feat(apps): Enable network policies for redoost

feat(authentik): Log in with Google only
fix(authentik): Accept token requests without trailing slash
2026-09-26 11:49:21 +05:30 · 2026-09-25 03:20:54 +05:30 · 2026-09-25 03:14:16 +05:30 · 2026-09-25 03:07:31 +05:30 · 2026-09-25 02:35:12 +05:30 · 2026-09-25 02:21:49 +05:30
61 changed files with 968 additions and 245 deletions
@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bentopdf
+  namespace: bentopdf
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: bentopdf
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: bentopdf
+    spec:
+      containers:
+        - image: ghcr.io/alam00000/bentopdf-simple:latest@sha256:3d62b8f8eece5fe947026ac3925ff08fda245b3d6ba2c3916b94da91e0010c74
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          name: bentopdf
+          ports:
+            - containerPort: 8080
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            limits:
+              cpu: 100m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      securityContext:
+        runAsGroup: 101
+        runAsNonRoot: true
+        runAsUser: 101
+        seccompProfile:
+          type: RuntimeDefault
@@ -3,8 +3,8 @@ kind: HTTPRoute
 metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "2"
-  name: stirling-pdf
-  namespace: stirling-pdf
+  name: bentopdf
+  namespace: bentopdf
 spec:
  hostnames:
    - pdf.whyredfire.dev
@@ -15,8 +15,8 @@ spec:
      sectionName: websecure
  rules:
    - backendRefs:
-        - name: anubis
-          port: 80
+        - name: bentopdf
+          port: 8080
      matches:
        - path:
            type: PathPrefix
@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - anubis-key-sealedsecret.yaml
-  - anubis-proxy.yaml
+  - deployment.yaml
+  - service.yaml
  - httproute.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: bentopdf
+  namespace: bentopdf
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: bentopdf
@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: garage
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgCviDZEvLfdKldhAtWubXmCxvCym6nEFBERMBDbfMftsCQdRdWFwAZ3IkQF5PqyBCjZ8jirQMttmXqL1GNKvJfEDkK4rwwYGkLpRM56IpRtkGhGHgYQOIYTa9RHzJm5OjPKnVppCRpb4Qe2MKczg8Uhp7Z3hW1HMDzK85Rzn2k41qcGqMRwEgDdmFVJxB9gviM76jcrgjnyNJvoIMinNwqRdTHmXnY451xDkBofEzkTXZC7plW42/3Vz/66bdqtHCmM68hZJkluki86ubHJqPIMuA55BJM7CRJTgKhk5va4Ex3j4RlTSF7ai+EGmF+jq6ls8Dn1QU12Osak97MulOEyCBHBQg3nnu5TZoFJKWT/Bgg0M9r1RuFyr6mrphVu6yMIIiROcyl95E3LjtMVC4o7+tWgkYmIOjYafQdpf7p6I2QPG4P6o/6qkEUWL1tqqYjk9RZ+OuOuBWe399in4OnRgfV+ZOJcCKXIsgbW1uVAiQL3lGMGI9/sDLxKtimpybGOX5F9f3O7mqFZ7FzkdvhgUtWkY+PUJIZHFNUSlF+ttmrj3wtq4JOpFdPYZqcnTCFFtwk+yDos8YWWjF0TX1RhM8Yq/+VBOVVaJnlhaolIKHiMds5JBGypsPjEBmP9fJ1ip4TjCyCP3p1/YscksgqjUWOCeASO9b50ce0OJzL9yHMGurffianLWR768q/1Zi5WQv6B9vJxCICa9TCCYgLOz0LUu0iiMd5hlPX0/i4gWi9KykIcSYHJ/RuE9+4jaqkYsTyhOipKPpkpjsqou9y1
-  template:
-    metadata:
-      name: anubis-key
-      namespace: garage
@@ -1,44 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis
-  namespace: garage
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: garage.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: garage.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: garage-ui
-      port: 80
@@ -15,8 +15,22 @@ spec:
      sectionName: websecure
  rules:
    - backendRefs:
-        - name: anubis
+        - name: authentik-server
+          namespace: authentik
          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: garage-ui
+          port: 80
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
      matches:
        - path:
            type: PathPrefix
@@ -2,6 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - sealed-secret.yaml
-  - anubis-key-sealedsecret.yaml
-  - anubis-proxy.yaml
+  - middleware.yaml
  - httproute.yaml
@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: garage
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true
@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: garage-s3
+  namespace: garage
+spec:
+  hostnames:
+    - s3.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: garage
+          port: 3900
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - httproute-s3.yaml
  - sealed-secret.yaml
  - service-admin.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-s3
+  namespace: redoost
+spec:
+  encryptedData:
+    REDOOST_S3_ACCESS_KEY_ID: AgC0A+pQKuYKMLfMPRAtL6a3PBEkwgghd7IbH8ZGhgU086s23NvbOBM5sHHkApqOiQ9z2LarAfvvKpBdxlQTjInxhqdJ1lW/zkWHokHhSn/L4ule/efU18a5gXsxNXN0Mon9PZrS9wKAFR9ZNiEDFa2/L4iUtCesUR/MneUFqqqibxiUgt2R8sMmRIzP9O0b8T7vnw1EkgyO4HWpWlLrGPnBryWA4OEj9CGLrTT7Z8u3Z2J5m43dELfmzdAH4gM3RQPXAzAMY+QyxnhtGA6x52OTcD8XxqB1lW/dWzTq+zCjnmRR5HbpWjeuM6ojlFJZoBLxYRRMZowMEKFX4egKUvGEDmSKOX5Z+Hn5n11dyRFhpKrMU9vy+utLvVtDM/rr5NqK1Bna0u40VdUUwpdoqAWUevw9yLld2QzOg06hjqQwpqVER7E1VTDKjVXveacaN7si+63abaw649eAaFhTitMEE9ORHZ7Fz3YZB5zdqnEQWZwzczJhhvqzNxP0pg1/JCEVrKYVfHCtuDoJ0BCeiuFPWU8lKYhYoxRzm6biWhdevM4o5CobnCedH/O+TDq6iPDDgC9iBNHIQjwfUAjjq44OXfl7X9+J3Q7xm7BYMD+/8LvycbBauFtOnkj32fyuUKF/EvoQF/AIQ3TX6rC/CkbIMT+m+mcAx75CB6hfpBFOMRKgpTT7WNR1zs6YrSEzNNQq95KvTIMVYEEKm+gjrnpv9mkCkCmSJPCWsw==
+    REDOOST_S3_SECRET_ACCESS_KEY: AgCp8zFoy+Clr5qY/57jfSwYT44a2jwTFzHgOPoYfE6LXXtis40QjrteEjyc9oE4dE2IlR3wY85twCcqMEbJW24mkTbQf5E4B4V5XaUTi2XhMkrms1tfwaKJzYJiPfoS5u/WyrMN7LK/pqryEVGODKh/57PNoEDK/N/ab7w1iKfxGQQVuwDSCdsT3RtrinzKXKHUFsR4f3wpOAO9nh/53atgZ9MMs+6DFLmkdXvIfjgJ/PqCrtxKx3hTXFNhrwbDIUJFF/wF9SUy6C2CyHCycdeU5HJFSahCIRMZvFAhDrl0Ubsi/MFgWsQouj2q6VEK8VAWDttCJaiSf9g/KhELneKCYC7qo7e4PzhHhAHUGO5fILWxd7HySj4CxSiCDiF3kIqVUXo/sqlbgBNMvPb+NNqo19g27jcFZPh/AZZkuBSxsdmEYfgg1RAcYmwPGUxksRcj36yknYjX4pMxJNqVGDH1nLsplOa5b8h+evxMnjK6oNduRP96zHd+Qo4sC2ThBF3Ar8STJpbbJ+KgdW1HnHo38JYd0J8q/pcVq5xY3+VX8Gy8JSrb9wdFMZnb+iWmyL/GNwLIqqbZw1zcKF7Rru78fl8Y5VWDnrpbjn1buqDxwyFkDhcxX9WISoAPKXP9K2Cs5UOIKwu50cOAyA+cMOMsYbTnkvAuDMZ5aBPp80j0TQLu4luPPvKG1RumhYxGthmEpwQaPyXuJfhOBbuVrsiNlaCKe+d3Jv9l3Y4PVlTBJg7ZD7YpfLoyvt1Y9ELAI5qiUjZ4Ru5TxX2lIqZOoZ/G
+  template:
+    metadata:
+      name: redoost-s3
+      namespace: redoost
+    type: Opaque
@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rustbin
+  namespace: rustbin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: rustbin
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: rustbin
+    spec:
+      containers:
+        - env:
+            - name: DATABASE_URL
+              value: sqlite:///data/rustbin.db?mode=rwc
+          image: ghcr.io/whyredfire/rustbin:sha-75418bf
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          name: rustbin
+          ports:
+            - containerPort: 3000
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /data
+              name: data
+      securityContext:
+        fsGroup: 65532
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: rustbin-data
@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: rustbin
+  namespace: rustbin
+spec:
+  hostnames:
+    - bin.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: rustbin
+          port: 3000
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - httproute.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: rustbin-data
+  namespace: rustbin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rustbin
+  namespace: rustbin
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: rustbin
@@ -0,0 +1,33 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: splitpro-db
+  namespace: splitpro
+spec:
+  bootstrap:
+    initdb:
+      database: splitpro
+      owner: splitpro
+      postInitApplicationSQL:
+        - CREATE EXTENSION IF NOT EXISTS pg_cron;
+        - GRANT USAGE ON SCHEMA cron TO splitpro;
+        - GRANT REFERENCES ON cron.job TO splitpro;
+        - GRANT EXECUTE ON FUNCTION cron.alter_job(bigint, text, text, text, text, boolean) TO splitpro;
+  enablePDB: false
+  imageName: ghcr.io/whyredfire/postgres-cnpg:18-sha-62e724e
+  instances: 1
+  postgresql:
+    parameters:
+      cron.database_name: splitpro
+      cron.timezone: UTC
+      cron.use_background_workers: "on"
+    shared_preload_libraries:
+      - pg_cron
+  resources:
+    limits:
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  storage:
+    size: 1Gi
@@ -0,0 +1,108 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: splitpro
+  namespace: splitpro
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: splitpro
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: splitpro
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  key: uri
+                  name: splitpro-db-app
+            - name: DEFAULT_HOMEPAGE
+              value: /balances
+            - name: HOSTNAME
+              value: 0.0.0.0
+            - name: INVITE_ONLY
+              value: "false"
+            - name: NEXTAUTH_URL
+              value: https://split.whyredfire.dev
+            - name: NEXTAUTH_URL_INTERNAL
+              value: http://localhost:3000
+          envFrom:
+            - secretRef:
+                name: splitpro
+          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
+          livenessProbe:
+            httpGet:
+              path: /api/auth/providers
+              port: http
+          name: splitpro
+          ports:
+            - containerPort: 3000
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /api/auth/providers
+              port: http
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          startupProbe:
+            failureThreshold: 60
+            httpGet:
+              path: /api/auth/providers
+              port: http
+            periodSeconds: 5
+          volumeMounts:
+            - mountPath: /app/uploads
+              name: uploads
+            - mountPath: /app/.next/cache
+              name: cache
+            - mountPath: /tmp
+              name: tmp
+      initContainers:
+        - command:
+            - sh
+            - -c
+            - until nc -z -w 2 splitpro-db-rw 5432; do echo waiting for database; sleep 2; done
+          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
+          name: wait-for-db
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+      securityContext:
+        fsGroup: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - emptyDir:
+            sizeLimit: 256Mi
+          name: cache
+        - emptyDir:
+            sizeLimit: 256Mi
+          name: tmp
+        - name: uploads
+          persistentVolumeClaim:
+            claimName: splitpro-uploads
@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: splitpro
+  namespace: splitpro
+spec:
+  hostnames:
+    - split.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: splitpro
+          port: 3000
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - cluster.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - httproute.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: splitpro-uploads
+  namespace: splitpro
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: splitpro
+  namespace: splitpro
+spec:
+  encryptedData:
+    GOOGLE_CLIENT_ID: AgDRctXaM2WUp9CYS1HQaxq1F6qJ6wyuV5PRK1hhSYCGCpZwId6mT/M+YCGiPnvAqR2W0L0cJ199ytZ5aV7UBrgbLG6XK7jN1txxpdWTSq0pONPj2jOrUvqdToA/6hUCsQBW6oqshbhjV/H53PxmKzR/t2zTQ0xoI64FK81INBsyaCY1gzdZQWYZCkmDhBUrvzfprcI6ayTvOtMhJkXMFU/TNielxjQtmRKnjz1wqyKZkvie7ZS2oEzU7R+VuuoMQVyL/N1pcu8rd5/WaJxJNgtG0oTFtJMQMCKvV80nXRWTXaTCGtpd4Ior+COgUW1ruzxU7HvrOMeQk/pwRPtVuANA5XUgwABWJH+RMmSDTsmqFlqaIYluE4swYGeR2dvEVWv4PN7YjBuJzYrWOCntp571JLw9jJ8ffCCEETQiEYc65ZMochp1rayZaHFJXAoorS/AbOK5fBYpdwM7R9KYl9tGxYzNcqzihezqb2hZuIIyEQnCtKPJl68TywiDXcUiftwlIhf56v2Us9nYaHRsIVstot1FhkrO2DqYrRxJ9/k8wPeJjPFCqrpx56y9bqRiyq4R4tfAKv/iHTZ2d8hVUZ1Pr/bc2pqwjxtjzBlGBXrAC4xSQWf463wk5IvY2dthRq0LZsXd7c8zV8QN9ZGwtWgWulNB/VXIsv0LoI7lmujWbCAGcis8helOo1wRgYE/NVeD/SEpJGEPkzx9XRuplj+00WsjOYmsbfvtQIcOOJbEtM3d6vqLd+SeFswSg1z01YFX6gagPhHCbDqfy0+DFkkM3QVsAPxKrBwT
+    GOOGLE_CLIENT_SECRET: AgAkBnqzqC9srhWzQA/q7ZfMpgfTy+J0on856vHPrIS8oe5P30vciaGlgkQdf1oMLA5ovHaSq6x9AEqv7HRzoeSrdUSjswZce1akAcXU+wA0mQGzVsmaTpCERAJ7GXWmSgsvIQNQXF5N6BLiZliueDiMIy3sZYAcoffrZ5l22mWOSBlHCXXZqZoP+F4Y4tQrlO28NjlWGo1UBf83JZ6TZMtK7IOuYoMDsZo/NlE1x0zj3beMm1VLvHJXRn1plU06IwlIKH0xEed2izff4FQ7f4Q3Dqmtbz6PhTdVqy4HQvhIrkAl/6IwQCZdTWHRdgv6fXQWs+ZftoeRMHFXI0xB3YfbLoqO8Q2kDqgxSOM8Xixdbabq1v8u0EVZCNRryb+XuWwG46xWNPVF2Nl1SIaeLxWQhFGEXTUf9IqYH9fQ1kpqIlj5IgEa1MUWsx1eE+vik1shT20woU7Lj21Zcu3RZob92qMVNZHheB2Lzkcw+dP1BwRIwXTiLXfdyDDHXlajnkvkkrrcwO62K4zEIIS/LyoLt2vdk63mfXKSz343pnpOsN2hEqJSTkCx3CFhB4JBSybSFrBtljcCDjK95dvsTQq8qZKEqLFZEQjRWXxsiR9aoNo2MCmPA+dDfvsJ7/GZ8mnjyNdLw+UCxrTiyXMI0pAgezZZZf96KPGUL+LnRbJiTHxxsfk+q2/nMZeU+ftZdV0F7zrCUQhkyJZwhYk2XsblyHiKsPCvLHtKbhIXVpwnLdXPgw==
+    NEXTAUTH_SECRET: AgCdNnXbHEuOlg1UnJii5eGJVfBZh5nWaybBODJJK3FbyhYPuj2KhGfNB/ld529FpddAEDv1IGWwKAOaSCkhSv1Nh1P2NZj37jpgbsHx8vw1omLLSkWqtRf1m4AhHhEwQoY49dlAk4AxSkjk5IckH8PbbRWFXx8Ns8kAGrJLrp6i7EbxrkI3U+hbEz93sQwRJo8XOeYCEodr7JPKoYHwy5roAwB0PmFL56bZFfuCa9yEje4BFxdQMrm0grSDMotTDH3nTF6irq5HSOEgqnL7Tt3kHW+Uaz5mvUZcCxAMUoB9q2mjTjm8fiprybVfMmCsib3epcZGrn0DiPZhihePkrfL6vTaz0pm1Nr7qkbtXFVY3RWgZjFpmDyAl/of7ddh9VYQVmqVAhfI610Czqqyou0zFuvlOXGlp1ljp7FNiwo+r02WxYoJ1leikB+CCnVxd/ErELA0AVneGUcWzoKG6r+OlDzsfV/gp2LXanAq2jKyeZ09ARhkLs3PHzkoGDaOF1Dr+3ZCidrfV+GRcnr73P7QEQNO6R+tEmL+idKiLr4uI56zrFg/Vb5Yxk/jMr2Hrfw7ai/nV2A+eqgXFQammCEZlDyCS8GPX8ULervbG/n4JmXXMUtGB9esM40cfTlsNhhv7sBC2P8QkOI00wvgdiwcPkOE+1i33Sxd1Vt20d8EP6TMfwhofQz2zYdYQEWYmBgiG+zX7mwwh3awuA5uH+ooA5vFe/aHPvMYM2rbTYDihEISJt1b6cbCiE8+Iw==
+  template:
+    metadata:
+      name: splitpro
+      namespace: splitpro
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: splitpro
+  namespace: splitpro
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: splitpro
@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: stirling-pdf
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgA81eNBpnSj7I5hSRoZxhU+d3+7u8xM93SzO0eNbMJ448rgvDG+MHzmmLgIxXlE2Sf7OS98+Xwi29eePt9+EiMrhWV5tqgy+gKAFYq1SEEe9tkMn5Ie/rdBgAfdwgnerg2kjLLeRnqeJOaqrHXXcMuxUFM7nc0DwqHe5dLPqVysJGQy4dGzBo+QxvYJuQ7TPtDXEGdE41AchPcR/2UfV7dGH8pqldqlFSJlb0M4rj/2XvinHWEKzPb8mXOHQ+aaENgm4NHTMJ6wjFX1VrO+MAQ7Ktm4ttcF4U/7PMwpMjBF+MaPmdGhFxnENOTvLhV/qcHw3qEDzsEFCosbMAJ4UxqXi0DwdqHYdfsp6bus0xL7RLrQxQw0SQmSYL0Cy+S78/3uk4EhBthvfi/VcJw536WvxZZrzhVp1ItRn9nUWI/oh1iNHAlyXQbMkmWIGIDC8iXtvE0DVWa8Ui16X14dPAZg7z1BAbjPZ+oi1MjcO4kuqVoDknkrBJxMEMYTxtQ8nbqDsKbTA9kNLo0JCmHOiP9l3/4f6hVw/B8uB5O6O2Vionz5U0AsnrunLMNvfeYleaS9290m+msg6T/umr7BgrVNXUEkG3GfJZ3xt8urHNjwXb/ESG5T5JnPYIRdTcITLuzLSKul5lBL+4PT3zOdjt9G/XD6HootT+AN9DuvfebM08RtMIK1mpI3Gx2owcKHxICIdgV/oaIGpe1q0L21jDp5sd30wm/3rfr6eKq1zuDiObA6N6EHI/7224Xw0sUuN2GmnRJ6RA5BQSXwSdeGqdG3
-  template:
-    metadata:
-      name: anubis-key
-      namespace: stirling-pdf
@@ -1,52 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis
-  namespace: stirling-pdf
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "4"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: OG_PASSTHROUGH
-        value: "true"
-      - name: OG_EXPIRY_TIME
-        value: 24h
-      - name: COOKIE_DOMAIN
-        value: pdf.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: pdf.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-      - name: SLOG_LEVEL
-        value: INFO
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  networkPolicy:
-    enabled: true
-  target:
-    service:
-      name: stirling-pdf
-      port: 8080
@@ -3,6 +3,8 @@ kind: Application
 metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "1"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
  name: anubis-operator
  namespace: argocd
 spec:
@@ -0,0 +1,55 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: authentik
+  namespace: argocd
+spec:
+  destination:
+    namespace: authentik
+    server: https://kubernetes.default.svc
+  project: default
+  sources:
+    - chart: authentik
+      helm:
+        values: |
+          authentik:
+            error_reporting:
+              enabled: false
+            postgresql:
+              host: postgres-rw.postgres.svc.cluster.local
+              name: authentik
+              user: authentik
+          global:
+            envFrom:
+              - secretRef:
+                  name: authentik-secrets
+          blueprints:
+            configMaps:
+              - authentik-blueprints
+          server:
+            resources:
+              limits:
+                memory: 1Gi
+              requests:
+                cpu: 100m
+                memory: 512Mi
+          worker:
+            resources:
+              limits:
+                memory: 1Gi
+              requests:
+                cpu: 50m
+                memory: 384Mi
+      repoURL: https://charts.goauthentik.io
+      targetRevision: 2026.8.3
+    - path: infra/authentik
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
@@ -1,11 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - anubis-operator.yaml
  - argocd-dashboard.yaml
  - argocd-repos.yaml
+  - authentik.yaml
  - cert-manager.yaml
  - cnpg.yaml
-  - gateway-api.yaml
+  - postgres.yaml
  - sealed-secrets.yaml
  - traefik.yaml
@@ -2,21 +2,21 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-  name: gateway-api
+    argocd.argoproj.io/sync-wave: "1"
+  name: postgres
  namespace: argocd
 spec:
  destination:
-    namespace: default
+    namespace: postgres
    server: https://kubernetes.default.svc
  project: default
  source:
-    path: config/crd
-    repoURL: https://github.com/kubernetes-sigs/gateway-api.git
-    targetRevision: v1.6.1
+    path: infra/postgres
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
-      - ServerSideApply=true
+      - CreateNamespace=true
@@ -14,6 +14,8 @@ spec:
    - chart: traefik
      helm:
        values: |
+          ingressClass:
+            enabled: false
          providers:
            kubernetesGateway:
              enabled: true
@@ -40,8 +42,19 @@ spec:
                  - kind: Secret
                    name: wildcard-whyredfire-dev
                    group: ""
+              websecure-dpdns:
+                port: 8443
+                protocol: HTTPS
+                mode: Terminate
+                hostname: "*.whyredfire.dpdns.org"
+                namespacePolicy:
+                  from: All
+                certificateRefs:
+                  - kind: Secret
+                    name: wildcard-whyredfire-dpdns-org
+                    group: ""
      repoURL: https://traefik.github.io/charts
-      targetRevision: 41.2.0
+      targetRevision: 41.6.0
    - path: infra/traefik
      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
      targetRevision: main
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: bentopdf
+  namespace: argocd
+spec:
+  destination:
+    namespace: bentopdf
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: apps/bentopdf
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
@@ -27,9 +27,7 @@ spec:
                name: garage-ui-secrets
            auth:
              admin:
-                enabled: true
-                existingSecret:
-                  name: garage-ui-secrets
+                enabled: false
              jwt_private_key_secret:
                name: garage-ui-secrets
            cors:
@@ -20,7 +20,7 @@ spec:
            singleNode: true
            existingRpcSecret: garage-secrets
            noClusterRole: true
-            # No discovery or website listener is needed for standalone S3.
+            # No discovery is needed for a single node.
            garageTomlString: |
              metadata_dir = "/mnt/meta"
              data_dir = "/mnt/data"
@@ -36,6 +36,12 @@ spec:
              s3_region = "garage"
              api_bind_addr = "0.0.0.0:3900"

+              [s3_web]
+              bind_addr = "0.0.0.0:3902"
+              # Required; a bucket's full name also works as the Host
+              root_domain = ".web.garage.internal"
+              index = "index.html"
+
              [admin]
              api_bind_addr = "0.0.0.0:3903"
              metrics_require_token = true
@@ -1,12 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - autoregexbot.yaml
+  - bentopdf.yaml
  - betterslcm.yaml
  - garage.yaml
  - garage-ui.yaml
  - jellyfin.yaml
  - legislative-summarization.yaml
  - qbit.yaml
+  - redoost.yaml
+  - rustbin.yaml
  - scriptscribe.yaml
-  - stirling-pdf.yaml
@@ -0,0 +1,63 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: redoost
+  namespace: argocd
+spec:
+  destination:
+    namespace: redoost
+    server: https://kubernetes.default.svc
+  project: default
+  sources:
+    - repoURL: https://github.com/whyredfire/redoost.git
+      targetRevision: main
+      path: chart
+      helm:
+        values: |
+          appOrigin: https://redoost.whyredfire.dev
+          sitesOrigin: https://whyredfire.dpdns.org
+          httpRoute:
+            annotations:
+              argocd.argoproj.io/sync-wave: "2"
+            app:
+              parentRefs:
+                - kind: Gateway
+                  name: traefik-gateway
+                  namespace: traefik
+                  sectionName: websecure
+            sites:
+              parentRefs:
+                - kind: Gateway
+                  name: traefik-gateway
+                  namespace: traefik
+                  sectionName: websecure-dpdns
+          s3:
+            endpoint: http://garage.garage.svc.cluster.local:3900
+            publicEndpoint: https://s3.whyredfire.dev
+            websiteUpstream: garage.garage.svc.cluster.local:3902
+            bucket: redoost-sites
+            existingSecret: redoost-s3
+          networkPolicy:
+            enabled: true
+            gateway:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: traefik
+            s3:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: garage
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: garage
+    - path: apps/redoost
+      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: rustbin
+  namespace: argocd
+spec:
+  destination:
+    namespace: rustbin
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: apps/rustbin
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  name: splitpro
+  namespace: argocd
+spec:
+  destination:
+    namespace: splitpro
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    path: apps/splitpro
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    targetRevision: main
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
@@ -1,40 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  name: stirling-pdf
-  namespace: argocd
-spec:
-  destination:
-    namespace: stirling-pdf
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: stirling-pdf-chart
-      helm:
-        values: |
-          fullnameOverride: stirling-pdf
-          persistence:
-            enabled: true
-            size: 512Mi
-          deployment:
-            extraVolumeMounts:
-              - name: storage-volume
-                mountPath: /configs
-          probes:
-            liveness:
-              initialDelaySeconds: 90
-            readiness:
-              initialDelaySeconds: 60
-      repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
-      targetRevision: 3.1.0
-    - path: apps/stirling-pdf
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  admin.enabled: "false"
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+data:
+  oidc.config: |
+    name: Authentik
+    issuer: https://auth.whyredfire.dev/application/o/argocd/
+    clientID: argocd
+    clientSecret: $argocd-oidc:clientSecret
+    enablePKCEAuthentication: true
+    requestedScopes:
+      - openid
+      - profile
+      - email
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+data:
+  policy.csv: |
+    g, admins, role:admin
+  policy.default: ""
+  scopes: "[groups]"
@@ -17,6 +17,18 @@ patches:
      kind: ConfigMap
      name: argocd-cm
    path: argocd-cm-url-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-oidc-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-cm
+    path: argocd-cm-admin-disabled-patch.yaml
+  - target:
+      kind: ConfigMap
+      name: argocd-rbac-cm
+    path: argocd-rbac-cm-patch.yaml
  - target:
      kind: ConfigMap
      name: argocd-cmd-params-cm
@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: anubis-key
-  namespace: argocd
-spec:
-  encryptedData:
-    ED25519_PRIVATE_KEY_HEX: AgCR+UcOTNv+hAcK3jE3fb0AE5lQBuxl0Y7Yqt3Lg/Bhh89aPH2dRs0o2n/1MuCXNGOtBAXdyKtW6W3VtenD1uKsoz8da2UjO3+qvknLmrZzUqjcilmiJCS7POoECHhciCMJu1RrLkSQChjg+Kl6fZUbDSTK5GTh75yy7o1uRtXqbgXFtdVDYA8fwXLoAG4nWlSgRgGTUnTKTKooyx+ADEJOQWrFCP0zFkZJKUcGc60d6+5PyYGODDNjh1qed30O7xWyZcCVVUzeSkH5QCpBvALRzKLGBRjNTHAS4IGVelemPqsN5ti4w6fYGtkqi4OPuAuaC47kdEnLUvZeDB+Qxnwx6Qe7MEI4u8H2N6mP8jMH9MjQv4gzCTtPy90Vqikf7hJ0KFsI5CGXONbQkkyM1B3MNbyqkgmtZJchVbmeN9MZhZOS7JYUuexYosdiqRvyIOAWr1/rSN9LzwesXNAPojq8IZPDjIPcbFCBv1ROjsS/kXKawlLBMX+XEsQZUWUfTh9Cfn3N9muo4Sz+nQ11smXthSkVRaniJLIsd+MPXg/lHayP6MYWncPhj8ZZQHKwBNxsCHljh1cFsjfm/IrIDmre6eaREnsBrxh7QKtsoiWWclqgF4ziA4BVWHwkfpb1LjIQNDIkD+i66ijOmwpQoiCD8tWRKrvcGWy6bTDPMO0ErA5QVzDx8YMFmSC5Ii0iSWIR2ci+qlKgUHFedVnp2kOw4FyOxWsDnfJDBmwyPvXrfrbDcvSfKMTLn6VohWC4Zais5bIuhD0uAmCdfJzyRe+H
-  template:
-    metadata:
-      name: anubis-key
-      namespace: argocd
@@ -1,44 +0,0 @@
-apiVersion: anubis.techaro.dev/v1alpha1
-kind: AnubisProxy
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: anubis
-  namespace: argocd
-spec:
-  anubis:
-    envExtra:
-      - name: DIFFICULTY
-        value: "5"
-      - name: SERVE_ROBOTS_TXT
-        value: "true"
-      - name: COOKIE_DOMAIN
-        value: argo.whyredfire.dev
-      - name: REDIRECT_DOMAINS
-        value: argo.whyredfire.dev
-      - name: COOKIE_PARTITIONED
-        value: "true"
-      - name: COOKIE_HTTP_ONLY
-        value: "true"
-      - name: COOKIE_SAME_SITE
-        value: Lax
-      - name: DIFFICULTY_IN_JWT
-        value: "true"
-    image:
-      tag: v1.26.2
-    keys:
-      existingSecret: anubis-key
-    metrics:
-      enabled: false
-    persistence:
-      enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-  target:
-    service:
-      name: argocd-server
-      port: 80
@@ -15,7 +15,7 @@ spec:
      sectionName: websecure
  rules:
    - backendRefs:
-        - name: anubis
+        - name: argocd-server
          port: 80
      matches:
        - path:
@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - anubis-key-sealedsecret.yaml
-  - anubis-proxy.yaml
  - httproute.yaml
+  - oidc-sealedsecret.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-oidc
+  namespace: argocd
+spec:
+  encryptedData:
+    clientSecret: AgAuadGZNylY8/lomfIg8PybwBtfZ20BXDfNacgIMMdRanRgRnLhMghaZfcQbcGuKRaAIya/aIqbUKkQwat2elypOp374wvDHilnaQ0DQ4qCBGZlPLMSzyEoz+sSuB3c0YHLcj48DIF9b5b24jsysS9mllTQCeEBNsuXiEjEuSBUpu6EbR5ztRPnEi8OnuJYTMJtnMVX0iPEqEK4DsR/c7ActayVBG+sGDK/ZyACxyLg8cuhJ2p7SyxqCwqtaS4NaKC6d4WK+3LEQcAd65PWeSKbR7zv77EcUQ8yzaM3yDXIZMmgLMzynfPgyll9aLr31n2UOaNU2uZPT6JtlnPARU1WuzQHcRCdJBjuKneDahE2D3m7sClxUCNXTgXfZqsWl6/gSvZrREukQyJgIz6mmmN3rUjYRn0lG+0CU6o1uDFGHyn9GEmzTPT4zt/U0YD7LjwdR+tWHBUmzQCPbe2DcPQLb+OwyY0M9RC52btfJVyErjMXN7TP8ut1Gmf6p0phr9ebVH9hNAPWcfbWkNG4r8c4gzHDca9ULPrwjz1oJsNeHf6ZXu3Zu26xnFsLswSQqWSSpBrHA9F5bl3U3/ScNErD+wrP6lH6dqcGGJVpMMUhDDNBKkSsu8zL8M97x5MYZPwAI+EfNF5ijdzqZbgEU0iTjJv5fHX1i+rGhbzkfqvuI3ti/8CkcSB/dEAYQXwfmSrtPJISX1zEWhqzgIfIDuPk2BmD+rKmWL906+aff7M/Ns32wZlvN3eCPVjO9w80mkn6OJY11re0Si0eg4ksUZDH
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/part-of: argocd
+      name: argocd-oidc
+      namespace: argocd
@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentik-blueprints
+  namespace: authentik
+data:
+  google-login.yaml: |
+    version: 1
+    metadata:
+      name: Google login
+    entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-source-authentication.yaml
+          required: true
+      - model: authentik_core.group
+        id: admins
+        identifiers:
+          name: admins
+        attrs:
+          is_superuser: true
+      - model: authentik_core.user
+        identifiers:
+          username: whyredfire
+        attrs:
+          email: [email protected]
+          groups:
+            - !KeyOf admins
+          name: Karan Parashar
+      - model: authentik_sources_oauth.oauthsource
+        id: google
+        identifiers:
+          slug: google
+        attrs:
+          authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
+          consumer_key: !Env GOOGLE_CLIENT_ID
+          consumer_secret: !Env GOOGLE_CLIENT_SECRET
+          name: Google
+          promoted: true
+          provider_type: google
+          user_matching_mode: email_link
+      - model: authentik_stages_identification.identificationstage
+        id: google-identification
+        identifiers:
+          name: google-identification
+        attrs:
+          sources:
+            - !KeyOf google
+          user_fields: []
+      - model: authentik_flows.flow
+        id: google-flow
+        identifiers:
+          slug: google-login
+        attrs:
+          authentication: require_unauthenticated
+          designation: authentication
+          name: Google login
+          title: Welcome!
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf google-identification
+          target: !KeyOf google-flow
+      - model: authentik_brands.brand
+        identifiers:
+          domain: authentik-default
+        attrs:
+          flow_authentication: !KeyOf google-flow
@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: authentik
+  namespace: authentik
+spec:
+  hostnames:
+    - auth.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    # The ArgoCD Android app posts to the token endpoint without its trailing slash
+    - backendRefs:
+        - name: authentik-server
+          port: 80
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              replaceFullPath: /application/o/token/
+              type: ReplaceFullPath
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
+    - backendRefs:
+        - name: authentik-server
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - blueprints.yaml
+  - httproute.yaml
+  - referencegrant.yaml
@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: outpost
+  namespace: authentik
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: qbit
+  to:
+    - group: ""
+      kind: Service
+      name: authentik-server
@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: authentik-secrets
+  namespace: authentik
+spec:
+  encryptedData:
+    AUTHENTIK_BOOTSTRAP_PASSWORD: AgAPgYcs6IXUWk3VUgoPNQXwP43kEKP26OAJmu7dA4vTRhmWwmJXN8ybRhX7jS2YPwGWxAWflxiM3x7F3jUohOpqN37et4zFCoUq43mQ3blbTMV4zhsuyMx0JIqhsafzlVWiKqmqIykVq8yJQ6886FkIS0u14i//YTcs0QMS7gum6pDEhehAg+FhwiNgm92iVCyhoh+3rL549akXe53UJNKwVzuWavEHZFTKJNmFa2g9YzYcJgNf46f7maPbfSg09E27XC9L7KNxxiodU2h0D50La8LMEX+X0fAbLtrXPf9MsJjcfNvy0kXqy/AB+A5zL/Yh4uVztWikE27evDvfeoWc9svCTIbBzwx1EtR/nC71IvN61ADpFGbTXA44jSOtPg6nNtOAq8AEqIp0p3uNbQK17cEfbmDtq8husTYF1i6e+VFVGIltPiGdRSZb92xtLGkf63YfdYXSy+xaiIJ/8ki4vgw91KY0l5/9sS1BqWR312UUEAtOGt7M4cydVEWToc1AdYj3RDBgPjmqoddiR66EMzhCFz5sxlU/rji7j4DAOFA4gqAV5JAZO1HehNFp2GajTi36d0XLe06/Z+IbEmSeTlPTGZOvxTweYcWexplzp/ob/MwAaMouPRcmae4/VTlu9Lex1bMYugc6bD8B7V+gmM/MhY7heQl+mSyBV0CO6JsZwC1tipzcJfaiBzUF8sZ7Ast3v+7omsjFo/CXqxbPNZrolipiEjE9IT3n3r2m7gpIkv+A/ie77iJF8k6zFRM=
+    AUTHENTIK_POSTGRESQL__PASSWORD: AgAoQ04gX1QOUI5kfNMNy07pnaqDTp4X6LDlQBBwSs13SVGZCJAL61hQymOaL/U2cCyc0N5nr7FCswHcqBE8t1esKlK/NB+BL9aWfO7uPonhdzsc2iKBONZYickCyyD+8Hgu/McQDPVo6vMQ51/82WL2ZKfwJEfTKmo1OfJ/I2Tls2KmczzlkNrCC9M5moObXl+PJlKJuxAkeXJc61MSn/vvsvksG5O0AKtXHmTk8E1t7krAbOqKy9CbVwHJAwH/NIhiOgJr/KziceWhHHQiEwC631ZpM+fZWiUSKETwpnLWSl7s8SvsEUNA9s/W2w24tpqSKrHOZtS6J0sT84FsV9U9T5MaZtZT9NG3FmNehxQpIlet6BSyJh+JMq5LjzA8ANvVvlXs4jhJyTcotLf/m1ZJbetVjFGJjvxUbVuxObpMentVrAeLO8cZqk1iTzqPdkrEeV38DN2E9oJSyQeRP6sZTnDd9xweou8nwMZWidyIDorTKSwvggje2YDXefc8+aOVVCN7pBOwKisEuPH35Ov/A2RDzmE3mQRC3EDuHJ+3dZbVawIawV0ZUIL52X+ongbllOtHABUfODY7tTC/VQMk07d3/zG5q7bCE2D+R0XE4oQJy2h2wYHiYUoGYM5JKC2me4TIx6Y+haksl2mqfC/yal3FLWMBdK4eC9VyXugO25l4yLVOcKa/QMhImHB6lbyNLGDuafnIanMkraWo73EqqXpF3IIqfzfgkj4aOO3Cbuu6BeQ4bNmmam+cWLqq1QQ=
+    AUTHENTIK_SECRET_KEY: AgAHHDs8mbJRc45DFgap2VUZn/F+m59hm9u2lebuJv70HSBxLLsHEn8nXLGUO3b2ScyPt1Qi2wbmRDENTjOHOYHtAQAjwV25r6RUiZ5TosRH2KhGx5N6gceorYQyk18l2CkKv4ObXjeGLJA0EqMarmFWiT24SFZdtIrOvWygLxg4XGful2h1Fw5uXK9PiUHgptrp/G5M5Htv0bvtD6m/FrgOlK6C6tK1D4vLL3VLX3/SceqNWVDIJmJao5JKO4IZTQxN8TN5k9K2CGrtOUhjCn4vLbYQKTPhiiidoQaipQ9FR+4KJMO0y8FbIy+3q7C/UZPyOTOu/2zI4t5h4TJY1+477A80GTLpE0aCBDpmFwgZY728wbTW4NyfIm15u0Um7OXhnJkXC1EqDbvlK4HYHiSDUjGChvlfMEY+D1datDlF1fEuIaeXtTqowpz3uy9qIEa0f1emS2J8TjIrKH3oW3mfmrJKSiySnCX1704ZPlwOJfnF5Z2vM6Oqo/mWHa6PSwPPRxSxEKVtSqD4KynzrUmx3GkrUs+7tntepA3yQoiDjyUyE71FwhJXO4sE3XcRGDUf4rB8CFO4+NgTbBAqFzNKYG32GIDhGjbMxBAJQMNXZhVcKceiaXf7G8LuaOEw39BkdtiFCdK3uXl9xaQPuStRsOYYQR2Dt0vt3AvDGjAW+McauCbYUD3rcAtVMo+rxEbejrotojWnb1OpGX0JqD5gHC68qlqY6BYkDbWpYojoKWJHuHlYxHIm8k7ghSq6npw94R526bxripNtcNq4Lh1NeM55LKruOEGr7n0dFcyAmQ==
+    GOOGLE_CLIENT_ID: AgCV2Rwe/bHbkQ3nkkIs4EFTbsEqQWRaWlXa/fHzkDyNKpd0CTOgqVb6Rd2KYyvoT9iDR0xt/8reLPd9e7B3G3V1oVFV7G1XiErBmzvxr6591+tXzo8JLVpIy0363R87idi2xIKGVii+G5aJvxxhua8IRsNfi4SRtoqpDzjgNbFtm5UDhhlCzcRKkm0zHgLw83d4Uwszu9X9II2A4FuMPD6KvsTFrgHevR1v3OerKl5kvTlUx0O3XEg5mnNUVk46J+D9wfg58bIlgUhMV8NtfKa8I5zmRKhCJySks1zlCgIudCLX7wPYupFgt0nrZjJGx7a546ntPdMVE4IJ+VhlQ94gjdWsVFm07espaQLph9T4CZDKxb6TwyNswhfFxH1Z9auyFf3Cfk2wx5GChNOL0mZ8Zrzcw008c8IUShF8je8JZ60teBffbBNao7XN6JM6a4ac5aKnNwFch9IJUU1qkvcJaZk5hAkeGO9uHrICb6lkr5Rj7t4h9l4mvgfIKXP5YCCKZ+yqrSI8Jpkch/cB0Sphgp7m7QXgGwmWRgdKEk1rP7ioIfoF66mLsfgvOkc+1ySvPgW/rCLbHwzMqJn1Fkk/afbRoWp/guFj1cOY9MrEQIn8ftugeV/0xWiL+y5RyJm7QZc1z5fSj/NTrVCZV0LhBHttPZzoGGWEqjLYQnyJ8p38lK7EU6Pmk4WrEMj7mmdYHEijyPhab+b7guOc+ULbPT7k7sBHXbKrTTUJa09jIqSS4jl2PNrzPCPDIvRpG/cMgNklhNPfvpDQcLdVRA7bsf7navZvDsQ=
+    GOOGLE_CLIENT_SECRET: AgDNFpqV5LGekTMvOBtPE9c6ZVPtT6wN+nCFRhZnvBKIz4I7U9jzisEN7yhc4ud22XJXpS5oR8hN4H+V6Js/bCZMDJefYcdstmHku14kUvoLRUtwPV9tdjiihmb57VLTnT1s1OzbnOqZPwXoCAmGAPLDgZrghBi0id21GgjU41jCHDJCcH1j9RHhE20JwsVG2uz9Tcp6MVYh94aq53V4//bvFXz4xQgVlN8c1jJ/W4rrNM9vmYdMwKyB5509oVWJigowsRlji0FXurR8ovz1AXpMuGj6hUGxLp0uHsqz7FV/0lsd4B2BR9cVRChAR8zDCiiKb4TH2Kmn676/Z+gtJ8vcOQg/WDT1ENzOr6dyndCLVxJvJuvl1EqinzhSqJjUy11HxqULApKKbX1iRJIAIGb6dpeKVoHDKg5xtcWGwaD6epG/tz20agkWBMCFNq5aS80npz28W5GeOQ8aF4X/rpjuEHVLrN+n0pgyS4wjwniB6UJMYRIYk45r0ICUtqyFjOiNzpU70NsPmEjDyItW1EVo+6tb0lRmOI5apm/9yayZXjFISwTAFPdBMrQL+ij4AGw4HMWMmN0aqDO+Kd1c9Jg6wUKluN2Lb6CaxehWeSJiz2wTEhEz8KBkInfezgSekNkw4wjJiBEZ4/M3G6Y/C61ekuVFarRc87cY+S3SomVZDGQcPysfQlieMVpHlfXq/CSDgHhZV3Q+S/wqpy5ZcfsyaU+v4PmvyEc12MZxQ1RGngVJow==
+  template:
+    metadata:
+      name: authentik-secrets
+      namespace: authentik
@@ -5,7 +5,7 @@ metadata:
  namespace: cert-manager
 spec:
  encryptedData:
-    api-token: AgAWGbxZBGrznQxIKfKmKEqAwNKY025ojuhr1l2vgoj/dBJ3vxpKX2tYAxZse5gu+G5CiI+130atGPCqJxGB0oRTbeTi9Zyxhw+FclxGMcXrfqZtXVUANrNUmpVZMgMF5pzd04rY9WdvK9tQiXnDp4SayzpRpzoHgln5gvTeLaArOQ3NC/2Nx/Ka+ImFUvxPvCI8H3ANXuRlk3dFfnLN8Uwj3NXWmsmTphq4hDzHXc0IWoV26MFwoKftjfVlirlKbP4LBCp65mXdluu3/EsuA0P2AS2S0RkFAucBPCPe2z24bivMZgn61KBGIJJ/waJITQ5CfYMPWwzDhNuabdosNKW0HejIy5cYZxMOBTz1t8xGYhOBsNB3t3KbyOqE9qxDxdZqiPQbvM3zyagRPaucHt15tjUqEzHymi0GGFToixRcnlQAdVrxmcb6JRe7eVrful/PNB3rG29DEuiCbXDOfMPbScjDkxNpKgQTAXnhRaPrjR49dpW0pkNABn11DcU4RsckelfD5cdxt+E0Oe/P8nKcglrgHMFZLSV30JGT+WEv2xx1M7VFz7NdxyrB0K8f8/hf3f5lEEHqTzPfaWQUIL7ZBIOqbtqvlnlx0m70QOzkeMUQdTO5jo1MoZy7MgomOCGPAaXUhDrDtxYCgipmMIbjCo6RokS86YlvqE9BNTpxt1LXX6p0rLKTiN0JeumLTU0rmdvMBxP1dH0LyTd9GWrNvbX8ve6ikbPTo7xAPG9KwlO5M4pY9MJP
+    api-token: AgCqVfWKc3TVZOWN2kWfWcEe+5pf5lRMOzcQUjgI7Wd4/0cDogagn0fF3MR1+tcm4kaxXyn0GzZLoOT4mWetg/BoGYY6X4DYy6fsyFzpvpY8mtdwiTrYtzdORSz1qw2U3yerB1st//Cy90D+sw8V13MGDh0vD0OEtYG4Xf1foRTR5KClzHmy16gjp64d4dbFWLO1oa99drQkCGRPhHcDzcrT0bFOutjN52p8AVcjBlzDMpP2k/Wo9wT4MiDv+clrXwOVyvARk5DrN9KY+iRiB0NkBvHaVNkQ9M62sIUJ9asBwIWZCY/aV4xGEvx9LYxAWvzIqmXBy+DOlOo3gOavQCOBI7Gdz015V1oIsViLQXG3j+5m0PSbguCNCXQhF9zmgqoJgiEpC2aFcU9oCZ/JS/DTiD8Xq60JSyY8bQE/yMX3vHAnXm5HOe14WJ60GkjGXPsBWWjmtAeBltAUW1WJfkTnHm/aPBflpZBkuJgkCpL2iMERETi0e4UfOuvf06cN3testuFfR9sIn6aD9mMY4B9e+6TLbjFF5uSf/W9/aMhLLTG8Mh5pZneGDndfRm6IG3Lj506xLOo3CAOA9BYF7MiShrgtuLmDH/pd8YCRTxsboYigQ2LrobpaQnkKYjHqLWNJi/I1rXefmEXK1mR8zZKJzBIsz4NG9TTary9v34yL22n9L+RtWJhrsFDXQqz7C860J7ifa28VJObo1QZN9bzsWoTPzUjK/Yw1GvrVUVUAsNyzbCgUjFUbrydoPmpx4ntmj6fSxQ==
  template:
    metadata:
      name: cloudflare-api-token
@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: authentik
+  namespace: postgres
+spec:
+  cluster:
+    name: postgres
+  databaseReclaimPolicy: retain
+  name: authentik
+  owner: authentik
@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: authentik-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgALpscM7BiDoZuUSlAI39CZYz3DvSaHQwzOpZEKp4tqfEYQ1r2DALOAbi4l3+6LzsMo63RNv3SYlhxFcbjjrDMiiaaB47iKDEmbSW/LQTJibiaoy67rgTs8T3I4awQbHeylwJQr5nS0BN6MeYh87PCmqFc3Orc5kCokSL9j7gVwOqNkq27RMJkghulUxAEONQrixFOiCHTFWCD/IybR1olUUacz7nKxCTLmcqDfzimGlF92VBbFaUzZH5W+0yd59zNqjhnmslIRiqli/ZVB2Z5ECuqr4YmrSmaCQvR5mzRmNjpmAeqCF/byFjfanPM6ZZ4NM2x7flqu8sULzZfBdXWmhIy03jPFFDBIvznHHW6y0K2r8kqewkoUsKgJEgZcsEvwe/F/gode3ukI02LuD2dKMNjeDaf8A4xaRx6h9U9cDiggmpHPW2HjO3kLp6ViEGPlGm3JuisnqncsBgfIh1T8ZMpmuM0WgAe6E3hFHnR6vbWYfSIi6nrEcpfLL+F2bBGYdUFBfjflaxXzhPnGDJ29GEBuyJcHPVRTqBhybS9rl+77dhCbPEsC5GN9MdCdS3uVWyKN+xIV1f/cJNsUFhDyU2rbkbFAebJurjPbKi92HPDaEq6OK3kunN9nNEZ9rE7d6ouw/gQ5Uq3CmaNDiVDorFfaW5DHVbRnm3MLdbLoUuN1AlU96/cDuSqDZjfLB69iB/+nt8TQLHopwQxj9AajfMyF+y9c2XvYZWvZGaCE1fTEfpIJ2fV1McnwbFi0uHk=
