         args:
         - readarr
         ports:
@@ -92,6 +92,7 @@ spec:
         tls:
           - hosts:
               - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config:

cluster/apps/download/readarr/ebook-helm.yaml

@@ -1,4 +1,4 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: readarr-ebooks
@@ -17,13 +17,13 @@ spec:
   values:
     image:
       repository: ghcr.io/onedr0p/readarr-develop
-      tag: "0.3.32.2587"
+      tag: "0.3.0.2091"
       pullPolicy: Always
 
     # Metrics sidecar
     sidecars:
       exportarr:
-        image: ghcr.io/onedr0p/exportarr:v2.0.1
+        image: ghcr.io/onedr0p/exportarr:v1.5.3
         args:
         - readarr
         ports:
@@ -92,6 +92,7 @@ spec:
         tls:
           - hosts:
               - *host
+            secretName: wildcard-main-tls
 
     persistence:
       config: