feat: Add holyarrs and use LDAP for jellyfin

Charts:
- kube-prometheus-stack 91.8.2 -> 92.3.0
- traefik 41.6.0 -> 41.7.1
- loki 18.13.7 -> 18.15.1
- alloy 1.13.0 -> 1.13.1
- sealed-secrets 2.19.1 -> 2.20.0
- cert-manager v1.21.1 -> v1.21.2
- cloudnative-pg 0.29.0 -> 0.29.1
- garage-ui 0.12.1 -> 0.13.0

Images:
- argo-cd v3.5.2 -> v3.5.5
- jellyfin 12.0 -> 12.2
- qbittorrent 5.2.3_v2.0.15-ls478 -> 5.2.4_v2.0.15-ls480
- busybox (garage init) 1.37.0 -> 1.38.0

README.md

@@ -0,0 +1,40 @@
+# gitops
+
+Argo CD manifests for a single-node k3s cluster.
+
+## Node configuration
+
+These live on the node, not in this repo, so reapply them when rebuilding it.
+
+### k3s
+
+The bundled Traefik is replaced by the Argo CD-managed one, which is exposed
+via `externalIPs` rather than ServiceLB. Control-plane metrics endpoints are
+exposed for Prometheus:
+
+```yaml
+# /etc/rancher/k3s/config.yaml
+disable:
+  - traefik
+  - servicelb
+kube-controller-manager-arg:
+  - bind-address=0.0.0.0
+kube-scheduler-arg:
+  - bind-address=0.0.0.0
+kube-proxy-arg:
+  - metrics-bind-address=0.0.0.0
+```
+
+### Image garbage collection
+
+Kubelet only prunes images once the disk crosses 85%, so unused images pile up
+on a large disk. Also expire images that haven't been used in 7 days:
+
+```yaml
+# /var/lib/rancher/k3s/agent/etc/kubelet.conf.d/50-image-gc.conf
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+imageMaximumGCAge: 168h
+```
+
+Apply with `sudo systemctl restart k3s`.

add-ons/argocd-dashboard/oidc-sealedsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-oidc
+  namespace: argocd
+spec:
+  encryptedData:
+    clientSecret: AgBqp25ilSAdFoj5LmPESSi/5Gq/Cai4vmZs1czKXmohOAMq7HIRO+fLWn+wU5B7R44s0kQ2Xw1ohF2hzTVljsK31PIdYNLbblfxYduKIJLCW1Um3/fCyYC6WSAFlZnaEn1iGghvR468Bsh8KT3OFIx3R6L5fu1dJ3t7JYE557GtkLbD7EWD70q57itUa+2OdL+1XdvSXOrqSVYjBcFdbxTRTUtvh8LR9J0Mg+uRYsk17UInfCqT3FRQtwRGQMQs+UX/4AuKzyTjw60w2lcfIsm/SBGvG/72FENUt46XGALoXmj3h4DaZBCH0j2LHWi3c+1psKTEXner5jw00Xa3eNOBKoDwIoEOIyGjIrhLf60d9Gm9Fp1weqcf8JTJdO3sXd4RXleUT+2zsu4vIeIXShXgCC/dz03kSXpPcM4/4XG/hWfu7Xgffc72Erdqbwj2SFpksVTQp1mWrhVu01qB45AwcaySpUovdYEm4DWhq7eB91sk8zhmHCNaDosnOlSjd1UD63L9Rg4y+objdVNEKODhFueSWh/Lb2wDQIxq3dR8Apy0cqSmrJ8QrJV8eAtsupHfn7Hg2zTvIM4jnKV8zQ+Jiut+Kpb+pC8jlcJPRfp6k3lpUjP9t95q+T8CVfvCMyEw8u0w9OUpGhozUMbW/BlP6tsWaJWKLnocIROxYPh3Rf4UtJ8Ol3qEW3Wkc+i6FyrIUlEGkQAad7USrADTx14Ge/XfZ6KO+Yt3FgyS8884u9dH8egkcEYZbHiZweAAd552JwIZn8gj7oUPxq8UQtNK
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/part-of: argocd
+      name: argocd-oidc
+      namespace: argocd

add-ons/argocd-image-updater/ghcr-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: ghcr-pull
+  namespace: argocd
+spec:
+  encryptedData:
+    .dockerconfigjson: AgCRsZSHP+T0U4pLck8AJ++dCb47OklXOgediZXPUSENy2/W/o4ooDgr+vP9GmSMoSm/5FBahmiSF8WYth0TYL4bdTKMQfnFO4kAOxk5QXuyyaKL+ZxL3XFfKRUeVD4m+HFJrvUsHC36TeJy0SYwkaS5isWdNTPFPdNRhXQ9OiTKQlL2tPZgOzk48CH5wDCugI3uC6/1tuzoeNzbIWRFpbkDtwhdGBqnZIiZZhOliXBV5wGnEcPKpxBnE21PNBsr2A8/lisuTsmcsyZDj3uenLjcdITdTs57sss8HPEI9u+cIuNFCZVO/URtJEV1k24oEr3CAPJojic6vT6jS0Ow9H3VEJpEObAN4E02+yC/gZjkLOBSO9aq77SzVRJpTxmcuW4s2U91hegYzS33H0jBCB1EJ5y/rYZUFrdBQnr16gENbMo8HuYf0jnogDvyGjd4Kf4HWDl97yiOv2xdm7Jb3MBrgyCQSw2uU4QpvgwGpTCo8j3LrfqQjBZRyTn/HplLO+zGkQKcqsNosZ0a+fm990gDWEgBuNjf/2iVLsYMJrz8da3Fu4k2TTtzxtAZ0eFJbxa97CRC3d/4nx/vS/S3zTzoXhp2XHdlG3RfurrKKtxeretRlTtbTM8CjahMB0/oLgBKSaNs5gEtvaATKe8jBfAw+WHxCFJC+0Jxj8IfDq0KWv2I1OO2r+7TK+o2Ed/7SucJQd4e4NQJfWQW/xiq4RL3StJdO3WXcICloslTMtE9EaZn/w/dx98bLRus9mrkom+tPSHw63tHPn6C4B75Ya8qA5LSBylMEZXg8CG5xfqmR3C0F/c4XCYerfbzNg88AIw2VBsAgW6aySCkZCa9rkaCx5AyzblCVQxGZ+PpR0RdaBkuT2hXoWHBZZu9Dmhk6Qr1HyqCBaV2DmsYFcYB+pfHUKzT0BAWO7BdbiLFil0V779JZw==
+  template:
+    metadata:
+      name: ghcr-pull
+      namespace: argocd
+    type: kubernetes.io/dockerconfigjson

add-ons/argocd-image-updater/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ghcr-sealedsecret.yaml
+  - pixelos-applications.yaml
+  - redoost.yaml

add-ons/argocd-image-updater/pixelos-applications.yaml

@@ -0,0 +1,16 @@
+apiVersion: argocd-image-updater.argoproj.io/v1alpha1
+kind: ImageUpdater
+metadata:
+  name: pixelos-applications
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  applicationRefs:
+    - namePattern: pixelos-applications
+      images:
+        - alias: app
+          imageName: ghcr.io/pixelos-ci/applications:latest
+          commonUpdateSettings:
+            updateStrategy: digest
+            pullSecret: pullsecret:argocd/ghcr-pull

add-ons/argocd-image-updater/redoost.yaml

@@ -0,0 +1,27 @@
+apiVersion: argocd-image-updater.argoproj.io/v1alpha1
+kind: ImageUpdater
+metadata:
+  name: redoost
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  applicationRefs:
+    - namePattern: redoost
+      images:
+        - alias: api
+          imageName: ghcr.io/whyredfire/redoost-api:latest
+          commonUpdateSettings:
+            updateStrategy: digest
+          manifestTargets:
+            helm:
+              name: api.image.repository
+              tag: api.image.tag
+        - alias: frontend
+          imageName: ghcr.io/whyredfire/redoost-frontend:latest
+          commonUpdateSettings:
+            updateStrategy: digest
+          manifestTargets:
+            helm:
+              name: frontend.image.repository
+              tag: frontend.image.tag

add-ons/authentik/blueprint-argocd.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-argocd
+  namespace: authentik
+data:
+  argocd.yaml: |
+    version: 1
+    metadata:
+      name: ArgoCD
+    entries:
+      - model: authentik_providers_oauth2.oauth2provider
+        id: argocd-provider
+        identifiers:
+          name: argocd
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: public
+          client_id: argocd
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://argo.whyredfire.dev/auth/callback
+            - matching_mode: strict
+              url: https://argo.whyredfire.dev/pkce/verify
+            - matching_mode: strict
+              url: http://localhost:8085/auth/callback
+            - matching_mode: strict
+              url: argocd://auth/callback
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        id: argocd
+        identifiers:
+          slug: argocd
+        attrs:
+          name: ArgoCD
+          provider: !KeyOf argocd-provider
+          meta_launch_url: https://argo.whyredfire.dev
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf argocd
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-garage-ui.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-garage-ui
+  namespace: authentik
+data:
+  garage-ui.yaml: |
+    version: 1
+    metadata:
+      name: Garage UI
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: garage-ui-provider
+        identifiers:
+          name: garage-ui
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://garage.whyredfire.dev
+      - model: authentik_core.application
+        id: garage-ui
+        identifiers:
+          slug: garage-ui
+        attrs:
+          name: Garage UI
+          provider: !KeyOf garage-ui-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf garage-ui
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-google-login.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: authentik-blueprints
+  name: blueprint-google-login
   namespace: authentik
 data:
   google-login.yaml: |

add-ons/authentik/blueprint-grafana.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-grafana
+  namespace: authentik
+data:
+  grafana.yaml: |
+    version: 1
+    metadata:
+      name: Grafana
+    entries:
+      - model: authentik_providers_oauth2.oauth2provider
+        id: grafana-provider
+        identifiers:
+          name: grafana
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_id: grafana
+          client_secret: !Env GRAFANA_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://grafana.whyredfire.dev/login/generic_oauth
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        identifiers:
+          slug: grafana
+        attrs:
+          name: Grafana
+          provider: !KeyOf grafana-provider
+          meta_launch_url: https://grafana.whyredfire.dev

add-ons/authentik/blueprint-jellyfin-ldap.yaml

@@ -0,0 +1,116 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-jellyfin-ldap
+  namespace: authentik
+data:
+  jellyfin-ldap.yaml: |
+    version: 1
+    metadata:
+      name: Jellyfin LDAP
+    entries:
+      - model: authentik_stages_password.passwordstage
+        id: ldap-password
+        identifiers:
+          name: ldap-authentication-password
+        attrs:
+          backends:
+            - authentik.core.auth.InbuiltBackend
+            - authentik.core.auth.TokenBackend
+      - model: authentik_stages_identification.identificationstage
+        id: ldap-identification
+        identifiers:
+          name: ldap-authentication-identification
+        attrs:
+          user_fields:
+            - username
+          password_stage: !KeyOf ldap-password
+      - model: authentik_stages_user_login.userloginstage
+        id: ldap-login
+        identifiers:
+          name: ldap-authentication-login
+      - model: authentik_flows.flow
+        id: ldap-flow
+        identifiers:
+          slug: ldap-authentication
+        attrs:
+          designation: authentication
+          name: LDAP bind
+          title: LDAP bind
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf ldap-identification
+          target: !KeyOf ldap-flow
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 30
+          stage: !KeyOf ldap-login
+          target: !KeyOf ldap-flow
+      - model: authentik_core.user
+        id: ldap-jellyfin
+        identifiers:
+          username: ldap-jellyfin
+        attrs:
+          name: Jellyfin LDAP bind
+          password: !Env JELLYFIN_LDAP_PASSWORD
+      - model: authentik_providers_ldap.ldapprovider
+        id: jellyfin-ldap-provider
+        identifiers:
+          name: jellyfin-ldap
+        attrs:
+          authorization_flow: !KeyOf ldap-flow
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
+          base_dn: dc=ldap,dc=goauthentik,dc=io
+          certificate: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          bind_mode: direct
+          search_mode: direct
+          mfa_support: false # else ";" in a password is read as a TOTP separator
+        permissions:
+          - permission: authentik_providers_ldap.search_full_directory
+            user: !KeyOf ldap-jellyfin
+      - model: authentik_core.application
+        id: jellyfin-ldap
+        identifiers:
+          slug: jellyfin-ldap
+        attrs:
+          name: Jellyfin LDAP
+          provider: !KeyOf jellyfin-ldap-provider
+          policy_engine_mode: any
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf jellyfin-ldap
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 10
+          target: !KeyOf jellyfin-ldap
+        attrs:
+          user: !KeyOf ldap-jellyfin
+      - model: authentik_outposts.outpost
+        identifiers:
+          name: ldap
+        attrs:
+          type: ldap
+          service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, Local Kubernetes Cluster]]
+          providers:
+            - !KeyOf jellyfin-ldap-provider
+          config:
+            authentik_host: http://authentik-server.authentik.svc.cluster.local
+      - model: authentik_core.user
+        identifiers:
+          username: whyredfire
+        attrs:
+          attributes:
+            jellyfinUsername: karan
+      - model: authentik_core.token
+        identifiers:
+          identifier: jellyfin-whyredfire
+        attrs:
+          user: !Find [authentik_core.user, [username, whyredfire]]
+          intent: app_password
+          key: !Env JELLYFIN_APP_PASSWORD
+          expiring: false
+          description: Jellyfin

add-ons/authentik/blueprint-outpost.yaml

@@ -0,0 +1,34 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-outpost
+  namespace: authentik
+data:
+  outpost.yaml: |
+    version: 1
+    metadata:
+      name: Embedded outpost
+    entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-garage-ui/garage-ui.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-pgweb/pgweb.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-qbittorrent/qbittorrent.yaml
+          required: true
+      - model: authentik_outposts.outpost
+        identifiers:
+          managed: goauthentik.io/outposts/embedded
+        attrs:
+          providers:
+            - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
+            - !Find [authentik_providers_proxy.proxyprovider, [name, pgweb]]
+            - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]

add-ons/authentik/blueprint-pgweb.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-pgweb
+  namespace: authentik
+data:
+  pgweb.yaml: |
+    version: 1
+    metadata:
+      name: pgweb
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: pgweb-provider
+        identifiers:
+          name: pgweb
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://pgweb.whyredfire.dev
+      - model: authentik_core.application
+        id: pgweb
+        identifiers:
+          slug: pgweb
+        attrs:
+          name: pgweb
+          provider: !KeyOf pgweb-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf pgweb
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-qbittorrent.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-qbittorrent
+  namespace: authentik
+data:
+  qbittorrent.yaml: |
+    version: 1
+    metadata:
+      name: qBittorrent
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: qbittorrent-provider
+        identifiers:
+          name: qbittorrent
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://qbit.whyredfire.dev
+      - model: authentik_core.application
+        id: qbittorrent
+        identifiers:
+          slug: qbittorrent
+        attrs:
+          name: qBittorrent
+          provider: !KeyOf qbittorrent-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf qbittorrent
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-wireguard-admin.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-wireguard-admin
+  namespace: authentik
+data:
+  wireguard-admin.yaml: |
+    version: 1
+    metadata:
+      name: WireGuard admin
+    entries:
+      # wg-easy requires email_verified, which the default mapping sends as false.
+      - model: authentik_providers_oauth2.scopemapping
+        id: verified-email
+        identifiers:
+          name: wireguard-admin email
+        attrs:
+          scope_name: email
+          expression: |
+            return {
+                "email": request.user.email,
+                "email_verified": True,
+            }
+      - model: authentik_providers_oauth2.oauth2provider
+        id: wireguard-admin-provider
+        identifiers:
+          name: wireguard-admin
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_id: wireguard-admin
+          client_secret: !Env WIREGUARD_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !KeyOf verified-email
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        id: wireguard-admin
+        identifiers:
+          slug: wireguard-admin
+        attrs:
+          name: WireGuard Admin
+          provider: !KeyOf wireguard-admin-provider
+          meta_launch_url: https://wg-admin.whyredfire.dev
+      # wg-easy makes every user an admin.
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf wireguard-admin
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - blueprint-argocd.yaml
+  - blueprint-garage-ui.yaml
+  - blueprint-google-login.yaml
+  - blueprint-grafana.yaml
+  - blueprint-jellyfin-ldap.yaml
+  - blueprint-outpost.yaml
+  - blueprint-pgweb.yaml
+  - blueprint-qbittorrent.yaml
+  - blueprint-wireguard-admin.yaml
+  - httproute.yaml
+  - referencegrant.yaml
+  - networkpolicy.yaml

add-ons/authentik/networkpolicy.yaml

@@ -0,0 +1,57 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: authentik
+  namespace: authentik
+spec:
+  egress:
+    - to:
+        - podSelector: {}
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 5432
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: postgres
+          podSelector:
+            matchLabels:
+              cnpg.io/cluster: postgres
+    - ports:
+        - port: 6443
+          protocol: TCP
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - podSelector: {}
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 9000
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+  policyTypes:
+    - Ingress
+    - Egress

add-ons/authentik/referencegrant.yaml

@@ -8,6 +8,9 @@ spec:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: pgweb
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: qbit

add-ons/authentik/sealed-secret.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: authentik-secrets
+  namespace: authentik
+spec:
+  encryptedData:
+    AUTHENTIK_BOOTSTRAP_PASSWORD: AgCdmFtQtxaSvL+ggv8kdkufOxVEhBOPMWEKmv0k6LpakDZdXDKBEdcb4bj8eYSbAePTpoPbSraV0GxMxw/D+Xm9o0JbbXqW+G9MfxDTJDE8n1eFkw/bRjq2gIZq/MNRH0ORBMpviQeAFnzt2gfcvu3Fua2RIQji1JHR67d6xTtzGTIunyte7UFh1OIDr9JWE+6mfjKVuebbWq1qUXq5ScrWf0UYjJ/qHJiMjM7NZeEq8v9D9uYZoXoZj5Ew6BRP+UWGZOgoulxgJys5mdAo4k6NMYapT8vEyyyOmzDlBYPG0KucQgiVHBwW8UaBvRQ3WES/xYgD44fwSIiLwtFsU0rCfDQXUMlbA05wvcy8u0Fq8v8xKCWZhpWpxKzaLHRIFL9QKfRmil60nvwYferjVRtfObdY28hU+/vh/LDJ6NMj5d5APgQ/1/otX/XQ48Ezrmo2nZqhqdbFKlJq9eSukcfB5KARvKrY7tvFmGr8tyqqqn2eAeDlcy8ivNomF9sIqYKVadtv4UlO/SjwTM0UEUyN2tIGTWBGWI6kDWKFjUtjsJTmMSTKFvTHyd24sUa8QskZgGLqMmF1z+Z8upVK3qgo5EKjFvvT9MekVZp+gj0eD9dZreEs8QeScw0+Oxl+ksrp6bJWXwh/A05/QSkPQm7A1Fx7KoVRdo2PVEJun7Jk4HuOrYXG+EAvDE0A66psM1XntLPdUlHbdt15a9JxMrTc4LI3ARw9TFDi9tL89G1JMQdBJGi63AOuOtLPVXm96zI=
+    AUTHENTIK_POSTGRESQL__PASSWORD: AgAlxWe8VpLJ9qzrJJqIBbWgctSdBBjx8HUXVqLQtZx1zWURks7YsB8RGdBYO/o/aQ42Q3EI/YLGiNdvm+7M+Bmbmg4GoXTxNujgfg8W4BZ46Z2g1sq/4mJhj3Bx/fiRAL8QaqJNbSiSmGoCRXuwseuiqDSrEn69ly/Y+wRlV22ZyPqa4vU/cesOFVYu6EAWKhS/6Af5TrsxEVwFPQUmOpsMGTxHV4GSkbYiXAjq9Rr2JkgtmISDiSGTFB6QcITF5QzdaAKaDym1ol/j2VLAXACgesVvUs3cFtRCprusXctUtNZdURriytUn7UusbeB+7YeG4hJohgGRZne83OkPd2RyYj2XyS2t7G5vV83WDFFBsOkvXQDGlnfSgAovyTX8hpUbwvWq2nkpRm+NhJYyryXR9QRZcnUdf4LZgSwDWasy1nUwTuOs2W6YIsdN3yV+BLq+yC77vDRrdlNbibc54EycuwDPzMnqazlGoPrxO53li/qGJN4v+et1cfevk3dXguYrOH7E2Kmqh0nAjp3mojoPfG+1RTzwRoiMjaLxEbtkLWzq/gBJTsVdWtTq1CpfEVT47Todc44lDmtk64OQffxQbq+ryaR6q7V8bRynsTYPJVFi0+VD5mjdmWz5IDDP5+fCMb6xZD6oTqgVoFV3zWSAj05J87Ok/lR99xCU0WqxYrF6o+3Bvg5i9D7flAw8nrFmuNc7G7SXgcQu2QIHfOikVXL6WScJl1Ycu9v38KvtZep5XjzGgHQ2SvfkulhaSlU=
+    AUTHENTIK_SECRET_KEY: AgDZtbDVvUGwkMw+uBUv7CyPd1lNrh23svotEiD9v+8gDaJlE6P4r1qLijYn1dqH063RdmmW3wndlohM/MjAXzSJbdRX3hv5Dk6Rd2fJKZdOiGuHFNRTLXsVwe1k0JwyweOzdBYcjHnfvSwEpI1ahFEtsmA9QhJ1HOpMxoMyA6oBWGkcjdO888wrL7EkMTYeAtwtIdnqA45X4Zqi7hhRdtZjhWBZ0d3pel1105DAxd1vyiK1mALvXhfFI3ixKYyU3Mb9q8O6KXHrv4JqOW/Zz9OQVpf0/yVRxv2xkYFvgaj66xW0KcA5rVp68NSDEGE1O4a/W2B09n1vtb5ZRml2597j0/36/wYkl9Q87jFEBkXi2xfDUTBHlm2ik8DwcOK6f54j2sHmWJMywPHsBYBvxVdRFQMxXXETQJWaas5ToL78HzFLsL3uuoez7umFMXtta3Dg3t6AqC3NwbWqicKgU8zJVPWNJAoLr9wrmJBOBLXgMHGnowLAkfNJNwQIAu2SaQwLpOZEfTkyKc+HBm6/rM++IpvCg1KJXGoUPbAq7qt97t8d0ev2JdHs3kMU8G5PnNfE+nf/6limWxp29Z/vXdMZ0JHWk+ivCia9yrdP0IXEqvSAuewEniKY+nYWlPZpJwX6kNpVcSK7DTIVzv+l9vcSPrLnkjwuzmnd+Sv4lA0cYkwh0uZ+00FF/0RVCEj8OP/c840bINdsSX13BXkaeeA2InZFWvC5PrjNKY9RIb1k2Hyo2EGS1ZTuIUNMFN/XORlBC2IdT0Tld1LpmKL8GuW+2SLJUJRwv23SmmAFWhPljg==
+    GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM=
+    GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ==
+    GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA==
+    JELLYFIN_APP_PASSWORD: AgCzqHmMF80Bh4OcOl0OStJb/zQk0BKzCjIblpELwMLsAuBtIOO0OK/IYrjlCO0T8Vn9jd00LQI1m7R5d+vCxcwbQVNhyw1zHDFg1MI28irvdJmp7439Si7R/T+gObB1I2Vww8d9OZJj5Zm9ngQoM+Oh5ne7c/+W7Qc9xgpWBDtcseCX5QDA1Uu4TJH1cShDQMPb3+KLq7MlKgoWw5uJZA/dJspdR1eqFyaXGHh+rceMZmzwG8sNz43KtVWKN0u7KrN+OE9RYdreQGCw09Yet8FwYA4+z4pAFbOIhyCfqdEW0uWA95f9PA27Z7GgO/CG2vonv73V7nvItIArPchdzdMwD+/UimLllH70tPB6GfZqMsU4FnwdhAyl/UhVO4/PILNZFyyku3SfWtIc2GAf8w0i7KB/zSZoo+HdrGsG8i5020XOG9lIqH/vNTeU4zPBWROEtCKzPjmewBdR2CmGtDu4RrN3XHK5sljwXU3o5QucrD9k8RZ+TjQh6dk/cp373xB1ywMAF9+NmFalnIy4RXJSvjh2H5NLrFFty2vxLqsrVNYdlc8UjNOB06pCnugMBBCx9UIc92ntfoMCmdK7EsUguYB7KWbygbBMfVZ/PusWNMFpmqca5LzcQnoYVKtExRzfofftws9yd0zyQ1MnrEHAC28GlJjYKoIfP/8Tkvah68w9dIoiJ2cIgwkU41JiJ9tjRDIYdvIDBZUPKl3gDF6hbb1K+XbjrEHP5FAZ3Dul0uts2BxRbxBi
+    JELLYFIN_LDAP_PASSWORD: AgAmgR2Br9bWrqKtnUmcbicWUqVPcgVGLOgTkEhiC5rQPr2W/VXQDecb5ErIfl7XmvhyjMh/4lVymaUntpvD7tYGh0F5IeFTe9NVGL1ssanH7YqY4vQAfDdgQYOWUzl4cC5Lo79bUQcNk31YuJkqDlEiHXWv8W7u0L7X3ijbMvFcgkMwPgZuHPAwJGB9Uok2odtAeSCIQDZ/ri+TfSAqD4rBqKbvueP1o+bkNXN8qai1obvTtPH7NrTy4Qi0JAGQUu43RtTzjxoSaqr3Xq7Z9l+HvYJTxqRUhrNkME378OvNqcH6ob0J6siFyiMJnzfGw2BzhzJ11Y9PEVnzL8c3fC/VtF7bErhid/x9OzFf4qBs9ba1S/710P5BB1cqI8MmqGvc1vIHeH/J8AyWkbWGPqLdsqLZ4k5lcwDJ67R6RwMQIivc2oaUQJnBU2IEzT+EydAyzSMO/Obfc32UFuk64B0IigsXKii274r1tAxa3Ua8lvpi1rQkqhx6Fe8Nwkvxe116gLjWKqBiJ6dTPMuwvt3OkRjMpKBs9AH9V8t90lWqO4cBGd1kZYKTcAHyQkIM8XqIiOuwyzjuW8Kxjl7skT9DuV+X6GLWoUnZNpo16Vu4OUigWb7uuNuMcp1bI7fX0U0CR1H58h1dAUfLRGP06tOK8xakrmmsC/QCu8ErC2broAPOWKLsFQVRafiSjRcvQ7z2OcN/JHLAPeJUJcFVhdTJSpVQa41KW3MX9uFO8oXLLyQSrFFrKF7Y
+    WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti
+  template:
+    metadata:
+      name: authentik-secrets
+      namespace: authentik

add-ons/cert-manager/cloudflare-api-token-sealed-secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgAdOsht6DLr8etz8DyU3JJVzoinxnldvBWzS/GBJWzDvAUKw5O0Lu8JpPEZTVMj97uKs16YZsiDCwODBZSD2PJZUAmKwcaWFgCSqBjnWsaCgsEW4Fo9i/SnovgzIPRsc8Q0BOaGZ/85j2hsHHX9lGQZdzLvPFqtR8oU3gCQyFPOJnOFwegUUavf/OzbCsaSd5+g8RZdB5tGdoScw0rlpV2rMff3IqBvAG/drLj4zcjq1vviC0XF5E79rKu2wLPmVVXfLxt/hpO431OCxLyoBJ/2drb16hqUv0yrFVykllfnVu2YxMg7Tzu0m0F6QHEaIu3FTyTQyhX5iG6a0hjYjlmUY3wkenm6V+bc9/Z2w45cYkXwyjumjTzjGvofIjf4pV8F0jYlYcobnY0w8cfij5yLo6WcMuYWImxF7j+94cmANVgFhZkhevSpwFE7uP9x8KakTGHd12NTNvJE8n1hYy7vS7giJGy8TSKPoFr6B2793m532aVR4EeIF2BfU4zENrcr6w5zWQRvmh/UPYj0fd61kefIRorjt6Xt0ydwzgEE7ggxFYN/6Pbn8ZNOwQvGIppHVZCzH2IGh147Pmg/U7RQsPzWRVshhlr4sY1cBA1PGsdOODuGuvtVTR2EJ/AoL79X8stMXOxhv0/bzRiAhHS0sg4H0xp5z5x8g/xSva6KY0o6IKgBEbGDuIa1L39VNu/5TeP/+68ln76zJiWlO6W3Ksl4jwk+ALLCo2U7OXqTk/4HJygn10mLnlvF+YlfIfvq1a/61g==
+  template:
+    metadata:
+      name: cloudflare-api-token
+      namespace: cert-manager
+    type: Opaque

add-ons/cnpg/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - networkpolicy.yaml

add-ons/cnpg/networkpolicy.yaml

@@ -0,0 +1,41 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: cnpg
+  namespace: cnpg-system
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 6443
+          protocol: TCP
+    - ports:
+        - port: 8000
+          protocol: TCP
+      to:
+        - namespaceSelector: {}
+          podSelector:
+            matchExpressions:
+              - key: cnpg.io/cluster
+                operator: Exists
+  ingress:
+    - ports:
+        - port: 9443
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: cloudnative-pg
+  policyTypes:
+    - Ingress
+    - Egress

add-ons/kube-prometheus-stack/grafana-admin-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-admin
+  namespace: monitoring
+spec:
+  encryptedData:
+    admin-password: AgDHA/P0QjtI0wgwOJTWOtRf49kKuqmX6sMCB4Vsk8LpGhFMYWgP8pnXxTAbV50qTnqVdY7GQfsabcWWaYDV7FTH3oRtAHbV+gplabbhlxIF3o+lwunkGcObbex9PrCI/9/qX4DL/wOVLTftlOKHzyX2+ajGnufDMuF3n4axiKAJNGiKiuawQIhksV4EgaGPtAhiInQUte5BylwlKIciTl6eiTDus3B+DVW0ubsX5VPVKRnJj2jKKM1woc+F3/+aSVKDzavjX2zKrptltWUgaY+KPIwuEsYB+kzy9JwtgD189NdGR+3f4zQNJ3pX+p9WzfhocyXdEiFAGPdqaPP0E4mMSd8WPpmdsCiFGN6aeu8vJJQOONyC/Bm63em+BJk1AaGWm1XgwC+GauUdkqAHNiva+XQpqIEBI20ddHJBN8HyS1xZajg2JI3Mxukfph0WjPoQ9kqhAkFjIfoIv1uvusL7fDAXhmAyp0s23f67WTzXB1ZWEyRGbgPZIoC0eHztILRIngUuC3L14/aTOhiTxcnX4VVUAJyXy1tM+NM3KCL6T7pQX81VnFerfzW+VeIzSpIU7AIaXuBf60d47j88Ff7Zm2qp257L0ov+sMY8jp33v8Vx4oB20h2bqdGbCdt4NWeD0hCBAU26vaFVuiUmZZuNuLNQqsCABa7cE86+BlRCVG0KXgylrFMNjE1IvgHj+LbazAWFQ0kSKpXKyD/AT0bX3ZNUQlL/U9jDMSuNTzYCjMe/znsQ
+    admin-user: AgB0Uxo17KMXzvE/IbxYE9M6xDN30OXhQ66hD+MD1fUmNriResa+iGpCknByxOWDtccojz6abbVTJBw/ACjWGWDcmuafrRmkXcy6/l7gcirb/TVubUlyurecr9n1Iqna2Ip4/5IhEnBuVzx2e5xe5r0npRmWI0qeFN795OO6++2I3rZUR8lUMpywTs6oyGSKKQ/9qOCaN+bARIvja4fxGw6mzPNkIHS7MAOsiUElNft8fmT+JufSfQ0npvxgimvsQCFyfxQjWwZwX+LLKSesPAcDD6iXQvaR51NCfwpfRptfom/99QeIXjv0OyBysQUWfZyYNx3I8VKOEWXLSvCafCQVJV/tuHkWob1hVZcaSRZxJolnSZQ3mQ4hgYxfr9QZp3D4rQMgpzvqsJ/EwShwWEFqrOy353X5PNvJhQTB005FGky9yumYpiJjtAyX1QWeM9wBedZfKYUi7YLV9YXiXk91n13nQxfJ/HRRZFvqnCYtTXFRfX8PGbYF6aaW2nop3xcaDZ932y9fZQ9Q6AlasKUm+qCfkfl6dUOfVHftJRLpvm/60GLw5ylz9XTHS1EEPJAPpty8YExuxYWdHn5RoCbRHjKyQWxckKjFG6qZ7LcQpQuitSqwzcCqE04n/naWLoKJpMJhI0Ecs1hYai7LCFKNqZJm9HqncaeZ9SZAd4jquKOoVIJAJMyGDdzLQFkuq/7Z75y9fQ==
+  template:
+    metadata:
+      name: grafana-admin
+      namespace: monitoring

add-ons/kube-prometheus-stack/grafana-db-sealedsecret.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-db
+  namespace: monitoring
+spec:
+  encryptedData:
+    password: AgAGsDkcxjB3fakl0/pOZF/ej8gxCo7BUac0LJxfRR106PA4V9n2otOAiyVhmN45sNE2pscm2vDJdHtv5fWaR7AyZLaBk3dSn8at5vFh6Zgx20KLXWXGUrPaJLD07fuvNI4fgmFqEHnWsYUiO35mBfr01s6gTJPPr+y9b9LUzAA+WCuJERNwt+hFwmRDkI8rUvwr2Jy3TGKAJFJCXK1vkPtsGvIi8zHONlo+DI1uEH5qFECzScjXy4zEwKd54VoZtmS9F+QCJhXeGxy28v00jYCjPuIN0vhbzlJbLxDfYRskOuIxU88LWbGd9CDse0ZQvNW0i4cZbhL4Xsr/rCYeQfVMjc9eC//h5hsF7FPtKp589/lnC2jnpSYUfAz6sORY5elmg9QgB7yin6ItOCkVTBLZ3KPicOzu9oVLks5oTb1h2ndyNn3ltThPUo3RQpqOlq70HVpeB5cnn1Vdlty7/DJ8EtQSpVl1Zh26xTSsK1BLabs/sEVKRT7D1qyFtUT7aZDD1e63giFJIZzOiO6i3gaeTlLUyUmj5XlwfI0sTlTVIn0v4af1d/rgIUWqHYw/LMxYAF/x1M8LIRwtFjpWDYH4QuB2Keu0vMcTiErL+OGfM06izLntIzdoNM96TEj1dpLOHBxAh6cGNj6K22AzXfaToDcSpdO/yVzQPuzIWwr/joiEakUHCAKF+wQbI5vtO2suZTadSlo4T5M5clrIDkRTht5d2p4DNBaSG18N0T0yoic5RqQyUbOdSkepyWbWJuiluOXi5/X0gRG1DUBtNkWR
+  template:
+    metadata:
+      name: grafana-db
+      namespace: monitoring

add-ons/kube-prometheus-stack/grafana-oidc-sealedsecret.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-oidc
+  namespace: monitoring
+spec:
+  encryptedData:
+    client-secret: AgDYt08vksKi/llySruExrqYKajxYNy6qlSze2pUy88XZOftNv/HEQrsoe5pcDK1fTBDgrPQhQgbX3mjD7I9psSVFrA6/tw19MQZK9QjyClz/92rGOf/iW7sqKJJ/rUYydPyPva48DwTvg/peGmUDleodE1bfogKrHfz36fJdop37KeTi8k0UZoyNQK0o/FayliyJzp9oX6rlJoa26szmQ0JP9/akBd2JTAruNw1JbOdmFx8GpIGU3Bl8uvbcDQwZ4LuGxn1hOiPutXuA5NTS8xrC7GnLBPMtAvg8etZr5JL6ZLh/cGPGyN7tWpjqrJ4Y9hyR+ryapZh4I6/uRrRG8BpqXILUri0T2CB7/VSFrRka2b3CWtrlUiaCYDK4d5UF1I3K9x7WnK9rWNDMx9hxOQ+4hL6wFhX9k3nfDH9yJ7C8+4u4jTJVOfE01HbR5d2ZBfvP8sEO8sAePgD84ViRVcAAZ2LmW9aPrMdNhlQXf1ODDOnj4FaXP+yZIEq+fqsiyQtLDNBsIwDDJgCv4l7ac6NQKbpN2rfEfs4UFk5g8Jj3TfvpXieFe4+VuUyAwy/7npvxuAn50xrcjAo/m6cyEgJ76oyK2tdHM44m5CX+MwMhNIVU1Mmuq4oZ98pRXx0f1xptcwcXiFV2Eor5lKmNx4mDaYDDgbFrPGJ8w9k6gnDsYUnxP5LfAhpcwFxQcSyhj2XdbSnP+mZio59W0+adGQoksNuZjF72COME7ijNREsAmUJ6d9EKffQsH8zf3rHb03vzNWVzofgOKDTHyfNy6bdiZgezxGjNdcgFixdU1Fqjw==
+  template:
+    metadata:
+      name: grafana-oidc
+      namespace: monitoring

add-ons/kube-prometheus-stack/httproute.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  hostnames:
+    - grafana.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: kube-prometheus-stack-grafana
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

add-ons/kube-prometheus-stack/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - grafana-admin-sealedsecret.yaml
+  - grafana-db-sealedsecret.yaml
+  - grafana-oidc-sealedsecret.yaml
+  - httproute.yaml

add-ons/loki/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - s3-sealedsecret.yaml

add-ons/loki/s3-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: loki-s3
+  namespace: monitoring
+spec:
+  encryptedData:
+    LOKI_S3_ACCESS_KEY_ID: AgCy95N0v+X9sAZ6eLZ1dT4x/TZbZdJdKDBdoB1EB0XD69KtjRnTIp6fnK7fWhJK8LBQMinvses1ZT8zxjXoYtP+eP/UMF3A5BPKp3GtwWqgGLWWcDEdRIPryf4isovw/5JRV7EoaS2GOqmXrGmzqW3S5B0CkGBBfp4vE22ClkONw0lh8RQorAHnHAQ5oBjdnUwcudKkqzCUpymZsLEU19TFx1xuHrI1b9pPBDUZKJc5sRQeJpMh0TOmP6G21SHvoVpfGb91nX7rFqt5uCxwXp00rWTJQDLmrBHITTzw/regKbtDz/hnow/Rmw9VvrKeh0olIxUjDwPfRFLalu2OKmV1oa60ta99Q5OExqQKKIWjOyOHovBAtpTP6q6z0/mMg/O0qoj+PyW6OJ8Ojkf7zYJAEyDil66ijALwXQd6bARjnePcrrmNCFcHVDIKRgraO4ZJDkPdfekKdCY9nepxGGdYDbFcl+CgieiKp5C+DQ2MAurAiWVIy07gfc0EwTneTIZa6gJsL1extnD1QMxF+Q51q6v4raTyvydMg7q2fcJNWs9E8c3buVJ+xbyuTGdotqaEgKgL9h7AGPznuXLBEv3jsZ0DZzooaXQr9e2eSOaj1Wdj9fBTkTDwtcCQOkWVTzQv0jdRzHkyadKaCkSLEy+wFvyoCmm90I1v41kUNAKb+OfErQF2oneR/kFvCRR63fHkrqeLlpfYX0yu6yWOKhDHN7WsQ6wd2s76PA==
+    LOKI_S3_SECRET_ACCESS_KEY: AgCR6N449J9uv9ZIb1CCZzlEMIgmnnWWGiYqDj5awSzun/j7nnU5CiqY0Q7YNUztKI2y/0TQAHdrS9Q46d3c27ZIiCwDJGK69w6Bcc8XPotzFZl7htRvc792CZtx9OShqLYrltoGvmNCLB1AY5wnxTJPQJ7p8Xat9GJA7CgRHerwhfhtuT3vKGRVOkjpQ5tRDaIYGQO8o7Tj2eaIn/dBwMgCVlfd2x2XLS7RzV8F+DTQ+94jpS7h+zJGsnEqH4nEO40OaD87ZTn8CnHlw9H9TL9shu8dNVULYK3j5Z9vHHPjBQ5oiTBdwtayJ0lBDOjimlMMYXiJhczsoR8PwYG7TNL/OZZIF8uMvuZX7lFLa/15W99XhLZSKoTbtYNT2HAzWNLM29unor3eDBebwZGyVu8VzQVECtU1/6EGnY0enMpldxUhJnVq3YmifZ74lktIcLy9g96lIYvJs10OrMZqMf7ANr74T6tLj+kDvlTS7AZF+27m5bK7Da3Uj15qvLsxox5XYsTfZa82Kz9XM67/Dif5PdGz3LCkVJHKBpSbAwoy54NqaIIlRrl08J947o7AR7M6T+L+kbU8JTREH0bbnAIgFvkBZow0LvL0rNB6I0A5aSO9jrMnb04I876Tf2JyRX0pLhtovo+253I3kQf8X9S49suYcJeTdATKtIMC2sE5wb23AdFeHLZz603HobieozAm7X5sDCaXQSROHUMPF2+f2sRifTxcryPP9YhpBZvm7zuqFDSjfQI3dtLrl8I7/Ohbn3J6whP6rgSqKBQaLS+s
+  template:
+    metadata:
+      name: loki-s3
+      namespace: monitoring

add-ons/postgres/authentik-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: authentik-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgDLpRHzrgu7ZjiHPa6Ryk1SJ7/hWlN50lKj6vwUP8IXWhsqKD75eniNRVEkogcsL4bxoL+xD5PK+A9p3MQe7gLlBlH0EJd0f5J3tSN+scxFpYxwjR8Dma1+sIlC2l87rD276Vr9rqXNe9x83ooJ6nHSDPGMidEryUzNUNzcObjG53BgQRW39ZzjHIlju3wt6iRcAxalfRC3v2mTPJyYaiz+He9ipO6LCJ/sv/po4QloASghBUK4zUGHyn8UCQzDuhQ3nnYZCyFG4T4ey8XWL53pFopTzWpRn+4g0yQXI+qvb28kfy4L8QvNgRhIzoWYMLQVswVVvzRE2y3nrkWRhG3Z4FgJSfGuOOR6obXboWNA008d4Q0In58O7lTxh+cwDNzGRY9WrWmFhx9ib1b2O729I+Vu1aTUa7IkaYg5BpMLuUjEiY6DfVZW+OvvQYPd6+a3mhitjk+NwVGZBdR20lW3bz35SY63yLfDrA1bBex2iq4jLGXEBlJz+loAU+yko1zua2RYC/tgfJpyU9NrSy+9ti59I8e0+I4o9YkJ2VmVtcoFd6L0ZOmdayw4r6hDtB+EHW6Wz0vnIrwx3fxMjSaXEvtNjZOVeKVvm9Cv2qJqTJGcRfiUeSbqEXtti1tlwupTe3bBXfotV1MqjmsAUJehhdfwYscvdmo60XMKJheyoAfB3LQw+uAg6CLtmfe78W9IUK23ofFfgtiQwp2/3gXmmp4XPAEctwXe//SaZWbVTdl5bKEiNvrrqGEI0zdcWfU=
+    username: AgDRt25giEz0pQQNgaKjvHh7pM5PKgp+LasT7uBRtkjdzvPVgjnmYjo5EIGMv16VGk1AzxoHk/gI+ERlVGACzrOoi7n5LoTwqmnbcw/AcsBB2TM18KdFKzMjJFZ7S65+lC2y1jt2fOaiTdlQ/OzU251x9NSiHPnLBw3K14M8kD6Yyq93kN2q78o9gD06KjXWGmbnADH1H9gJSCwSJmLMS9WWri0Mr86l/JgMwVCdEoDKOFwlqQWWr8SAm1P/5q61TyIOPjjUe1AMFMSZTFezFuchf6NBieztHN/JW5nmPWSc43aH5u1zjjaTJu2qk3ipSN5BBCkoKZ9boW/wqy4AriRJfitq8LxIObAFgkJMHG5RTjtxU8j2z8oKHll9UxO0yRSIkdhBI3h6iJAqDmi75bH+RIfdx1kiT3g+nkXsmR5/ptBORyNejppeSYsh/jptdJNtzjmBlGlORtLX9Ah8I3Hj/gr6x++GjwphYZLlwjVa1S7vSnWwpdGKP/0RwBNMFeqf8PerN/tp519b96toja9QyA0y0lJzh9XmMcfOUKYamg2i31tn+4ab1GOGlMGeck/MQ+3G4skJmEiCMvxQjGSOuNjL9W1DnSvjPsK8pNnJ5ndUCQatu1a04psQ0dJK/jVluwuIm34u3lOmisWEoTzb9Y2PYUavIpkPt5be0qmCh9+r5xdL+gBLccGdVdrB4zQ7caW26Lp76WE=
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: authentik-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

add-ons/postgres/cluster.yaml

@@ -0,0 +1,49 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: postgres
+spec:
+  enablePDB: false
+  imageName: ghcr.io/cloudnative-pg/postgresql:18
+  instances: 1
+  managed:
+    roles:
+      - ensure: present
+        login: true
+        name: authentik
+        passwordSecret:
+          name: authentik-db
+      - ensure: present
+        login: true
+        name: grafana
+        passwordSecret:
+          name: grafana-db
+      - ensure: present
+        inRoles:
+          - pg_read_all_data
+        login: true
+        name: pgweb
+        passwordSecret:
+          name: pgweb-db
+      - ensure: present
+        login: true
+        name: redoost
+        passwordSecret:
+          name: redoost-db
+  postgresql:
+    # Each app role may only connect to its own database; pgweb to all but authentik.
+    pg_hba:
+      - host sameuser all all scram-sha-256
+      - host authentik pgweb all reject
+      - host all pgweb all scram-sha-256
+      - host all all all reject
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 1Gi
+    requests:
+      cpu: 100m
+      memory: 256Mi
+  storage:
+    size: 5Gi

add-ons/postgres/grafana-database.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: grafana
+  namespace: postgres
+spec:
+  cluster:
+    name: postgres
+  databaseReclaimPolicy: retain
+  name: grafana
+  owner: grafana

add-ons/postgres/grafana-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgCS2VPTseFFkdtaDAjYv6+9M+s6ndiezfWjV+OyPTPurfHJxLFkUlPC8gnZkut9gRhz1jsakP91an0aFEZTWHlM/amvSkomUWbwxKw6l9Co1U0IjK6PUPWKkQtLA++vFaL40u8yHFMbMLkND3oLPqNadcCGl+cmLgmSq5VgEayaClx4MPlhSBFYBvpJJ3B/CkK2odnXYO1aSeBIKPQFIlbiooSWjBA0CzJ9gQQFSnEVkDqHfkd3nEVHaziCdhpOCDyH6twQlafMqUjIbVKPJ2yd2dZSJZRLh6t6FY5EHhTh6PIbniRJ3ZtX2uTaZJ/tJF2af3QfRMUJ6go4r+16IKM/Q1ZrOcJfa7Zz+9RoC4d9dkl30hysr88WX2+GHx1E+beEd0v0Kv5IR8CZlbRyQV+DYDgwjFD9ALE37EMhpkCyb1qi1ulhl+8LIXLB08nedbIqqvPrmjUd3+y1EpuATeCgIsaVeACxBN2iUJ+JjVOFE/umnSgEGVctSIQSl4kZz/SFpS1Ygy0yrVOSmt9rtvPaWSWlg8yN4TTli1OKCJreyLDVSXV+/Pf+3UoN8p/SR7r1cC3jb4KBy61O/7jovMgO3XuhYHtUyJdrgp0h3DS116yBtFVomGKhCRMriLXb7VG9zD/spgYpmikPMrMABm9OPaLOBiKMEz+VN8Nd7cXZ1/us6kV77lSUInZV4osall09avYn8NaTN93hIS6J/Xb81b7yuH6Au6p13Zf6dkefEF6vu/g3m0eP3ZlgIkroF1rNe6IrkzxA0U9dDvrr3ayB
+    username: AgB1nXmxGuR6ObktViN4tvpH9W5B2HdzDVAwd4dtv0nBSGkS4NXA5B65BzF8NpWRVcnbS5hr6H0KfnAWHguDGL3/pEU6fdam3At8F+2i0oXSH9Pt+C2SxEcH2ecRHK+7VqNgJhd8j9i89G8DQGAgFjWj9UpfOCwr65G7UrHkomdBgitSFQD0dXMPJ973ZSlRZOxECT8NKjmgMX/iHztBszIms/ACB6u4Yfg64nAZUta1/Ky95ZSb5ZgrqABE+GLgRIKngAhr4OlpiVZelsTz0ccjCU4bT6a4ZqiqkbDLS19nO2rOSMDsnxgqoVBRF1Bz4Ry4R3e3jpQx4xBQrV4x+FFCymEi1rpZ8KQCrRf88YD+A+jRsBGnsB79wcaq996zw2tQ3kZd743C7AM9ZzXiNuGVGlhXqld6IbvHzyh1F9X02+diPVFftAO9owPEiTBcZVscj6RREmkOGcYHLtjhCghzHR0iQZ1DvazqyPSyUuvKyyXcX5m1b0DzgONqEgdmHD+saZZbAacQakUdoOS1hGLGgExaXS1pLV20eSIpoAJls9WbRXCeAIfWbN2MV2y1BUUDvmIAkdkocQbthovl2NeOy1FYVZZSmS6jY4zv59PDXFx2HMcNsj8qzZu4gDlEfngY5L+L6Lqr0XQKN250gYEkuduYaPoftCiaThMKCc9eJkAlQ9GdvrQrW49wBcXnErvFVmfuNcWr
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: grafana-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

add-ons/postgres/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cluster.yaml
+  - authentik-db-sealedsecret.yaml
+  - authentik-database.yaml
+  - grafana-db-sealedsecret.yaml
+  - grafana-database.yaml
+  - pgweb-db-sealedsecret.yaml
+  - redoost-db-sealedsecret.yaml
+  - redoost-database.yaml
+  - networkpolicy.yaml

add-ons/postgres/networkpolicy.yaml

@@ -0,0 +1,72 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: postgres
+  namespace: postgres
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 6443
+          protocol: TCP
+    - to:
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: postgres
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: postgres
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cnpg-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: cloudnative-pg
+      ports:
+        - port: 8000
+          protocol: TCP
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: authentik
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: authentik
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: grafana
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: pgweb
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: pgweb
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: redoost
+      ports:
+        - port: 5432
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: postgres
+  policyTypes:
+    - Ingress
+    - Egress

add-ons/postgres/pgweb-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: pgweb-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgCCnUlPp1buEwCQDC/q1Fy8JHfi5QzuUCMoIXJoi5xgJewkI7ti0JctSrJJvdvS0QUm7se5s85tewKjsA1tIGrC8/nsSSeGbNmqRXS5BbGVdr6SIQhExTmVNdQqQwoyYtV8/ebW4ntt+HrIdgO16o6nsDb5lXblYguZps535SqwSN6vRLHhD3+Wg8SBjHZV11i/9w1nufy4KhgW5jlBhosKOaGVpgH33OQdsDMvkSF5FcljgeUm7R+R5sBYXh5VfPpEjsBB0zi8nDzSNS8aDVrQuv3aFeNnJ4vgBRV8a8/VclaMO9RqXgnl+HjHczbEau+x8AHZ19lLVXJ3rxi4itgOGXevVGEdHi+i+WJX3yfakGrleBneqkbY4VUuuu8T0l1wveLxRGBNwR39xl+wSZU8skDWoDh0Qdgcxpiez9Ewit3s9WE7SALtdUhVdwBdzZVctqZMVUeUDDBGYk5cyTZmRAMR0oBYAHSFD+C7+oyVjJsnZOp4sn/1q8vOOZzLeMu640tyopCChL1eIqbUxz+c0WsVXOQkIZFO2XErkLi0mpf9/rksRc8jWPZL3xTqcgQmGPujpm116K6nclf6urgghj+UW2KWilZRD2M1qXFEi4UdyDFPMs9bOMqymuk0zr8bM2+xJUvaC5AAByjFOEvwoqrXMp/55+4OhcEXkce482Ohl22EF9UznwegpxgcSvDVsdvA63nqkA6/ScYVf6vOJMV1IV3V/xrCmCfvrgzw7oOdfLMFF3DFlK7b2bcwdm7tJGnjIVxRKEk/Oac0hcmb
+    username: AgCrlxpjKHYriSWpb27Yy244lRX8YJFTWFxfT6Zpf/FG3nJ0BmcFRCzADbE9+E82Uugbsomv7Bx+GG3PbdzZGZJkxnGptLLIMIXbFlRr0W7cKFCWasmti8CW3KmVSp6YSZ/QR17GPmEkehFnmooK5DGhxZJcrK2+yFhN16JtCh/XGuXHVwVGMZMcVm8mKWcPKgH1yCfxQfFCk/xD8+3FySTKz1B/eyaUhaWncL8iCaMQgTd4G9YUomL0ykqwu6RzO/UkC7taq0dnvSg/XC6NDfZJ3juqdAw86RagJH3H41T41WM42ItXHCVy8XEAkJALZO8+caJC1Aa8kqvtPQh+5ParKpQK2CGGoIpcy8gicfWsGC2Ohtmoma0J37Ha/ur4BUuEbesnrvkYGDyf+j6rwJ1tA1Ff5w1POeySqRbpK8M7pEwLNTA3dNzhqBfY8sLdIwDx6W5ElBDz/481IzC1vKgNCaINjvCIvT4ZMHMVEwaAHxTyjv/On0Gi/U2m38Qnu+IxZXC/Zi1LPvFCCE3ieVHOKA4gyxooKIriORzxzxZbD7hvg+o4Dhkd6hxWRYfpIMZBQi6Ov7jHzY2VJroJ80wzsLXFLNwP4pEpSjcQsmus/ErLJGwHUeWYASo5cVmBdrbtQEDWGSFm2pi1FSCLnC/7/eWsPJqqS0tHCT35+Iabgk0EbXEPHgE3ShR7b3j/+qwhACLktg==
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: pgweb-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

add-ons/postgres/redoost-database.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: redoost
+  namespace: postgres
+spec:
+  cluster:
+    name: postgres
+  databaseReclaimPolicy: retain
+  name: redoost
+  owner: redoost

add-ons/postgres/redoost-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgABXpIKEczwyJR1ZLvcmtcQluGi0ACDO3SCC+D2OfaSxpUF0ZtmE0b5ngq2HmYj7GPMZ3vAEaJ42oXDgEiS8Teq9ACxmCIo7XMeA5X2w6w7RCmhgQdx7N3G+nL0fO5l49URckk8xDZVFCSo4wjbtmjQrdes5CbMlImtG11byFAyjs5lBAN9niJZ2tnJqJhpEvI9/6St0AlVjhsRhwvaV0zlVBtKFcBvSKemcBHkTA2gPBeJ3xmizuc4NsJHhCriiOAhJ+IA19eBzvN/bmfSxdJb2F1LdSQxlLDstnuO/dJDKkvIul6TrWwtqRbCI5tM3K0lHbGeeDmIRVPmsK99Kw3FAoSSKIZ0u3FTXqMF5mi9+abJAxHgD/JYn0Ecx/09Hp4lUwEWK3RIqmbfq6ose3YcSRULJeksSIQtGsOmkE0LxZkQV1F15lOAWL9QhYTDXZbD2JTnkc06SLSk2THpl9o0+F4ZNI+TpLHGASIH8nu95qVh3u7odwjaqe5Czh/njIGw7zuh718hLQtXi7P4soAj46Db2Gw9ZjSw412LGfU3ETDjeIeA4wQXhp78HtEn/vsDRMgx9EQH/726Y3BehdEzpx3g95zBvyT2T04UPc+J+K0zwp3c4rLmkyqxlXOq8NW2p1huQsdk8QTMojCep73k8VSzKpq9i2I9ktWTPJbiXP1KpLA8q0J6awgFD3c1IjYoeeOptfz0kR5oTQa8syTdlj4QVYrxopWqGhK7Cn2G4zwc1Gv1F2sO+KL7/KUe+Z/vp4kICKdL6JfQbUJf4WAU
+    username: AgB7DGwIppwLvtb61d9cn/FnzC9bwAdhvk0XR2BTiO4EaA9py79Y55Y0pmSmdi167MCfsQNBZEYHV/pD1RncdzHbMV+rKs1Y9Q8ghFUcuTaXC03tkYfZX/JnwdKAaqhyMqGkycyFWsVip7i2uoodJ2M0QhuD3L6dgXeq6rFQhrc5GjL/7bWiKcYY6X82qbYToJCHAHzmZ6lXcRwGqtV9TcC72CtHgP6vsBTaTZLadptxh9xI89SiLej/9m2D1lhSshJ6K90BTeaLVqeR19hP/VCOltnQfeV2GfJgBAfstTEnTHpqtGuPct+zo/IvbFnnjLmcNgVwzCerk6O25mgIuOQxkQp/gnoswnzMojPzwWnKsl5mrlrjkYRuGrFZjykB6th/xat/VarHyMJUpKlmNcealkWvy9TfHzCyQtCHW/fwHiWJ6W2/Cvf6ABBDl5kn0oj41l1Ekm8zxR7GCoucd/iAvizWJ8V9d4g/P28gBl7UI+WDFRkKcYATKZ2s6P60ORXj+aeYnoV0s64if+Er/fdbYXdSo7YiZVOtKy3nGIRsq9pl17QM1GXNmKNcpSE3SwKudEwIKcLSKZ8oCAn0gm2KwGGbJ6sRWu2+zysxgcoDnmpZje4SoO+xXLKDJ9NMCI1RBmDByk8IoNxn6efQXZesn1TQd0QqdjRF4+yXxPgpfzjK5TBEFx8ya8LMZWlhU2dxIQpJusV1
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: redoost-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

add-ons/traefik/kustomization.yaml

@@ -3,3 +3,5 @@ kind: Kustomization
 resources:
   - wildcard-whyredfire-dev.yaml
   - wildcard-whyredfire-dpdns-org.yaml
+  - wildcard-pixelos-net.yaml
+  - networkpolicy.yaml

add-ons/traefik/networkpolicy.yaml

@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 6443
+          protocol: TCP
+    - to:
+        - namespaceSelector: {}
+  ingress:
+    - from:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - port: 8000
+          protocol: TCP
+        - port: 8443
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+  policyTypes:
+    - Ingress
+    - Egress

add-ons/traefik/wildcard-pixelos-net.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-pixelos-net
+  namespace: traefik
+spec:
+  dnsNames:
+    - '*.pixelos.net'
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  privateKey:
+    rotationPolicy: Always
+  secretName: wildcard-pixelos-net

apps/bentopdf/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/bentopdf/networkpolicy.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bentopdf
+  namespace: bentopdf
+spec:
+  egress: []
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: bentopdf
+  policyTypes:
+    - Ingress
+    - Egress

apps/garage-ui/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - sealed-secret.yaml
   - middleware.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/garage-ui/networkpolicy.yaml

@@ -0,0 +1,40 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: garage-ui
+  namespace: garage
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 3903
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: garage
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: garage-ui
+  policyTypes:
+    - Ingress
+    - Egress

apps/garage-ui/sealed-secret.yaml

@@ -5,9 +5,9 @@ metadata:
   namespace: garage
 spec:
   encryptedData:
-    admin-password: AgCQeGAvd1QdDC8IUwNYqHJxRES1jfPbonYTyutCklms6tjebQw1pRKnbDWGRaFmgWg5jFRPYf6TAMRnZnA/1dKJMOrV9vGjqx++r+khWbe5oqvcoQInqVdbkfulHoP/Bf6jc2mj9znGqpW6E7e6Z94pwwYkpaY2CIYhfcs7PiaTh7HiFMmoNWlGmHBh+lIZ//WJblgpFdQRWR9j7CiIJOLC3OmAvGV+Uh5i15fdA9aTBLZaB1pWh/kqug/mmj6q5E3Bp7BlC7Pm20Dbyn85kfA9RjAM/AkWSycGcBgk+FaJKFVJnPzrHcx6CdkbUnczxGVrbs+C89pzCk8ysaOVSNDErW0rCWNaHrflRx6P1+OUamCWWafZdkWTGQ4m0I5pX5IQ40zIK1uE8Zzil8EJPynfs37fNzn54wVBmsaKpsFC/3y+d8UTVgf1shJF0cqPimWjCZPqvUZrimL/20tPhTSERaxtWSq14l39bQUc4sNZdaKc69IkI04geI9OPvE+XXQNYe86XPYlNJ/R5curg1RvQxAR59sb04RmZAfdSvcwYxpK1Ekchq/e9IK4ft6Ul70nE/oN43NE2Ck1+5/EOjucFmIQzZ49Jq2OIjHuBjA/p/BmwAhiZVwPObRJ0VoL9XDv7BVB+S/+RWnFjDW7J5YhWquZ2Y6XwspHhpjvHmH+LLSio/34VpWQgG/lSAhvSPuRkIp/XxhQwemti+3yQNeqfXtvpfKa1IgAg9ic/rbocQIUtQDaT4yYFi7cruTpx7U=
-    admin-token: AgDBYTHO2ZgJig+h3wIv1ru7VxEDKIq+SUjOygg39lVaF1bH0ADaWOdr1m6nP37LiBCyQSGtqilUGqXPV91VRiJJqFBXLTnYs0JbmXGekkfeImztAd7LL3yqKHThji/Bo+vD00PC3SAbpder2d6BJhOMez2XqFY2vPSY81earoiR+ajzuvHBC4PuwDjNYwnNq5BkGCF/D6EOenVfVJZdWHG4/oCciJzX+fwYQYw0sY8ur5cRxyY6wyWC2QH9YflDKbwFteiqnh8E1+B4mqSFiTcaM79FAU6rYxknXmw/BArNdbXvAxvYDyGKxQA1k6GwW9TWSg/CpKAmuJW2Xv1nMCqt3ZIJCTO/H1PIi24XouNBGc9n0VOWKNWZTI8CIZLRB+/LzLuT/vjhu4qA/LE6SkDXw1dTkgkkUChUKN4PrWfwTVIEgZwjPdewOZ9D9JT8TmPSZtGvVuDVOJl7+wBYGT4SkI9W2qU91h1VT+vmXO/7QyQ/kj2ny092GjT2aJTFAbtusAjV3dKZnfodXaCX/dQ3JnSuP2mWQGZ/2Gj5AB92FNvqeTkiqovS2hGgXjyOYp4JeXVPvBa1tWEo0Cy4FrqBLaycNIHuhGiWAhLrivXTX2YqyM3NfEmEuyzXu5M3E6eQhaF8uveDjqhxF1z07IUXU8zBCvHtC7vX2aYPfSKGWcpvGKa8NnkjamRY1qJbj1Jr15a9UBSM1TyWNGp3pxFHyy707FlayRDIdJOe0iYqQw/5qZQJBl1u4/1zbOldP3dPFtbGuhR257+wNWwKKfACorTsBg==
-    jwt-key.pem: AgBYRkRh01LSyyozE46odjgrHsZ6gI3ykVOdV7qMPEFt5lILq44BKFt3vVL+yAUz0brVPQeEjz7dg+xsurAKKMjvuxzkOqBsSFhWwBzy+f+GfTSZPBrBNPAX7jI05dUNbcu2UuxYMlgVq6VWa9lf0Gc8yvuEuD0nS2qmpj1ACL6awLBKnkVXL9c5mvoC97DRyk920rPTnERJGU5q7i+zue4sxufYJwJZAJLOmdpzavHfQ3lCcJr6FfboFmGnvD6SM85rXTtImyDY4tsXf4J1rRriYR1OQe91j4SSbvxDFskXYSQ4bTgjimat21SXLCImj/Pqh6LJz7wMd9aW95ju4jDE1q1og0ToIL0Nybl9ANhqlJgFtOfvQRnaJVQQw/2GitlDVejJHCYWsVsSxQtAhvrGdWDOrZ1eTzvsmBnGcWzDwtC1YN3u+Wd0qJBfoRIJLiinwLaJ7ponm5MSb9Qjkym99gXm6XUO0MlHS52pfVaai+OmyWE6B6nF9tf3YVXfjZcNVB1pFHCZZR6XcnIm+wi1EwxXR8NIeFgqiaIm+BwX9u6IMiQOHCVznHD5nc2wfSXpeeT75IX/HAzRWC2cc6a8vPsr+h4A4hqW+cOoMYb9gQQIa+F5X4LcWb6f/0HJHh1IO4vf+P2hVU/5CkpgGJk+x48KgkrX0CE+bafQQjNp8JTdis1gxSGEX0QUaVGl+x7exGhrKlW81ZZTovequibx1JhdNSXNbWZxQ2fXz7SdN+/AjYyEh1gNPI2Zx6RRJc5BlDSSt7TYwqy1NUcPfbJV7hbqV7oDUH8JrsoSk+xxB0WDE+Uh5P4MsQna6NWkWyFV4tvfK4QyMupQaxOAKOYV27DxBaTr
+    admin-password: AgDIy9i34wa9hD57pft2B8SmSmCF5UyksaOD5NyUovQhLwJqv6QuZoXOQ8dS2aCMK9B2jFw2oaycJPgW02HEsUiuaorifAz/wmjrU8yXtGTcxpqxQfS0+EUhefHtcWBYVcTc23qMpllJZLEr7+aR+sCF6jAq1CHeuSCdAOTkhjBTbFmcodIZWCspxrqoxF4NLBGKSdKIuWLekH8w8oJ1ymf/VUj/LizJIKZn7QoRpS5KYVBM2hzlXipUr1FWSjmCmolTPv/ICW6CYHtlOnEvYUTOnEAdmAx5DD2HocKs+OjBUuFgnYwj2XIyLOoVI+nrACrQSvmzXOUrKNI5y54DU2PNgAa1zetWfHk/Xv468bLQc9bSBFhSSNTrl3mi8Aa381mKJ5aRXLGa89fCqGWAyrzKle0yc1msg90jriJMh5kN026KHXw/yeqcrTCD9MdTMr51UusfhzkE6LSnKmXX0XQNjP4OLOKu7kFXj8xRox0W0CNbXyg4keQcWnWKF1LUgG3X2+1CIZNFex7S7OE8KYtxP4O7aqy1kRZvgVsUONafaIPB+k+Gosnw7ImEQ4Zu8L1ATqpeEioHoxeac+RhavXjte7UqSjIV6moxWrwrK2EMZPHhm2Kh+h8S3ROA/78Y58hFkEYQFnJQwwwByGctS0zLIOCybVm/lz8puohlZAcfzf+J++0R6sxkWZtIa4YWG2g6RuTjUoqcgHPwrRYmbvB3WmYu9/w+717HZob13QP9C4mpT7Zhposw44JuJMN7MA=
+    admin-token: AgAJHn+bv6P/JJVplonJWgc/vnqXRQSsaKlTnrEUmH+P72YqMPEbt/Ma9ptkWOewQNr6mceYHUpXQuhczuAmeebe0GS7jr1md+Clnap+8NMKHbhYSCX0/MwvV7JUcWfZ6xJcttPHbP6a8s6SToidDOohBtY6gkeuA+12AtGI0t6xugAcCwBKqZnAY2lacD1nEqyatUP2cGHXTMmaNzsyz3g9QvuhCPrOx6FeC7JjmC/JdwqyLHN/b/NvVdCZUmvNjsPaq0U7UK7UCbcWYbjxof2u/3QF+EFlNBrpb4DYipOVqtrY57IrfYbUNucd+e5X71Kjpg+iwR+IPyGXS8OGJQQsh1ytYeZLbHpaCpmm2HVU0JMZx7p25QSqwNzP81wjU1VKkw1WEZG4RW4eHS6/aISSBouG4g/IRo8E93nskfj6Ue0+feFv1k50l2L4ROYtEUwMaeaA7zpwr6tTei1fenJ86sa3HAIwgIdiV1qqp2TTWwpr4xFHlVYdYvb+igt7Q4h73FwvYt3kAMTmH5O2iatGZfo36pqTGOqrfBPu5p+agkuA97MSumqHKzqADSPyNz0BmqzV7DPvuKsKxaFYAiEbNjD5bCIyDUwNnQIucMUbHtEfLngN+yD79kZiwBY1xS7sf8QG5yOYi0U5Ra1f/AEKasPUEOsiphrypcTZ3GzVv6aIaF/AJPWZZGDT0S0kXIB6u19Lyl6V5NUEXImnpBI8gyoMflIiFB18qt0nX7CBbNdRcwHGzcCjy2nshkvhSRmW0OiWw3v4UkDu8YAaSZDRFGjKJQ==
+    jwt-key.pem: AgBLwseufpRTqJdLEFeRr4ZN4VihNmua9GMPEEm/iARbWgNqCl64QzvJGy6XWM+RdXkS4z5jrjMg2Z2AJDHvd8qnFpDPBd4peAYw03vaxxpkz/TNz2+9HO4Nultn2wA2bd3CfA43doSs1T49lksCKn33puYEh8q5BB9hMUgU8JFc1sEMKS7auWoPQlwAOnJ4Qi4ISQZZ/C2IPLVW1VUJfPTsAenJ7ZgqE42DFFmghDfaFEQb8BcMNDuQCU8BJSqC3BoSMiuxmtkurzk7aXegVOEBcbdmPEkKa0h63kuTJCHZth5mVz4NatpgO6EDovGahO2EJkuAY1fyDhL0EpUSf+XHyaTpsDa/M+qvPZvd6wjGLjIH2CV1bHkvqx2GjKqv4zPkki3ESlxan/qfh0uFcGG2a2bSezmFbibvXr6uvmKo7KcbZWevc2GYgmODRJRW4bl5MTp0YDKcxF4I2kFboJhnCG5aw8hfw7LLUdk9iCT89u7UV/cHafG9TpoxkpIHyZmKrZLLczAvkLdABFX+6UYbFG3N+kVlFUXe6K7Gt1LrMVievNDIlds0y4b1paXIsj855znXZO7+zLcmpJKEnmjOJ9wa6TLCsI3wdTzEoLQOO9HPgywGRo3lxNu9mbiYnRbjwpO1pXs8RNfQj0ERNwE/EZoE+51SkGAADvqeWG/fT4bHadKaTYWitiVwXOjKJeXjEm3BpQI6hNyLMO4J/JMTAGHdqNttv3yeu5FJWJ4MrYS/tyXUSVBTojU2599/soFPqDUn/1IClkOKrdG15ZJCedMB55qOPf1k51dvIbhUVBEQlDyRDGksqPItVf1tM/+RhuGrasRk58zVuY5qm9JQFReNiNZv
   template:
     metadata:
       name: garage-ui-secrets

apps/garage/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - httproute-s3.yaml
   - sealed-secret.yaml
   - service-admin.yaml
+  - networkpolicy.yaml

apps/garage/networkpolicy.yaml

@@ -0,0 +1,44 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: garage
+  namespace: garage
+spec:
+  egress: []
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: redoost
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: loki
+      ports:
+        - port: 3900
+          protocol: TCP
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: redoost
+      ports:
+        - port: 3902
+          protocol: TCP
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: garage-ui
+      ports:
+        - port: 3903
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: garage
+  policyTypes:
+    - Ingress
+    - Egress

apps/garage/sealed-secret.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: garage
 spec:
   encryptedData:
-    rpcSecret: AgDWvOoSUADQx+cExTUDmk6/BWR8a7U5HRGf+T38P24FrP4DJiKl3GJ3Ce9a3eF7SqO/1TXiaN80+c4NX0dMEmnaS8III2Zbaa7x/rOHP608Vh1z2Nnxly11X10okVy+Qym9O5/oA3cue2bu6K3eG8W38mn3hCA9kWC6g9OiAwjBTxJXYmsUFYbj69Iloo9moBBLEtztu8T9vYu8rGqcchKzzjnvcS91kiduq9rY9/ZvYC4zx469DgnV/di8cjGdU6JAtsoHwggDtCVf2hvkyOIHTyPM9Y/EVGCsOsIzhJnTdsyRGn4su3ruLmS8VqbKC22Q86pSHjwdlD5RoZJjYtMWr5Q5YAvFbnTH9/+d0r363BfxlNsVkINd5d2OwlPpagEQ9pg4oFnnk48tsVEoYz1RCy9x/bK3U4B0Jin6l0T2NJ3umXPriLxBQbODWVA9vcv6G1tQiiuOsbYCWigoxe3ACpuYQDV+XujfmEZr3pcIw0hwKXtUWHI079aUkICcMEbtE3gLc1dNVQpja1SimZOUlqf6pz3YLv6L1e2X+yR93p2rN6hc8IJh3KA8ZR1Ymbbq2LaOwdyla50uuhsOkE2TGDTGmf9NyXjGcUys5LgNpRruzXEm/KgUX4tP7iMjHu5HbnDe9oiv66qfuIORiR2P3lbOdx3s+XmPd/87afw6YHA896ccCRkGpGnFanbrR+Z7MRqCOZsSLnQd1JpjnWJJU/bzrSl4q+PUV1Bt+hvAf8wXUrDtES6MdpOKUe4XW8s3QbVHvCx1iOSzP+r59T4N
+    rpcSecret: AgB5qZc+lP+J11wyLaNSG++stokqfiu0KuX+FPIzO9WZIHsdNGoBlcCifn9jsbVxB5z9tbSlteSTS/hVLHvYWEGPK5MNdRZORG5lSGqf428+jmdCp4kXAQp80nBHsqsOpJeHJtuM3IlEEpHMfV18cXnz9Q3fOj7hcSBRb28XzdAdyEIr3ZG7ThPScXR0lQFwYe5/W4GikGQvLUHSn8DwZgsJesP4bJdHlHaifPYZMLFa4JSv0bcwrz5+WjsKWU3xa5wkHrMT05ihaK63n9vUOb4/AwPQHBL2BJfl95DlmoRAIvAqwlfA3d7N7Nekb9G8ZupUTnPRZBQ2+32JsHZ64B+nIR1/WC6+8U+2McTMJtORCidHbf0i0E6Q6ClpMeoGobtVy6z+rOkUF3Z9xW/WwS1hznb5LXRW1My/KPvo0pztyEipdTZFqRkq2teGf1pXvELORlA3yoE3K1JU3RgCmDWOD4sUbuacWhjG1127Zo+W3gnxudVbODJ+s/F7HLC+6IHlWBarTd9QbTHemD/8/iZpkqWmyg1oexowvzWlG6jWFsxBe+hMQ9vzFmPkYDsfzBNMeJohwhOxPG3h/aWkBw1FHqd5/VOY7R1t+BpCI9xanWKL9F/rOa5wH5wfOyLptLv057ZxCBCRZQNDeVsAaU+Z+odBYhGQxnsZIPly9L8vAnS5h68A1bnTHhyob4RuIaLoSTKGDHnNOvzIhclu5DSfr5cSkRxbRRFPD67KSpNhoU7NUnjJJE171yJZADI/f5XZPVfe/1mu7Y3epDExT/oD
   template:
     metadata:
       name: garage-secrets

apps/holyarrs/deployment.yaml

@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: holyarrs
+  namespace: holyarrs
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: holyarrs
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: holyarrs
+    spec:
+      containers:
+        - env:
+            - name: TZ
+              value: Etc/UTC
+            - name: HOLYARRS_ALLOWED_HOSTS
+              value: holyarrs.whyredfire.dev
+            # Traefik's pods
+            - name: HOLYARRS_TRUSTED_PROXIES
+              value: 10.42.0.0/16
+          image: holyarrs/holyarrs:1.0.9@sha256:3d941aa8a78d4474cc016a0d994b2531aa8692015aaad487cbdee136e8dd4226
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          name: holyarrs
+          ports:
+            - containerPort: 6262
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 192Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /config
+              name: config
+            # Same path as Jellyfin; one mount so imports hardlink instead of copy
+            - mountPath: /media
+              name: media
+      # Owner of /srv/media, same as qBittorrent
+      securityContext:
+        fsGroup: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: holyarrs-config
+        - hostPath:
+            path: /srv/media
+          name: media

apps/holyarrs/httproute.yaml

@@ -3,11 +3,11 @@ kind: HTTPRoute
 metadata:
   annotations:
     argocd.argoproj.io/sync-wave: "2"
-  name: splitpro
-  namespace: splitpro
+  name: holyarrs
+  namespace: holyarrs
 spec:
   hostnames:
-    - split.whyredfire.dev
+    - holyarrs.whyredfire.dev
   parentRefs:
     - kind: Gateway
       name: traefik-gateway
@@ -15,8 +15,8 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: splitpro
-          port: 3000
+        - name: holyarrs
+          port: 6262
       matches:
         - path:
             type: PathPrefix

apps/holyarrs/kustomization.yaml

@@ -1,9 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - sealed-secret.yaml
-  - cluster.yaml
   - pvc.yaml
   - deployment.yaml
   - service.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/holyarrs/networkpolicy.yaml

@@ -0,0 +1,62 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: holyarrs
+  namespace: holyarrs
+spec:
+  # Metadata and indexers are on the internet; in the cluster it only talks
+  # to Jellyfin and qBittorrent
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 8096
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: jellyfin
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: jellyfin
+    - ports:
+        - port: 8080
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: qbit
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: qbittorrent
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 6262
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: holyarrs
+  policyTypes:
+    - Ingress
+    - Egress

apps/holyarrs/pvc.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: splitpro-uploads
-  namespace: splitpro
+  name: holyarrs-config
+  namespace: holyarrs
 spec:
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 2Gi
+      storage: 1Gi

apps/holyarrs/service.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: splitpro
-  namespace: splitpro
+  name: holyarrs
+  namespace: holyarrs
 spec:
   ports:
     - name: http
-      port: 3000
+      port: 6262
       targetPort: http
   selector:
-    app.kubernetes.io/name: splitpro
+    app.kubernetes.io/name: holyarrs

apps/jellyfin/kustomization.yaml

@@ -3,3 +3,5 @@ kind: Kustomization
 resources:
   - httproute-local.yaml
   - httproute.yaml
+  - networkpolicy-holyarrs.yaml
+  - networkpolicy-ldap.yaml

apps/jellyfin/networkpolicy-holyarrs.yaml

@@ -0,0 +1,25 @@
+# Lets HolyArrs ask Jellyfin to rescan after imports and sign people in.
+# Adds to the chart's policy, which only admits traefik.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: jellyfin-from-holyarrs
+  namespace: jellyfin
+spec:
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: holyarrs
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: holyarrs
+      ports:
+        - port: 8096
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: jellyfin
+      app.kubernetes.io/instance: jellyfin
+  policyTypes:
+    - Ingress

apps/jellyfin/networkpolicy-ldap.yaml

@@ -0,0 +1,25 @@
+# Lets Jellyfin's LDAP plugin reach authentik's LDAP outpost (LDAPS).
+# Adds to the chart's policy, which keeps Jellyfin off the cluster network.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: jellyfin-to-ldap
+  namespace: jellyfin
+spec:
+  egress:
+    - ports:
+        - port: 6636
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: authentik
+          podSelector:
+            matchLabels:
+              goauthentik.io/outpost-name: ldap
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: jellyfin
+      app.kubernetes.io/instance: jellyfin
+  policyTypes:
+    - Egress

apps/pgweb/bookmark-grafana.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pgweb-bookmark-grafana
+  namespace: pgweb
+data:
+  grafana.toml: |
+    host = "postgres-rw.postgres.svc.cluster.local"
+    user = "pgweb"
+    passwordvar = "DATABASE_PASSWORD"
+    database = "grafana"
+    sslmode = "require"
+    readonly = true

apps/pgweb/bookmark-redoost.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pgweb-bookmark-redoost
+  namespace: pgweb
+data:
+  redoost.toml: |
+    host = "postgres-rw.postgres.svc.cluster.local"
+    user = "pgweb"
+    passwordvar = "DATABASE_PASSWORD"
+    database = "redoost"
+    sslmode = "require"
+    readonly = true

apps/pgweb/deployment.yaml

@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: pgweb
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: pgweb
+    spec:
+      containers:
+        - args:
+            - --bookmarks-dir=/bookmarks
+            - --bookmarks-only
+            - --no-ssh
+            - --readonly
+            - --skip-open
+          env:
+            - name: DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: pgweb
+          image: ghcr.io/whyredfire/pgweb:sha-2c734cc
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          name: pgweb
+          ports:
+            - containerPort: 8081
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /bookmarks
+              name: bookmarks
+              readOnly: true
+      securityContext:
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: bookmarks
+          projected:
+            sources:
+              - configMap:
+                  name: pgweb-bookmark-grafana
+              - configMap:
+                  name: pgweb-bookmark-redoost

apps/pgweb/httproute.yaml

@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: pgweb
+  namespace: pgweb
+spec:
+  hostnames:
+    - pgweb.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: authentik-server
+          namespace: authentik
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: pgweb
+          port: 8081
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/pgweb/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - bookmark-grafana.yaml
+  - bookmark-redoost.yaml
+  - deployment.yaml
+  - service.yaml
+  - networkpolicy.yaml
+  - middleware.yaml
+  - httproute.yaml

apps/pgweb/middleware.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: pgweb
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true

apps/pgweb/networkpolicy.yaml

@@ -0,0 +1,44 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  # Only traefik may reach pgweb, so authentik can't be bypassed.
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 5432
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: postgres
+          podSelector:
+            matchLabels:
+              cnpg.io/cluster: postgres
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8081
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: pgweb
+  policyTypes:
+    - Ingress
+    - Egress

apps/pgweb/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  encryptedData:
+    password: AgCCLx1xyP6tj0NnqQpB20SXNfb1k+Y2jL2U5JEz1UMR+bx7LXCGkFoWBGdvLBEO0gOtoYwcG2zQf89ukurqVx4V6Z7/22/0ERvOw1HiFrqnHh9B+1KhO/76iC2V+0a+2elCYrPuTUeV8MaBbleY8qPHqTVbx7P5umvtrvmI9YcLaROw/6FKmgwN75JYMWjeeAhrhW4knOgJKgZqXFcGUIqPeC08TBVvRfIfkxyahx1mS3Bi4Wu1GdYaaUOfyrhCUuyhhE9Fo/dAFVkshnJGRPpBvIjM/iFsR8LZYO+WuVE4HbX2Jf/re7jZMELs+PbliX4I4RUNUTo8P6J0GEMlpHXTzkpVvtRsSy6SZynEmr3u3rLFW6y7xvqx+fMNEIO366Vn6wkDMCakHroo7ZCCgMIhwTqtbIkJ1wLm89SzMXaAapR0ZPpF2W2t//XZ6XAPnAXuwW1aynLddHd/4q4H4GFJgH1igMtAU4Rdt69P7F6V2w/SgDR5kAXVzh9VOFdiWQ0cB00E9d19PpAIbEhx6SJ8zgout/RjYGZJyr+jLML97KqiSwaH7k6dH4JfezLeBnlknulbge7NRoL1QiN0h+rs/O66+lD37mlQV63mWDgbkqhzDIV7Q2ORRyj1PZ1mJ9arzNnWOGD3DpjO3IRVW95XEHqj4Q7FGZ5AOMHYG/Jh92LWqLmVjKG74omWf3gsFAdN6SojEf40TICFCaiPUpo7rwPCBialScmMBVDq9RJmlCjdXrIlEbBx5AxI/HR/oT2wrS9Z7slwN42jYq3T9f7A
+  template:
+    metadata:
+      name: pgweb
+      namespace: pgweb

apps/pgweb/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  ports:
+    - name: http
+      port: 8081
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: pgweb

apps/qbit/deployment.yaml

@@ -27,7 +27,7 @@ spec:
               value: "8080"
             - name: TORRENTING_PORT
               value: "6881"
-          image: lscr.io/linuxserver/qbittorrent:5.2.3_v2.0.15-ls478
+          image: lscr.io/linuxserver/qbittorrent:5.2.4_v2.0.15-ls480
           livenessProbe:
             httpGet:
               path: /
@@ -38,6 +38,13 @@ spec:
           ports:
             - containerPort: 8080
               name: http
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 2Gi
+            requests:
+              cpu: 50m
+              memory: 128Mi
           volumeMounts:
             - mountPath: /config
               name: config
@@ -104,6 +111,13 @@ spec:
             periodSeconds: 30
             timeoutSeconds: 10
           name: gluetun
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 96Mi
           restartPolicy: Always
           securityContext:
             capabilities:

apps/qbit/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - service.yaml
   - middleware.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/qbit/networkpolicy.yaml

@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+    # HolyArrs sends releases and follows downloads through the Web API
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: holyarrs
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: holyarrs
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: qbittorrent
+  policyTypes:
+    - Ingress
+    - Egress

apps/qbit/sealed-secret.yaml

@@ -5,12 +5,12 @@ metadata:
   namespace: qbit
 spec:
   encryptedData:
-    WIREGUARD_ADDRESSES: AgCUjKDTHlj+cDz5QmTdFrQ2uzgf2h7nHIB22Hiy8dNQoHPmpl42IS8pWMM3cC7/RQ620XX3Gvnjt7w3N+cRHsxZONCtBaocM/B4lBxgkrqoBuMISQ90oeqeL16ZWd6yDPmzgJLG0JfWPEuGkXsCkMHKg2cTQwZeIhoI0jiiUIKtY0q3YA19cSaf9gX0buQyu84hy6oi7Y2l0EXqwcbHJP2NEAWmxXuHF1nKtcSnAUlsHGCfomHLtSPoyoR0Ug3CER60oE18JIYmbt+iFL4Oalx4nKFoJbkD+dPLx/Do7kylySVqX5DAj1ivIQjyqZmcsyaigP01OU+poSM0D94mhMt8Dfi+ZOzDemoVDKtJlOYNfskk0hLdbLdGk6DzlONl7KBjduzbSk7BnFlr5bRNeKYFiDpg5I1y2FKROpmFCvV2pzqlLFl0C2BTwZU1dAj2Qk+ouUdhzzxEKqS2Q/CUUIftepqKIYzMJncFDbEjt5gAB0DJOt6FWiNG9TV3v+oSdzqn9UFPTIP1SO3IhyVoICDGmo829ki104ZnvjVciuPLH85l5rSdQI6qJuabLXylqTU8tmebTXDJZw/kBD+hw4ycCgD1kQssZM3djjy/RbMhY4zrpN345jelr9Z5kQsINcDBPfyCjCm/Eo6PM/fiuCkNP/KrKHI6C+NkyFHWk14ZeYODJI8GYakRO6SCRZ1G/SWJxA5DfZcuojweGD0G
-    WIREGUARD_ENDPOINT_IP: AgBKPD8cgNPVl7YTUsKkDRioPFCLNg+q+PGYiN5Qvw5nAvhh8tmUiV3JlkdtUHp/ggC8Fn+bLsNPRjjQoa02F8wZv1oxO1XeThNtxX49xlcLiFsw83wtL/pKQcNShml+HClsiCXN569g9NkcCY4R13tcSZPRbVs+oV95sGeUtfx/Ukh4g/URX1Z0aKzI2RE1ENMLQMXkVrrk7GJdqKBBsW76wHcTHw3DgcshMhlgcDwLiX4b+e5nAOzjlcwEKm6EBxXz2NuHP9PTkzfvK9QSSZJ7GLlac7eqFWj+xir8k1s1bIzB/suNMIzpo0bvOUjpxmoI54Xd4/hZ6fXkEF7lD1DwK7G/RV9+XNePPX+lGSJ9gQMIadmK3P6jHNnl/+RtqUk3mQ35r3Tl1Tmz3mhhK3/YalL6/8zWesNVYt6D4yQkFi3GFnc02Htl7/CyU+r5a3TwE3xUl/VNtkhHklrL8obF/cCORbFlYcwT2tbYl1av/3slJ8UsG+DXEX62+o6Tpt70Mzhcj61mQ2H/Emb5d7FPYlohogM1e37YY6lJhbjZeNHxxKvki8kusPa/eY8ZAdJcpd41/0rrL3uSOOZqqELNuTzqQKRhb6CDUGaoYFqSw9umDqwjdvfFQcYLQepn84HFILAlUfNF/InO6WrNh8jWGKx9SNsDfrJpY/RRyEJK8EoNIuelLdNP3phZhxUcQn/UBZ/M/UOzJZZ2xJPl
-    WIREGUARD_ENDPOINT_PORT: AgCOTc0MMWugdnF6Ou8mGgBGu5VD7zP6O3hGr+4YzW/UvCEARqwuoRXTKggUpFcZC0mNf1CdGCB1iRGCVWjnFJsw6zSudcJiWEVOtqLMfxxwZHhApiMtaHq4ERP4Hhu3jn/QwdwbYgk7rUoqsCRU2JelgPoYIhJh/2BtOz0z8PO+ktMIi5Qaj7m6O0zkxbzvqZaEbgkYsFCtQlaWqvghNk7GZB12KOOr0kU+Uu4vyi2ak7quoMjaQkMrRHOhhw0hk++FCXN9SNpDGyGBcqPtl/8ZRUyomLi76O3nsHX8QtXXj3yzDEwrdfwNzCwJXqI6HI4X2+/xSvnxI09wf5ei6D8gyJX8gkPQiqsXA4dsYvTUstf26Qlh/L6iQjB8RkXixBR1YwrIu/lLNO0FpFPqtLJu5jf1jMjZIn+oPl3GxAXcM+kRsX9YS5oJdD3rFFTz8HGthfOTSpaEgSnN2rF440vfIH8DKvTDH4cyR78C2Z8TWQ2hbDxXOX/NwxvPfidttyC3euLBc4Nkb/VX/DEU9W3QCB9yKuXw2KKSqnWHvIAReYLn5ex9czU+B+8IP2fJzTMDH7gOYqwtxuRMPu5bto0dn/120ZaLDBzGUHL38pBnMsYhssOGQlerpG32nT66IYdaZXTMD2UHsTwnNqu4/J98IY47n60wg3SVOVyZQ/dmS7Dfp8lPr/kE3+xNM8HWayCEKYxW
-    WIREGUARD_PRIVATE_KEY: AgAwJo1zxNRWXAinDWXvLajPWwHeWwAD8zOopE8Z8M5xAUDKWkTwZecR/ODI37bYQ22bb1+qjErBsqUHyT79adOmypY9DLW6YdY2YPkQwef33iXdgC1T7nV4pjI2TahiVab0z+5ot18A/FM9S7VHmRX4L+3ccO/oqcInNz5PFbsXp6U0dZZtiKWg7N5IzdT9dwDCknNFTv10URlHKE0Awff8jA34XGC8Ra/SvF3gSiaYjwd74HEBpnBMM5CsiveOyU1vCNxg93S12yrauC5jmD/ex5oEnJ4J1SziTUlB6e6ALpluA3AD91wuZ+wXeaJ0huNSz4g4sL6jm3OQykyiRx7jx/8FL3no0u3ydGPgYZ5MaEYXBtTk6ODFEhUZ7EGs9w8vip1SY/FijZYC3QT78R5WMim8gi1wf+TwmA8YRIDZW0CMhbtI32Ef2oDmb1Jzl58Igba8zQGTIqT7Htj6f4mpJk8gKSRIzkvLK6o+cynOpQzZBOZb+G7lZst4g+lILLjmfpFGJTVgogfEkuYV6ntuE3dGB2OmRGUW0vpDM4ZCkxYsjh/1kzSyOGVYtL0EHS689ehzUDUJLuJuvuwZIFUjOFCFofGP37rKCcSGouLNj+xWmcbCgx7si05rw8JMeAWE5YETaBbi55DDaUB98G97KM28OlPBDm8PtqdcBD4W2up34nowXdG0tZ38VsTV7xNyp+2A5saPQZ72wM1fQiUwGwoHRKdHB1ptF6u+0zr6tlQoiVE07BMQ8/ykAQ==
-    WIREGUARD_PUBLIC_KEY: AgBAElHBgsQNQ3l8CGLlKMmi9dMTLmgp4gseMgbEMW4sjOvhsAIeLGsuv+HuStvH+bfAp7U9Fh6pAlEZKPOdN5pbpoFjkTDC5VU8aKJcdO/+iZWURbULYBDyGK32Ss/0eCwIsdO7lFcSFy2T7XJFPn656lBx8gocBp9PMHRSoL2dELP9q8JyNr3nb84vZ8hwiBP3Gy8BITeeE4J7+DnF2SUg+4pc92gMOgmWL4LO25pI39Q1yKBw4tCOf4f4ETgmjRHv17WsFw2JZTgb1rmXFvvKWGzTPZbA1gajcRgTKY7DrzWFjFi/o84qjGC4feQ9vb5ZwnLN1MzU1yByQmxQiAOSCK+1SMrvUJ9dF2kE3zJw0fSGjU83iXcorpbe4YYFr4Y8k6mKSSthchYyQZp5FuB9N9J7vm4vv4kUbTGOtwHQFrKRNiB5PVVFqzUVYWs9CfFcodAu7JaCBHKzLj1X7xBLiQoWYpx7/LVTjoR/R9j/+bfblKlid+H322Oh4ReSuxVKfMmNiOGeueMOrGX+DhHtYFbGHmdc3aprjBkYanq71MV9kFRVAZd834IX4wWykQWWgmYtx+eZJs6DZRWhAaVbBQ9IY0vS4IjAInTpMN9yqNxJkZ+w1MJIeTG5S9NnB3xUjnOgSCow9r/IEVNFbT4CbsEXbMECQ3S0OIby8r3Zwt8J7NEphFYkLtsR+brtMLsWRHIw23mtSTZajLMaSHOG6fooZyNKYgYJGr0Spura2M6TjhW+f1csYKrkxA==
-    wgcf-account.toml: AgAaSo7eZz/CvAN1reUDhHzFWIcmQMopYloYitAYq5Zu6gXE+65ogq0Jr/S7WLTqdgL3KWWhSmlG+jpepC8cpomVrnPfydlw6or227dm0ND5XNEO1MwNOtzeGNS3q7ayB8NoC7qZVR33KqutGOZLbFawyTZUi4ItjW74SdvL/Ftd4VvqrG7hQtAd/2PP37mL0unw2DesL8hFUXTkvlzAdKHZGQMaYNcH73JWJwvlf95L6ncKdZXWEM0uJnjhAVE+sCpUEQK67mQcX4RrYairr1wwux2YYjwweAriXw7wzBDvOXnHqg3Ldmat0V7FMK0MeIzHhezy15AGLtYRonFcYzEznIl7P2FjjG4Yz0EAk0t1rJpQgV35NAybseQ8t/92+vPa7LaPcjUUKZ5Kx1a2SdihljtLEjzuIdvYN/tKPcselzehWWrbDl/qeQuwZABxj8z24moJmBqJcXpAigvX4XlDcWp0jHWQxbLDozKtYHKUEPmhAklVaDuVr+bY2jOxU4Nki3ybLYpi834CsifcSc7RAaruJIlnITZUR2VG7PMIoTObqfeYnSyZKabHadWHHdkoyYsJmSiWjadvlvBXtW+RTHVU8UsD8GdVS9wBpA6ZcRsegFiEAoMzdyZQNRabYjUeAxpA/lOtt/PH1FnIV588Of/lhypBdUF4rRYcCvVT0gFQjoe7ITsvEf/P+fLb3TO47fQtBqOmKqoD21yhtb8Y4GQ21XVmB1gJT+/oYjny9/YL5CuhJif0XoarJZHtvTb5Ubs716PRSmSvAoXI6jBMKVSssWtfMIedL03X+RAxyT3jvL/W/SEuN5D5a2RpjIswAIN5LQ3b9f7F/JgDIQKdIHUEm+Z430lS83RDsMpJ13SmRVoXzbAededT7r08DHu++sOvDfHeMy+lTD0aTaskbPWY5PLve7g7PWat9q+NMepgRC3z26JCw/08O4SGX/fUhxg709F5A8hf/LUSTNGRlQ==
+    WIREGUARD_ADDRESSES: AgAgYz7lVospXNvfy7IZOK/fxQe2OWJ6cc7ZzQf7kfXtZgARrffOg2trievpkcimVhi2dL8CTbYwuiJ72M0FirxOq9zTyUGh48AagZk9JygQntCrkJp7O9E3nSpyTJanq2L5QWug3WePvrjK8ShzmSJLQT43l/hAxFPy9u2JbblU5vjpvPpZCHpVU7HuZ/lqfNEI5zRj6mzxZnphmctEGzXW+wilw+WHENvDBL+jqSMgylAycu/5+Uc5X1JGLqEN2DWRyCQBRMDxkiMBnVvE+ImfkxHU+ZcTMUANllnqNwjot/jpFDZb1b916n8eBLMoSUkwKpTP5DfT0slez7hC+bJ9tkUXAAUHDRm18XTtGY1Ouh1uqtIQl8HiuY0hoShfPF3BfC/4wNXMRZjsj1R++z6kP/vQyiSu+z2PuEI8yzDRnNQGEnSnog7bTJBdui/MXHUc7Q+wgVNZ0/c4HfViZbw4zP6GVf+jshdUbOR8HC+KxRlKzU8cNDeUdnydUxplF+By8gyWg1hPY/GlD+8hRWqi1QDLdgl5JXEwDpU++WmKhiBHrm72f1BgZ5jlIiMON3Z2Vo18DzY8j9zUA59uAQsxDhSu7+wiuWQYbZrSVdFY006eBWaI3gVPeu3e3++i2ogKFfc6q5gmmaxhs1CLhhUypddKUzkfXDz7alMuauKq/h4uLesoqIFEXD9eWPs4mP9qirYx8MAZP9txx/YP
+    WIREGUARD_ENDPOINT_IP: AgDEkEaKaG9zfbuT9Hx3HMWZJzVT8QnMWN7eebCx654Gwn6XNtxD/22d8wxIRfhllrv47HCsCUR855ptHD9HQjeJ08WhMFm7nQl1rYI/5vKfZDyWdSR3grBzGConz0Eue3y5uljXcr0yN+9kqzURPr5MPs6fKRJVfSWaMFbsjb2S1Y3HRPXU3+xdoDxeOeVmMV/pP1enGRnZX890UF5QR2wfZcEXB6WPWWC1XnPxc7CFmLNRi4RRhLjh+A9WDIqEny5gviBTFXQsOEnFqAEFSmey/zMF+Rk2lGEWl6ROFzdH7ypr9KNA0dtMmfCLJ9AQF9P6MMD/uh2CyB5K9Jk5xNGoy3EgpQyjHp7q6FGiUG/jT2RXBdfoiJoq/NPsgQB3leIzEBBQk/DRau+xcob6H75nVtS+fVWOJFt6tsWKVAQhDc7YO7WvwRyTups+3s0iHxS8SXbshiC+ndZPZClPO4UXVY9OhMAUZ3sKwS2c0Ffj3xzJZWTnO7JBcONYmjo9qASd6FJQKPvIy6T4t9EEe6iL05t0/mIsnOIEdoN2le5Lv4DK5mmlboCW3FzSK/e/QD1iZLJVwrTF7gvBKvsGk+hCng6GZMsr/3++t2bZYMUjMZPTpDaTk2z3N2An8Qg0X2HM57D/pTZiaiKTy83cjQsnFhkLBHzsqGhtJbScJHtasAMt07+kW9t/8T5LTGSv8h6w0e2Iyj/TsShc1ZuA
+    WIREGUARD_ENDPOINT_PORT: AgCANmOaOgGnXywiDn755qCxBADq995QPGwBQYiApioSaYC32UP64SVP6RRDBGvC+jjFqhmXZlSDTN0LdrKG0x9d7klVIlF2awTIdRKAzN9wki0lLZQZ9Xx0wQl/YVXTKgcVtiuWeOmSJOEPm8Zxw8/1Rj21bg1PV05VZc4jxqsq+s0AdDy8DDIphD0Pobp0/U8MpowFRFEGnjmfE+Ap0wV/L7CR1opFr0PJHuEbgjp2+WfgnnG2Hwqj8nEUXiZzZzd0YIQ53sE7rlpBfTgWIBpeisOD1NAmAr5UxdTSlYhKn11pdMgIdybYGS22RTYMdKh9S6I+S0AjA0Gnci2O62c7y1aFIMxLrq2G8LhTlCEiRrYirGzNQZiVooGAnJE2evcTVnjZTGS2eHH5d+86Fq2anD+YzYhW9QLyp8goEyqHjuf7EoGF5H78Ij0lJ+rPreA0dSU0uOEC4dKZQpvdjkMZFu++uusNWLh1x8tvQBdRBDqExc2qbulBnn8VxRk1jwMKjwRarGrt0K4f2Dn3pWGc8d7JuLxnJ5QDljp/BaNlrOhnp95h1Uh4vQoj6fvn78aMkAQDbIIVaCx2IFVPEJBXCfbYIbV7mY1M7roRTZPUQ4+mGDe3IEPeXLvI96QK5en+0VsksB37+eFp7BIsNibzViJI5KgBYp+Hd9PECPYKivPjhP15vqLEcqGuskahvxp7xblS
+    WIREGUARD_PRIVATE_KEY: AgB1iJHqHhWudTU26hAXvWpp8OsCccV7ASH1BG+hmo5nXTEyBpjCQ58yuYMIYHIJq+iLlrHTr3cn4s2Q9CO+BEnca1O6sfOYzewoIqvVVjF4ol2TurPz+Q+FhqO1W+IAE4qrg/2/qTwyg7HcvBHEsKvIH0M9huAk6hgzGrh0Hx1NK2AyvtEkW11Bxubux4LVNxjqS9RuNNzIvVURU4aN6sDX1Jhkvv6cr/DU8QwopojHJnrxVOA++rWgF4IFvkz0K487WKkE7Pn+aTW0t+vN0JgxIobznoyMVRkUqeEDbE1nBaf+/JSQ1FREcv4CSIzT+Zcb1XslkGB4vOjEC0ZBkiQaAxHQdl0Fdthmt/5NnXonl+5mFDVepDmoGPmsk272uMGxl0vvTXWZXQfasspf0MBGBjR/NF6MPVkEf2n6Gkk3INvtQUbtwjKpmbQj1INBKVhOgEH5RDwyYsHz6FkrtPQmv8odwcTpQzL4gC7bZ5aRY/MGJDnWRNHZsU2j4Juqpc7q8t15xT26gvhedGwcD07uYM97gGvMtVhiCFAYj8XOKJAfhqeROgbGjWSpUC/9D5ERNg9BYhYyYjcOmrmdL3x2LZEiWCwKI6jR0YssmuGsAgX0z01h4OvLTN+kjc9hurdPdat2zqNr7w48CdE117ahLd3li//iYWlEC5mVCnHQ6iRrh65LstfCDwWBdFHTLfdpAhe0Ugd6rcVJt1sHPGL/5E6tLECU8zwOThU6WygHmvWpjLzWIX1bO2eF6g==
+    WIREGUARD_PUBLIC_KEY: AgASGQ2/lkGyl0HYWYlwuJZ1EtxoHrCIf/Zgzk7hCe3he1kHZHrcDpdoMPVEd5ys72wHW1crygowq1h1ySHPRb/gU6OgxBQHvZkGXBxmXon8u3KIuahuAnXwHsftO7qIepAGTka9S8/7GTeXEutXGMOWgfdRO3RzBUzkmoFH6lyFwco1U6SBfyfN0MVfPTTlMk4fV6DBZk4ygOf6Slow3/CR5+2otNRFx3fnzPTU2bEg0QvuMXg2RPmse9YnjIiSKl5gVmt5FwIyo7IDpgJy67rwfGu17Hv3cIhOdLLskPkakd97MVxpBp8xeGLSOL+5ogeoi2rvKvF3AbRyuMhi1eUlTuYuFp672tPQqkrTr512LsL44+WZdivhEAAl/bkMSJDHejAyta0n/3BJTIBaF9T7/ZPagfMSE6rBwpI9qpiNHNaCD+qeo9f4+f9VvVj0TTvhGku3ERh3cWiaJ3RElcpzhlWNlBb1Rnnmz5d++ES85W78vq58HjfYv9Y0JzOWmjdk0PhOxd7us4qNGOUaEs9CnkdDKU2AAnbbPkIw7CIGR8fTeNsyQw4L0VtP9X5X9NvjAsBsCgzPKQg8dcGFL07G/JLWVOCFQidn9L0SxQXH5O6bH4lic2jFQjCdwmOD9CkT/49Gb6ZzxwUnlYTO6mlNtIiFKhH/b+WAjDc9LMfwvSxNft1fkjgFjrSvk8No9NyU8QVvIPxQLJnKdVxSWWAaI8pePPeKaTD3a/qeANkb8HWIh6Z17zNx1ggC9A==
+    wgcf-account.toml: AgCmivAwuSXzJouUpC2FRB5vzLQ6Zj4LYzTbpwo6S6FuB0npes/61jtvdBuT+zdw+GuXhANRW0g4IBo8B/m/rtOzauZ0Sao6hqvlwTBbTPd6B/lnwQMMF/u4SrdsmRjFrlPxRWWs4rVZfDVcoeQqy7GCpRRHx36z/uwTGoFbz1yvTWO9RLJWCTMI8es8zoHzudpe9fS6PcAo4Cxv4ezA7kPMqQ88JkT5C0HdTNj5xEm/lhkrA/5mdF2ScDC8JOVJnJkURirr0glPRRoYlKB9wlSXcLtXMjlVWu72cND29QcOmJHaSyVZLzWtu83rA8axZBjX9c2Dgtw7zwtf06Lapcj91Qo2ul4vKXMfH9CoCzEpMwllSWKZZndV+OgkG53qKWzvrDj/bagK4qX4TLibCAdGd0hQ+/IX9ATJdmdRgHMu2AW3dudsLMXJJF8/5NdKS9ULeWXA/Fi1P+Ahebi1mS3NyRIQpAB0Fa9+FoaHUIp4itNOaOVQEQP/xKUCBeB4yFTqcCqnOwogPbzpsvPJWnoUTKCKDB9PCActjAiRPkGsxj+rh8FGfm/xjSbuzdLg42fHiFSO17zMr1xWbuhhUv4/LM0JXJki61e7/ZOPTjzJACykH2L9KYoC+jHv1+Tfr+tXnhO5yX9G7BUKF4r0CCciVufnH1N0j8ZsSDoqxT9avimH0hJJiJ596pW/UbM9KXbf8omqShd88rGHF++eX51Kp3eU2+JVFhpYsrWjtYOSUHobU6NqJZDYMc1TE3hAa8GeiGtuKweovD/mcbhEXvNksIOQqB2JZ8dODgFtN8WAcRQqRALoag5OyokcpZcnpd9NUgvPVUpCyddnKnF3oF9hR1uhhG71U7rf7OTtNO9KZwy0tg20cPQ+fz88vXLRejezCqf7yfVgd6pqxXtw7XgPHMR0j0RhKMrahee3Q/TWBou/XB1kVYkJHLfg6QLmRiaWVT4I/xd7zEZF7Li0VNc49g==
   template:
     metadata:
       name: wireguard