+    username: AgA9pxBlPvKPAX/NaHHFSN1ypRxKmd8CNcs92+l3JpDar81IYWaQPG0p99wYxrBp0414GIhojpkWks7+lVDSgmVzw9T+JQzow54lRxe7dHFOzfAQx1oQyGp8AkiGtjAIdUx9kgYhM01xQUDYtFDe3XnhVUkvjQNARctWyX+o/vyYTnK5BMHZB6viQOWrifNUmPQQRFnB9oEPGVqysYlJ2+o1sMyJYXOiTEMVkuk0rFp8AE2WGeyfR0pFwhSyn2g7bbFvUoQbECiG4y83AKmpmX4p25bAlzsIxb1kgUpYlqZXGMqLuQaVBJsBs3u7sDUjQZFRfz3rH2OLfNGZcCGT3c9Ueg05eRpAyWHP1kHWmkK2Yl4kPcyx54bBk2yv2h4lW7DmlsG6jE6bzKPtMTJOiJdkqkNSkerd062ktWYrpAg6iuGWB1A7Et+J07JaWd6xfANRknvH/D+CEQHuRM5qEtM8HVLuTlKSxX464d0nNKUw0rrSokWJWT5olroc+VjaHyXdF6LEYmgNXxtUwa95q6k8J78ZLidx7SawbFC5d5ErFbkq+6xOPWeKzcDExtcMd9UF1Ti90Ybp5ncyxoQLXCWhSV9SxjeS+f6H8Cs7JM39kxeOfLvvxw9qz2rSW6qbimh5KaXmO8KK3BFtrui+k5tlnv6qJaRbtMUV+p7WyK36wBk1fUMR0lfK8FRuWfnUuslP2wk17vlkvto=
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: authentik-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth
@@ -0,0 +1,29 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: postgres
+spec:
+  enablePDB: false
+  imageName: ghcr.io/cloudnative-pg/postgresql:18
+  instances: 1
+  managed:
+    roles:
+      - ensure: present
+        login: true
+        name: authentik
+        passwordSecret:
+          name: authentik-db
+  postgresql:
+    # Each app role may only connect to the database of the same name.
+    pg_hba:
+      - host sameuser all all scram-sha-256
+      - host all all all reject
+  resources:
+    limits:
+      memory: 1Gi
+    requests:
+      cpu: 100m
+      memory: 256Mi
+  storage:
+    size: 5Gi
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cluster.yaml
+  - authentik-db-sealedsecret.yaml
+  - authentik-database.yaml
@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - wildcard-whyredfire-dev.yaml
+  - wildcard-whyredfire-dpdns-org.yaml
@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-whyredfire-dpdns-org
+  namespace: traefik
+spec:
+  dnsNames:
+    - '*.whyredfire.dpdns.org'
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  privateKey:
+    rotationPolicy: Always
+  secretName: wildcard-whyredfire-dpdns-org
Author	SHA1	Message	Date
whyredfire	96db9b3511	feat(apps): Enable network policies for redoost	2026-09-26 11:49:21 +05:30
whyredfire	7b94d671e4	feat(authentik): Log in with Google only	2026-09-25 03:20:54 +05:30
whyredfire	f553fd3cd9	fix(authentik): Accept token requests without trailing slash	2026-09-25 03:14:16 +05:30
whyredfire	ca90f591bd	feat(argocd): Use PKCE for OIDC login	2026-09-25 03:07:31 +05:30
whyredfire	b91cc2409c	feat(apps): Put garage-ui behind authentik forward-auth	2026-09-25 02:35:12 +05:30
whyredfire	e1da29adbe	feat(argocd): Disable local admin account	2026-09-25 02:21:49 +05:30
whyredfire	6a744d0525	chore(add-ons): Drop anubis and its proxy from all applications	2026-09-25 02:21:15 +05:30
whyredfire	b1224e0d5b	chore(apps): Drop autoregexbot application	2026-09-25 01:42:01 +05:30
whyredfire	db59b123df	feat(argocd): Prepare ArgoCD through Authentik login	2026-09-25 01:38:38 +05:30
whyredfire	4afa2a1e87	feat(add-ons): Add shared postgres cluster and authentik	2026-09-25 01:16:28 +05:30
whyredfire	a9b287d06c	feat(apps): Add splitpro application	2026-09-24 22:57:55 +05:30
whyredfire	8659225f0d	chore(add-ons): Bump traefik chart to 41.6.0 and disable IngressClass	2026-09-24 13:48:45 +05:30
whyredfire	19810bb114	chore(add-ons): Prepare for k3s upgrade to v1.37.0+k3s1	2026-09-24 13:41:35 +05:30
whyredfire	42e94b8d22	feat(apps): Pass Open Graph tags through Anubis for redoost	2026-09-24 01:01:40 +05:30
whyredfire	e69dced597	chore(apps): Use redoost's default image tags	2026-09-24 00:49:18 +05:30
whyredfire	e460030099	feat(apps): Put redoost behind anubis	2026-09-24 00:46:31 +05:30
whyredfire	c69767b489	feat(apps): Add redoost application	2026-09-23 23:46:49 +05:30
whyredfire	538ed748a1	feat(apps): Expose garage service to s3.whyredfire.dev	2026-09-23 23:45:29 +05:30
whyredfire	485db774f5	feat(traefik): Add wildcard certificate and listener for whyredfire.dpdns.org	2026-09-23 23:25:23 +05:30
whyredfire	4c9ea9a8b8	chore(cert-manager): Rotate Cloudflare API token	2026-09-23 23:21:00 +05:30
whyredfire	a4c3bd4179	feat(apps): Add rustbin	2026-09-18 16:17:09 +05:30
whyredfire	028069629f	chore(apps): Drop stirling-pdf	2026-09-13 01:20:14 +05:30
whyredfire	58e38d65ad	feat(apps): Add bentopdf	2026-09-13 01:20:14 +05:30