apps/redoost/auth-sealedsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-auth
+  namespace: redoost
+spec:
+  encryptedData:
+    REDOOST_JWT_SECRET: AgBlwaY7ZaZZSSpLoS4XOF5+dghrmIXZu4YN7kQxlm2WunpxMjw4VjCz5Iz6OxvsJrh0R4rf4YfIotHTlbs1Ylc9JtjrjcO0joi3+VwenIGLbGKi3tq0JJCJohrAkFF08Ro9d2UEFx39vhEXJ6EFDoNqhZp8v51OXdLRe5gAU7kwEHyWIxZMzxC9LeVLCPN3Ss+LJCALa+ePoYOENYADy9PK0BgsvXddnUmRIaxRVv81qc74c1tHnzCL79nazVtFw4gdqV9m9QuPzRem2pHXRvIC8O8J08LeCSrp1XXJnRB7SDWEdKYS6iSL+/ohOhxYGRUSDq+bG68b7pWTQu8Gp/jHyPiZWcjtL5V6fzs4otE8Ur7prAbflXZHLuxzUjPHsUJ6JMoP/Eousb5ui/rcA2jtjVOlPmxaIncj2Q5JK4jABMt8s19oyFedlEHD2Er7WXF7ZoYY2LFu5c645ltju3HlUflxac66NDhVDqy5BGpFyjwkC/XJ6mrl3gqp756UaFrFW8ViuJllhYty08KBU5eA9AOvi9JRl0AVHGQPAE0kV+4SC97Q0zXcqNb0FR9PloOUNvoqyFyjU/n8LUO8ObWw8zrCPljigexHRKEawwgxEVCrqMNHaAtzEhD5uXrDvsTZ4ONFOAooR+dSKM13HSMyvwFyPY+vzZr6D1Mef4dxYfHwJeV6WtZuAFFsfQFS7QhFpCIDsDXV3FDxY4PJnREG9jFr/lkgShlLFD7IcdDBYC1BxwjNUNdMUW5oA1AiKyByd5aCQgetHy1UbJKGy7yO
+    REDOOST_OIDC_CLIENT_SECRET: AgDS2dN+lFtGk/DHb7TNj3+trQLgxNIQZBth1nHLH90gXh1Etz04wKwWmI+/OJWGqxaa4xbxrcJWJDaAQeAK34qOQ6nu3uVV10lK0PBHqaGVA9s7uu9LsMy08dGC3IcHGI7dSyNaBoWAgO/CbRJYRBIEl9ePibm5bvhMo0VQZk8LtiBxrsySLyYqBSEDLOxbrGGtEO6jAlAe21jKTFOdaSdwZ+oGPWAuKICciA8bl4A5iqkJR8P0AD0azZ/HjYtygOL9Lextlf2IcRyzFC6lmyYEyn/O02rTGgFuCZHHDcF1fS9VOXDXlJVpvFSd7fsbvLa1BOqZ4y0UlJ7BVP03IzmieJIbl3Ey57Pr/mWlpQ9j6a7Fo90zF1Z8eribSZvJIuRdLPWIBfHJTqBVB6S0YiUNcn2KArwx5hKbRqEfb1NDFyDV0cfT7dXTN69xcc4YByBdaUmFjZZKfz0gYIOYKZo8bkA/vHiIjYYOdamSJpdThNFMLuqD6mJdsNx3EZLoXjkezmbWig764AudHfkzU9OOqi095rW1tP2mSK9T1qAxjs/lr/PGNjTQU5CNQ/XOi0qZgnjUmRZEyuDz79lvL8LeE9XWLVQ3eQ+z2Mm//YNcx1soaHdDnhUKtFXEqcl3tj9InWmCloHtB8xtxyBoB2yEUR5eEls3qHCfdiebt7mINDMdO0QqmNdleFKz3TTs7/2NgJ3xfzK/cSkkfXxvUHmRgYpGWG8887KifIEONZvn6ZLDfg==
+  template:
+    metadata:
+      name: redoost-auth
+      namespace: redoost
+    type: Opaque

apps/redoost/database-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-db
+  namespace: redoost
+spec:
+  encryptedData:
+    REDOOST_DATABASE_URL: AgBqe7ze4oAAyWrbSdLWaaQ3laVs7WxBobr0/H/YFpXIyALuVZP2O5rtB/0BGauc1xPEQl9aeYkmSzAvaK0ECtEvU/Wj9QLfSJ0WCcGXrK+Cou7ykW6lSwFfbTOzDylCDpZtSEKanFFj8KCmeu/7PS/gwi9zsJXKR4xgfaWEPztCr6ND8iHY6RkBAxljl3NLeR0y6auC/eq/Tj08IkTGlXHeF9nQN7SaCl4t+kxtjY+k1CLbXUmbmNY16c0H2DFwbLQ9RgsyvL6aXnJ2LeqRvNsg3QdZDPDJwvs1wqR/4U+hTRh8tAGrmIoqQKuxcasEL5bmBX6Bo1JVlS9xgULf9bPbHP4mncClHFJrXTHmNv10cLLuyd/o0YdBStWoaeIv2YSchnaoRH0Qu26GbF1CF2KrgE9Dwu6iCJn9Ux5LPhWBvjsNfJ6r7unw97IwEHSsrWT93osddiPi4rGLXS4rP89CouvUbN3LYsyJuI832Jj163lk/+EERxXR+ctVQJsgH1gZuHlswLXEkn0BvCT44w5+Sc0NgPkGeKyld4Fnn5FmHlba8qkyks9+J+mZBJC26fh9wZJN0JFbTkLov6sk6nGEMEvrIJyVBrAJi1FmEG0Uec8Fr/NyLv+1TZm0eeRZ1mk8J5h6QydsBu5Cq2wabfysnMsIJmS4YpL6kYSIcF0j8zr/ISfjEFchfnI9AcGQ8rhqYcytjkud+I+kpaq6R9wDMpUB7FV0S2J48A7seXmvJw7wA1ojdXFuQ7Ix0HCUIcFrvTPs6KqXe75DfXEtQ8Lm2xc+OWz7xm9DfbPkeo2s1CSmHpUg7WeRjNp7aoiJgFvy6+xZi8xe7nt8B7P87SHf5IbtLLpY9v2bcPjXJ8R/lzyXE/kOK+H/Dr9YDrGDZvZm
+  template:
+    metadata:
+      name: redoost-db
+      namespace: redoost
+    type: Opaque

apps/redoost/kustomization.yaml

@@ -2,3 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
+  - database-sealedsecret.yaml
+  - auth-sealedsecret.yaml
+  - middleware.yaml

apps/redoost/middleware.yaml

@@ -0,0 +1,9 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: compress
+  namespace: redoost
+spec:
+  compress: {}

apps/redoost/sealed-secret.yaml

@@ -5,8 +5,8 @@ metadata:
   namespace: redoost
 spec:
   encryptedData:
-    REDOOST_S3_ACCESS_KEY_ID: AgC0A+pQKuYKMLfMPRAtL6a3PBEkwgghd7IbH8ZGhgU086s23NvbOBM5sHHkApqOiQ9z2LarAfvvKpBdxlQTjInxhqdJ1lW/zkWHokHhSn/L4ule/efU18a5gXsxNXN0Mon9PZrS9wKAFR9ZNiEDFa2/L4iUtCesUR/MneUFqqqibxiUgt2R8sMmRIzP9O0b8T7vnw1EkgyO4HWpWlLrGPnBryWA4OEj9CGLrTT7Z8u3Z2J5m43dELfmzdAH4gM3RQPXAzAMY+QyxnhtGA6x52OTcD8XxqB1lW/dWzTq+zCjnmRR5HbpWjeuM6ojlFJZoBLxYRRMZowMEKFX4egKUvGEDmSKOX5Z+Hn5n11dyRFhpKrMU9vy+utLvVtDM/rr5NqK1Bna0u40VdUUwpdoqAWUevw9yLld2QzOg06hjqQwpqVER7E1VTDKjVXveacaN7si+63abaw649eAaFhTitMEE9ORHZ7Fz3YZB5zdqnEQWZwzczJhhvqzNxP0pg1/JCEVrKYVfHCtuDoJ0BCeiuFPWU8lKYhYoxRzm6biWhdevM4o5CobnCedH/O+TDq6iPDDgC9iBNHIQjwfUAjjq44OXfl7X9+J3Q7xm7BYMD+/8LvycbBauFtOnkj32fyuUKF/EvoQF/AIQ3TX6rC/CkbIMT+m+mcAx75CB6hfpBFOMRKgpTT7WNR1zs6YrSEzNNQq95KvTIMVYEEKm+gjrnpv9mkCkCmSJPCWsw==
-    REDOOST_S3_SECRET_ACCESS_KEY: AgCp8zFoy+Clr5qY/57jfSwYT44a2jwTFzHgOPoYfE6LXXtis40QjrteEjyc9oE4dE2IlR3wY85twCcqMEbJW24mkTbQf5E4B4V5XaUTi2XhMkrms1tfwaKJzYJiPfoS5u/WyrMN7LK/pqryEVGODKh/57PNoEDK/N/ab7w1iKfxGQQVuwDSCdsT3RtrinzKXKHUFsR4f3wpOAO9nh/53atgZ9MMs+6DFLmkdXvIfjgJ/PqCrtxKx3hTXFNhrwbDIUJFF/wF9SUy6C2CyHCycdeU5HJFSahCIRMZvFAhDrl0Ubsi/MFgWsQouj2q6VEK8VAWDttCJaiSf9g/KhELneKCYC7qo7e4PzhHhAHUGO5fILWxd7HySj4CxSiCDiF3kIqVUXo/sqlbgBNMvPb+NNqo19g27jcFZPh/AZZkuBSxsdmEYfgg1RAcYmwPGUxksRcj36yknYjX4pMxJNqVGDH1nLsplOa5b8h+evxMnjK6oNduRP96zHd+Qo4sC2ThBF3Ar8STJpbbJ+KgdW1HnHo38JYd0J8q/pcVq5xY3+VX8Gy8JSrb9wdFMZnb+iWmyL/GNwLIqqbZw1zcKF7Rru78fl8Y5VWDnrpbjn1buqDxwyFkDhcxX9WISoAPKXP9K2Cs5UOIKwu50cOAyA+cMOMsYbTnkvAuDMZ5aBPp80j0TQLu4luPPvKG1RumhYxGthmEpwQaPyXuJfhOBbuVrsiNlaCKe+d3Jv9l3Y4PVlTBJg7ZD7YpfLoyvt1Y9ELAI5qiUjZ4Ru5TxX2lIqZOoZ/G
+    REDOOST_S3_ACCESS_KEY_ID: AgAsARN/0zM6asSlm+13UwKz2YvviQDwuvzPiP+Xy+kCi8VUdaQohzG0f7FfDhmG/0zvgc2EawNenf8QfUuEVYUMw/xa3orbvardL0RkOZN7dnm9bLm0LiuzRs6i5VgWSOBhCVZd3oMhlVyI2Pzbu09VtcTIqbIPrrrcrQzA5a9rIes8MKGEQbU3pdZILSKLFXgFWCqDGiex9ugkweI6jp9gk71hRzqpYOP9AA2df5kB0n+7HcIB4rDq7WlA/iXkCMH1NGhjDBMpRE/HyxhP0Td2WXqNsYKDM8Licq1qBnuSGT2FaTsCKXZ0X3ClFpbaXipzAwimqK4eg65tneT5NKbLnWjNZKx08scw98PcQzS4g+9l8nH8IIKOVq2+MuC+85e6yEgfkEjwknltEGSJl4VwdFUm5Ec2GVi1X9zWW4BzHuGWJYE/tj3atoCHfUnht3O8WVo1s4pSOMyInsetSlhV2YVMncOKVDHciY67+ih71jqiHqABGclbDzaQKFeXFY/e2J6o1tTRQ2ej5jxdjU+hdqig5/jsGqRc67t4oiOPEgEq4FmDTp27FGUIM20w3l74PC8vhX7GWOJfpl8DqvYgAJyYLO0hzSeE/Gl07/UZalq2Cinl0BwvROJ7kPVB4H+NqfbGl77AxMXWu49AUV3BBKG3xFI5eEVY9CRTL5lAY+WKW31543pgvB9lvYbq7LuTnvlOcKSwlXD0EeAWo4eyLuwtPOk0n8c26w==
+    REDOOST_S3_SECRET_ACCESS_KEY: AgDEE69d7G2xfvL/SyMz4HbsYO6bilvv0lh7gtSgfGLSBK1K3Bzn4tf3h6xRFLlO/mhlQCiozWSB9TQdltZyDvYswYH23kEaPR5m27yudHK7nxN1G8I/uyKFzm6o48keU+SGCakutYJ3Mqrbicj/Ogi+5VPG8M6Yxh/hKYcMO9i3cJDoqn93Ldyv9jRty8q9nNhaZDs52di1p+1S4FOZ0+ryrIPVtdPGfM2KViFnLG3DEBqMkxHNegWGRjie+AVKY/MOqVE64I7t+XBYnjLfy4aRpGFHhEXhihkfGklQMMKFwlIc8OChs0RfPHTWHlbTg73Xmr9uDyUDWgAG7VPfjuQU6RfgkWCGe3WjLF/7hPZmfzR/S2nhPZzNugFRBeWG6Q2FJ+ACPoJQFCmht2JackU9X7HivJee3UgfG0q63Ja2OK35oiwmHcPj2Wfv7YGarmnMw6QRiKY6ZpQN3/mlUyWNPMnwoRrb+JWQJTkVrRL1lZloydgtFX1y25v3XYjR6jU0s0aN1jacxIVto1C5UgNhLBIjhebXBnqVlWn4nJzYTLZvKnY0mHv8sF2cEXZNi4wqa8VdifZjSriqJKDCnQSPX0Gvr9XTRiqRWFNzoTRr0U6AnV3/zlxJaBb21zXAY7QbpbzExEbazJjhaaSCGoCGhVsVFOdn2KydbZd0mFR/o5KUDR7GXMJj/6wvNsjduyvlNFxJgCwElhApHTWxtsXWYR0yFeuIuTfyn6hbTo8TMQqPqAGKowSst+q0DvOKz7E7P5HZrvFBGkucSr5JdIxY
   template:
     metadata:
       name: redoost-s3

apps/rustbin/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - httproute.yaml
+  - networkpolicy.yaml

apps/rustbin/networkpolicy.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rustbin
+  namespace: rustbin
+spec:
+  egress: []
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 3000
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: rustbin
+  policyTypes:
+    - Ingress
+    - Egress

apps/splitpro/cluster.yaml

@@ -1,33 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: splitpro-db
-  namespace: splitpro
-spec:
-  bootstrap:
-    initdb:
-      database: splitpro
-      owner: splitpro
-      postInitApplicationSQL:
-        - CREATE EXTENSION IF NOT EXISTS pg_cron;
-        - GRANT USAGE ON SCHEMA cron TO splitpro;
-        - GRANT REFERENCES ON cron.job TO splitpro;
-        - GRANT EXECUTE ON FUNCTION cron.alter_job(bigint, text, text, text, text, boolean) TO splitpro;
-  enablePDB: false
-  imageName: ghcr.io/whyredfire/postgres-cnpg:18-sha-62e724e
-  instances: 1
-  postgresql:
-    parameters:
-      cron.database_name: splitpro
-      cron.timezone: UTC
-      cron.use_background_workers: "on"
-    shared_preload_libraries:
-      - pg_cron
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 128Mi
-  storage:
-    size: 1Gi

apps/splitpro/deployment.yaml

@@ -1,108 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: splitpro
-  namespace: splitpro
-spec:
-  replicas: 1
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: splitpro
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: splitpro
-    spec:
-      automountServiceAccountToken: false
-      containers:
-        - env:
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  key: uri
-                  name: splitpro-db-app
-            - name: DEFAULT_HOMEPAGE
-              value: /balances
-            - name: HOSTNAME
-              value: 0.0.0.0
-            - name: INVITE_ONLY
-              value: "false"
-            - name: NEXTAUTH_URL
-              value: https://split.whyredfire.dev
-            - name: NEXTAUTH_URL_INTERNAL
-              value: http://localhost:3000
-          envFrom:
-            - secretRef:
-                name: splitpro
-          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
-          livenessProbe:
-            httpGet:
-              path: /api/auth/providers
-              port: http
-          name: splitpro
-          ports:
-            - containerPort: 3000
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /api/auth/providers
-              port: http
-          resources:
-            limits:
-              cpu: "1"
-              memory: 1Gi
-            requests:
-              cpu: 50m
-              memory: 256Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-          startupProbe:
-            failureThreshold: 60
-            httpGet:
-              path: /api/auth/providers
-              port: http
-            periodSeconds: 5
-          volumeMounts:
-            - mountPath: /app/uploads
-              name: uploads
-            - mountPath: /app/.next/cache
-              name: cache
-            - mountPath: /tmp
-              name: tmp
-      initContainers:
-        - command:
-            - sh
-            - -c
-            - until nc -z -w 2 splitpro-db-rw 5432; do echo waiting for database; sleep 2; done
-          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
-          name: wait-for-db
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-      securityContext:
-        fsGroup: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      volumes:
-        - emptyDir:
-            sizeLimit: 256Mi
-          name: cache
-        - emptyDir:
-            sizeLimit: 256Mi
-          name: tmp
-        - name: uploads
-          persistentVolumeClaim:
-            claimName: splitpro-uploads

apps/splitpro/sealed-secret.yaml

@@ -1,14 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: splitpro
-  namespace: splitpro
-spec:
-  encryptedData:
-    GOOGLE_CLIENT_ID: AgDRctXaM2WUp9CYS1HQaxq1F6qJ6wyuV5PRK1hhSYCGCpZwId6mT/M+YCGiPnvAqR2W0L0cJ199ytZ5aV7UBrgbLG6XK7jN1txxpdWTSq0pONPj2jOrUvqdToA/6hUCsQBW6oqshbhjV/H53PxmKzR/t2zTQ0xoI64FK81INBsyaCY1gzdZQWYZCkmDhBUrvzfprcI6ayTvOtMhJkXMFU/TNielxjQtmRKnjz1wqyKZkvie7ZS2oEzU7R+VuuoMQVyL/N1pcu8rd5/WaJxJNgtG0oTFtJMQMCKvV80nXRWTXaTCGtpd4Ior+COgUW1ruzxU7HvrOMeQk/pwRPtVuANA5XUgwABWJH+RMmSDTsmqFlqaIYluE4swYGeR2dvEVWv4PN7YjBuJzYrWOCntp571JLw9jJ8ffCCEETQiEYc65ZMochp1rayZaHFJXAoorS/AbOK5fBYpdwM7R9KYl9tGxYzNcqzihezqb2hZuIIyEQnCtKPJl68TywiDXcUiftwlIhf56v2Us9nYaHRsIVstot1FhkrO2DqYrRxJ9/k8wPeJjPFCqrpx56y9bqRiyq4R4tfAKv/iHTZ2d8hVUZ1Pr/bc2pqwjxtjzBlGBXrAC4xSQWf463wk5IvY2dthRq0LZsXd7c8zV8QN9ZGwtWgWulNB/VXIsv0LoI7lmujWbCAGcis8helOo1wRgYE/NVeD/SEpJGEPkzx9XRuplj+00WsjOYmsbfvtQIcOOJbEtM3d6vqLd+SeFswSg1z01YFX6gagPhHCbDqfy0+DFkkM3QVsAPxKrBwT
-    GOOGLE_CLIENT_SECRET: AgAkBnqzqC9srhWzQA/q7ZfMpgfTy+J0on856vHPrIS8oe5P30vciaGlgkQdf1oMLA5ovHaSq6x9AEqv7HRzoeSrdUSjswZce1akAcXU+wA0mQGzVsmaTpCERAJ7GXWmSgsvIQNQXF5N6BLiZliueDiMIy3sZYAcoffrZ5l22mWOSBlHCXXZqZoP+F4Y4tQrlO28NjlWGo1UBf83JZ6TZMtK7IOuYoMDsZo/NlE1x0zj3beMm1VLvHJXRn1plU06IwlIKH0xEed2izff4FQ7f4Q3Dqmtbz6PhTdVqy4HQvhIrkAl/6IwQCZdTWHRdgv6fXQWs+ZftoeRMHFXI0xB3YfbLoqO8Q2kDqgxSOM8Xixdbabq1v8u0EVZCNRryb+XuWwG46xWNPVF2Nl1SIaeLxWQhFGEXTUf9IqYH9fQ1kpqIlj5IgEa1MUWsx1eE+vik1shT20woU7Lj21Zcu3RZob92qMVNZHheB2Lzkcw+dP1BwRIwXTiLXfdyDDHXlajnkvkkrrcwO62K4zEIIS/LyoLt2vdk63mfXKSz343pnpOsN2hEqJSTkCx3CFhB4JBSybSFrBtljcCDjK95dvsTQq8qZKEqLFZEQjRWXxsiR9aoNo2MCmPA+dDfvsJ7/GZ8mnjyNdLw+UCxrTiyXMI0pAgezZZZf96KPGUL+LnRbJiTHxxsfk+q2/nMZeU+ftZdV0F7zrCUQhkyJZwhYk2XsblyHiKsPCvLHtKbhIXVpwnLdXPgw==
-    NEXTAUTH_SECRET: AgCdNnXbHEuOlg1UnJii5eGJVfBZh5nWaybBODJJK3FbyhYPuj2KhGfNB/ld529FpddAEDv1IGWwKAOaSCkhSv1Nh1P2NZj37jpgbsHx8vw1omLLSkWqtRf1m4AhHhEwQoY49dlAk4AxSkjk5IckH8PbbRWFXx8Ns8kAGrJLrp6i7EbxrkI3U+hbEz93sQwRJo8XOeYCEodr7JPKoYHwy5roAwB0PmFL56bZFfuCa9yEje4BFxdQMrm0grSDMotTDH3nTF6irq5HSOEgqnL7Tt3kHW+Uaz5mvUZcCxAMUoB9q2mjTjm8fiprybVfMmCsib3epcZGrn0DiPZhihePkrfL6vTaz0pm1Nr7qkbtXFVY3RWgZjFpmDyAl/of7ddh9VYQVmqVAhfI610Czqqyou0zFuvlOXGlp1ljp7FNiwo+r02WxYoJ1leikB+CCnVxd/ErELA0AVneGUcWzoKG6r+OlDzsfV/gp2LXanAq2jKyeZ09ARhkLs3PHzkoGDaOF1Dr+3ZCidrfV+GRcnr73P7QEQNO6R+tEmL+idKiLr4uI56zrFg/Vb5Yxk/jMr2Hrfw7ai/nV2A+eqgXFQammCEZlDyCS8GPX8ULervbG/n4JmXXMUtGB9esM40cfTlsNhhv7sBC2P8QkOI00wvgdiwcPkOE+1i33Sxd1Vt20d8EP6TMfwhofQz2zYdYQEWYmBgiG+zX7mwwh3awuA5uH+ooA5vFe/aHPvMYM2rbTYDihEISJt1b6cbCiE8+Iw==
-  template:
-    metadata:
-      name: splitpro
-      namespace: splitpro

apps/wireguard/configmap.yaml

@@ -1,26 +0,0 @@
-apiVersion: v1
-data:
-  wg0.conf: |
-    # Based on the image's /defaults/server.conf. The init container adds
-    # PrivateKey from the SealedSecret. After editing peers, bump
-    # wireguard.whyredfire.dev/config-revision on the Deployment to restart it.
-    [Interface]
-    Address = 10.13.13.1
-    ListenPort = 51820
-    MTU = 1280
-    PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
-    PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE
-
-    [Peer]
-    # macbook
-    PublicKey = xuWFr3AHPeh/gRO5NiCGnwHcr0e/8InaroXcY8S5eC0=
-    AllowedIPs = 10.13.13.2/32
-
-    [Peer]
-    # phone
-    PublicKey = 8VBoG0Bpwv1UhAOethIgRJXmaNWPErSWkqcfdjGmhHs=
-    AllowedIPs = 10.13.13.3/32
-kind: ConfigMap
-metadata:
-  name: wireguard
-  namespace: wireguard

apps/wireguard/deployment.yaml

@@ -12,72 +12,97 @@ spec:
     type: Recreate
   template:
     metadata:
-      annotations:
-        wireguard.whyredfire.dev/config-revision: "1"
       labels:
         app.kubernetes.io/name: wireguard
     spec:
       containers:
-        - env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Etc/UTC
-          image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123
-          livenessProbe:
-            exec:
-              command:
-                - wg
-                - show
-                - wg0
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          name: wireguard
+        - args:
+            - |
+              # The node's kernel only has nftables, the image defaults to legacy iptables.
+              for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
+                ln -sf xtables-nft-multi "/usr/sbin/$b"
+              done
+              # Only skips the setup wizard; password login is disabled.
+              INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+              export INIT_PASSWORD
+              exec /usr/bin/dumb-init node server/index.mjs
+          command:
+            - /bin/sh
+            - -c
+          env:
+            - name: DISABLE_IPV6
+              value: "true"
+            - name: DISABLE_PASSWORD_AUTH
+              value: "true"
+            - name: INIT_ALLOWED_IPS
+              value: 192.168.2.0/24
+            - name: INIT_DNS
+              value: 192.168.2.1
+            - name: INIT_ENABLED
+              value: "true"
+            - name: INIT_HOST
+              value: wg.whyredfire.dev
+            - name: INIT_PORT
+              value: "27299"
+            - name: INIT_USERNAME
+              value: admin
+            - name: OAUTH_AUTO_LAUNCH
+              value: oidc
+            - name: OAUTH_AUTO_REGISTER
+              value: "true"
+            - name: OAUTH_OIDC_CLIENT_ID
+              value: wireguard-admin
+            - name: OAUTH_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  key: oidc-client-secret
+                  name: wireguard
+            - name: OAUTH_OIDC_NAME
+              value: authentik
+            - name: OAUTH_OIDC_SERVER
+              value: https://auth.whyredfire.dev/application/o/wireguard-admin/
+            - name: OAUTH_PROVIDERS
+              value: oidc
+          image: ghcr.io/wg-easy/wg-easy:15.5.0
+          name: wg-easy
           ports:
-            - containerPort: 51820
+            - containerPort: 27299
               name: wireguard
               protocol: UDP
+            - containerPort: 51821
+              name: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 10m
+              memory: 192Mi
           securityContext:
             capabilities:
               add:
                 - NET_ADMIN
           volumeMounts:
-            - mountPath: /config
-              name: config
+            - mountPath: /etc/wireguard
+              name: data
       initContainers:
         - args:
             - |
-              set -euo pipefail
-              umask 077
-              mkdir -p /config/wg_confs
-              awk -v keyfile=/secret/private-key '
-                { print }
-                /^\[Interface\]/ { getline key < keyfile; print "PrivateKey = " key }
-              ' /template/wg0.conf > /config/wg_confs/wg0.conf
+              # VPN clients may reach the LAN, not this pod or the cluster networks.
+              set -eu
+              iptables-nft -t mangle -A PREROUTING -i wg0 -m addrtype --dst-type LOCAL -j DROP
+              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.42.0.0/16 -j DROP
+              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.43.0.0/16 -j DROP
           command:
-            - /bin/bash
+            - /bin/sh
             - -c
-          image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123
-          name: render-config
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            - mountPath: /template
-              name: template
-              readOnly: true
-            - mountPath: /secret
-              name: secret
-              readOnly: true
+          image: ghcr.io/wg-easy/wg-easy:15.5.0
+          name: firewall
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
       volumes:
-        - emptyDir:
-            medium: Memory
-          name: config
-        - configMap:
-            name: wireguard
-          name: template
-        - name: secret
-          secret:
-            defaultMode: 256
-            secretName: wireguard
+        - name: data
+          persistentVolumeClaim:
+            claimName: wireguard-data

apps/wireguard/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: wireguard-admin
+  namespace: wireguard
+spec:
+  hostnames:
+    - wg-admin.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: wireguard-admin
+          port: 51821
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/wireguard/kustomization.yaml

@@ -2,6 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - configmap.yaml
+  - pvc.yaml
   - deployment.yaml
   - service.yaml
+  - service-admin.yaml
+  - httproute.yaml
+  - networkpolicy.yaml

apps/wireguard/networkpolicy.yaml

@@ -0,0 +1,60 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 8000
+          protocol: TCP
+        - port: 8443
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+    - to:
+        - ipBlock:
+            cidr: 192.168.2.0/24
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - port: 27299
+          protocol: UDP
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 51821
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: wireguard
+  policyTypes:
+    - Ingress
+    - Egress

apps/wireguard/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: wireguard-data
+  namespace: wireguard
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Mi

apps/wireguard/sealed-secret.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: wireguard
 spec:
   encryptedData:
-    private-key: AgCyimGRHeoQAc4xVkr09bpRHYtZBG2Gjc1IkOM9D/p+f7n7/Va2hJixDL1ieVBXufEm485MYcLV74j1dG6q/Xyad+Y2VsAlWGIFlC+1rCO0V/dEKGOav8bxxhcMV56YUDgNR4ZtBOnN5aLgq2P/72CIbRpa9I4ofNUmoMV+Eh50hY9oVJgdmeb6Dx+03q5Zkf1LTJZMxnYi5r6bbzznT1bqQM9gZml4N2b3cBBVrtLIBlPFkHeyxhmS+0ZnQgXiu+oFEkAvXLKB44AmerJ6UFYjX5ly933UzOm2KsTR4pIGHRsj6vZvjCb6cJUxCAhFOn9Nq+B984TeNTomCglYVc3p5XRVAsSVL+MBT1EfNoz9qSec8sHiufnsgHG6cre6DDriv0HD+yfg8tCK7IX0HbETb2aQXgNNFvdnSL5S6rqbffctl/ivfj3RsZmJCcaxwrWR6khmn6nzOkqNeKSMjmpAxSTdAlve6EFFWqvFz4D0LpYpk/73kyaWvczuzV//cGlYBwVOBA9CPCyAexdrQ78wbzn0zaCdo7yKqTQtgZestXnyCICUyrXm+1WQzd8W/lGHtr/hV7D3H//RQAGxnlWERvWCZlYIF6xkz9eApvWl72gE4cwzcgme+1+EkyPgSmLgtyh78B/kucEZC2Qy2chGJEAlwJln02HxbJ0RX8Bo1ko+kxCHzZl12zA02A1yzQGzEt7Oya9K/wrhWX8plYFK4Zq811yHmVqJEeu5bseCSi+O0tHmnl5vafRFyjw=
+    oidc-client-secret: AgDML2QiPv8lLkyYYOXVI7IY+F3F6x4AoJP7OwNWcFzN699HTvud78sYW1zs9P3BX8FfUArkXHZhjG07OyP5HYxtbUvv4t1IyJaMqg1NsBSB9F3QPEVoanrEIwfUbrzbIcCjD9J0RRrf7aBeAL+zTI1odEOFQhdXwrwEliombjLTcjMMBZGW8IVAQ8/2Ip+Vl8fIGpoS0kP6PGW7NZMTehxBMImyLipzJeYrg2gHN8dlHgE+TWKIuAxV0TSmWV+QvjW6ivSWEwDOabGvQ9GxH3DCwSvPM4kEm5SfFXodzyEvFVsK0MFyY/TvsIU8kursZrSWNlhu437ncjPp4H9X/AYikYHqUnx0hbLRqspIP8OmdNu4A3VdQjGVJcqwsSWmKBIpXrKaoO2GmQQWKKhmbFfgJaCXDmnPBG1A4ngLnNzFdG4JuT5zZwfQRLe0BHxkVbTaN2MtsU47G2dS55TXoJk8q54Gi/buarf0eNj515DsgiI/CqaUchp3I9U+SWC4cHtAF8EncC1qbfqtMTpI/mEsK+L3RxKZFq0EPXmrOLYbrqjA4H44l7cdg8/3aVxmILCh0wleytUuYnQG0u1+vNk/5H73F+RZQT2UbOzQZ5VVIvzT1vNgu8EAfX8+HWvbRANuGB+4hAdOLv73myL2qnxyz3N5btXFOGbjDjAkxeLKf/qEsAXUBPiBGPh5NEdCEgMSzrgvdtfzQ/BzT8i0xUPBzjVvXAQQckOprZAuz9IOq5N4Ug7VRFgktyDpzQ2acpcWuxeq4opfrj5PGM5rUPkv
   template:
     metadata:
       name: wireguard

apps/wireguard/service-admin.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: wireguard-admin
+  namespace: wireguard
+spec:
+  ports:
+    - name: http
+      port: 51821
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: wireguard

argocd-apps/add-ons/alloy.yaml

@@ -0,0 +1,164 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
+    argocd.argoproj.io/sync-wave: "4"
+  name: alloy
+  namespace: argocd
+spec:
+  destination:
+    namespace: monitoring
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    chart: alloy
+    helm:
+      values: |
+        # Discovers pods through the API and pushes their logs to Loki
+        networkPolicy:
+          enabled: true
+          ingress: []
+          egress:
+            - ports:
+                - port: 53
+                  protocol: UDP
+                - port: 53
+                  protocol: TCP
+              to:
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: kube-system
+                  podSelector:
+                    matchLabels:
+                      k8s-app: kube-dns
+            - ports:
+                - port: 6443
+                  protocol: TCP
+            - ports:
+                - port: 3100
+                  protocol: TCP
+              to:
+                - podSelector:
+                    matchLabels:
+                      app.kubernetes.io/name: loki
+        alloy:
+          configMap:
+            content: |
+              discovery.kubernetes "pods" {
+                role = "pod"
+                namespaces {
+                  names = ["garage", "postgres", "redoost", "traefik"]
+                }
+                selectors {
+                  role  = "pod"
+                  field = "spec.nodeName=" + sys.env("HOSTNAME")
+                }
+              }
+
+              discovery.relabel "pods" {
+                targets = discovery.kubernetes.pods.targets
+
+                rule {
+                  source_labels = ["__meta_kubernetes_namespace"]
+                  target_label  = "namespace"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_name"]
+                  target_label  = "pod"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_controller_name"]
+                  target_label  = "workload"
+                }
+                // A deployment owns its pods through a ReplicaSet named <deployment>-<hash>.
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_controller_kind", "__meta_kubernetes_pod_controller_name"]
+                  regex         = "ReplicaSet;(.+)-[a-z0-9]+"
+                  target_label  = "workload"
+                }
+                // A cronjob's runs are Jobs named <cronjob>-<timestamp>.
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_controller_kind", "__meta_kubernetes_pod_controller_name"]
+                  regex         = "Job;(.+)-[0-9]+"
+                  target_label  = "workload"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_container_name"]
+                  target_label  = "container"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name", "__meta_kubernetes_pod_label_app"]
+                  regex         = "^;*([^;]+)(;.*)?$"
+                  target_label  = "app"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_node_name"]
+                  target_label  = "node"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
+                  separator     = "/"
+                  replacement   = "/var/log/pods/*$1/*.log"
+                  target_label  = "__path__"
+                }
+              }
+
+              local.file_match "pods" {
+                path_targets = discovery.relabel.pods.output
+              }
+
+              loki.source.file "pods" {
+                targets    = local.file_match.pods.targets
+                forward_to = [loki.process.pods.receiver]
+              }
+
+              loki.process "pods" {
+                stage.cri {}
+                // Changes on every rotation and would start a new stream.
+                stage.label_drop {
+                  values = ["filename"]
+                }
+                forward_to = [loki.write.default.receiver]
+              }
+
+              loki.write "default" {
+                endpoint {
+                  url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
+                }
+              }
+          mounts:
+            varlog: true
+            extra:
+              - name: storage
+                mountPath: /var/lib/alloy
+          # Tail positions survive pod restarts, so logs are not shipped twice.
+          storagePath: /var/lib/alloy
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+        configReloader:
+          resources:
+            limits:
+              cpu: 50m
+              memory: 100Mi
+        controller:
+          volumes:
+            extra:
+              - name: storage
+                hostPath:
+                  path: /var/lib/alloy
+                  type: DirectoryOrCreate
+    repoURL: https://grafana.github.io/helm-charts
+    targetRevision: 1.13.1
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

argocd-apps/add-ons/anubis-operator.yaml

@@ -1,28 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: anubis-operator
-  namespace: argocd
-spec:
-  destination:
-    namespace: anubis-operator-system
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    kustomize:
-      images:
-        - public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
-    path: config/default
-    repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
-    targetRevision: v0.4.4
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/argocd-dashboard.yaml

@@ -2,6 +2,7 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
+    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "3"
   name: argocd-dashboard
   namespace: argocd
@@ -11,7 +12,7 @@ spec:
     server: https://kubernetes.default.svc
   project: default
   source:
-    path: infra/argocd-dashboard
+    path: add-ons/argocd-dashboard
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
   syncPolicy:
@@ -20,3 +21,4 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - ServerSideApply=true