chore(apps): Add network policies to standalone apps

Charts:
- kube-prometheus-stack 91.8.2 -> 92.3.0
- traefik 41.6.0 -> 41.7.1
- loki 18.13.7 -> 18.15.1
- alloy 1.13.0 -> 1.13.1
- sealed-secrets 2.19.1 -> 2.20.0
- cert-manager v1.21.1 -> v1.21.2
- cloudnative-pg 0.29.0 -> 0.29.1
- garage-ui 0.12.1 -> 0.13.0

Images:
- argo-cd v3.5.2 -> v3.5.5
- jellyfin 12.0 -> 12.2
- qbittorrent 5.2.3_v2.0.15-ls478 -> 5.2.4_v2.0.15-ls480
- busybox (garage init) 1.37.0 -> 1.38.0

.githooks/pre-commit

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Normalise staged manifests to their kubectl kustomize output, so what is
+# committed is exactly what Argo CD renders. Requires kubectl and yq.
+
+identity='[.apiVersion, .kind, .metadata.name // ""] | join("|")'
+
+git diff --cached --name-only --diff-filter=ACM -- '*.yaml' |
+  while IFS= read -r file; do
+    dir=$(dirname "$file")
+    name=$(basename "$file")
+    [ "$name" = kustomization.yaml ] && continue
+
+    # only normalise files the sibling kustomization lists as a resource, so
+    # patches and components are never replaced with build output
+    yq -r '.resources[]? // ""' "$dir/kustomization.yaml" 2>/dev/null |
+      grep -Fxq "$name" || continue
+
+    rendered=$(mktemp)
+    kubectl kustomize "$dir" |
+      yq eval-all "select(($identity) == \"$(yq eval-all "$identity" "$file" | head -1)\")" - >"$rendered"
+
+    if [ -s "$rendered" ] && ! diff -q "$file" "$rendered" >/dev/null; then
+      cat "$rendered" >"$file"
+      git add "$file"
+      echo "normalised $file"
+    fi
+    rm -f "$rendered"
+
+    # normalising may have reverted the change entirely
+    if git diff --cached --quiet -- "$file"; then
+      git reset -q HEAD -- "$file"
+    fi
+  done
+
+# nothing left staged — prevent an empty commit
+if git diff --cached --quiet; then
+  echo "pre-commit: no meaningful changes, aborting commit"
+  exit 1
+fi

README.md

@@ -0,0 +1,40 @@
+# gitops
+
+Argo CD manifests for a single-node k3s cluster.
+
+## Node configuration
+
+These live on the node, not in this repo, so reapply them when rebuilding it.
+
+### k3s
+
+The bundled Traefik is replaced by the Argo CD-managed one, which is exposed
+via `externalIPs` rather than ServiceLB. Control-plane metrics endpoints are
+exposed for Prometheus:
+
+```yaml
+# /etc/rancher/k3s/config.yaml
+disable:
+  - traefik
+  - servicelb
+kube-controller-manager-arg:
+  - bind-address=0.0.0.0
+kube-scheduler-arg:
+  - bind-address=0.0.0.0
+kube-proxy-arg:
+  - metrics-bind-address=0.0.0.0
+```
+
+### Image garbage collection
+
+Kubelet only prunes images once the disk crosses 85%, so unused images pile up
+on a large disk. Also expire images that haven't been used in 7 days:
+
+```yaml
+# /var/lib/rancher/k3s/agent/etc/kubelet.conf.d/50-image-gc.conf
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+imageMaximumGCAge: 168h
+```
+
+Apply with `sudo systemctl restart k3s`.

add-ons/argocd-dashboard/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: argocd-dashboard
+  namespace: argocd
+spec:
+  hostnames:
+    - argo.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: argocd-server
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

add-ons/argocd-dashboard/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - httproute.yaml
+  - oidc-sealedsecret.yaml

add-ons/argocd-dashboard/oidc-sealedsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: argocd-oidc
+  namespace: argocd
+spec:
+  encryptedData:
+    clientSecret: AgBqp25ilSAdFoj5LmPESSi/5Gq/Cai4vmZs1czKXmohOAMq7HIRO+fLWn+wU5B7R44s0kQ2Xw1ohF2hzTVljsK31PIdYNLbblfxYduKIJLCW1Um3/fCyYC6WSAFlZnaEn1iGghvR468Bsh8KT3OFIx3R6L5fu1dJ3t7JYE557GtkLbD7EWD70q57itUa+2OdL+1XdvSXOrqSVYjBcFdbxTRTUtvh8LR9J0Mg+uRYsk17UInfCqT3FRQtwRGQMQs+UX/4AuKzyTjw60w2lcfIsm/SBGvG/72FENUt46XGALoXmj3h4DaZBCH0j2LHWi3c+1psKTEXner5jw00Xa3eNOBKoDwIoEOIyGjIrhLf60d9Gm9Fp1weqcf8JTJdO3sXd4RXleUT+2zsu4vIeIXShXgCC/dz03kSXpPcM4/4XG/hWfu7Xgffc72Erdqbwj2SFpksVTQp1mWrhVu01qB45AwcaySpUovdYEm4DWhq7eB91sk8zhmHCNaDosnOlSjd1UD63L9Rg4y+objdVNEKODhFueSWh/Lb2wDQIxq3dR8Apy0cqSmrJ8QrJV8eAtsupHfn7Hg2zTvIM4jnKV8zQ+Jiut+Kpb+pC8jlcJPRfp6k3lpUjP9t95q+T8CVfvCMyEw8u0w9OUpGhozUMbW/BlP6tsWaJWKLnocIROxYPh3Rf4UtJ8Ol3qEW3Wkc+i6FyrIUlEGkQAad7USrADTx14Ge/XfZ6KO+Yt3FgyS8884u9dH8egkcEYZbHiZweAAd552JwIZn8gj7oUPxq8UQtNK
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/part-of: argocd
+      name: argocd-oidc
+      namespace: argocd

add-ons/authentik/blueprint-argocd.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-argocd
+  namespace: authentik
+data:
+  argocd.yaml: |
+    version: 1
+    metadata:
+      name: ArgoCD
+    entries:
+      - model: authentik_providers_oauth2.oauth2provider
+        id: argocd-provider
+        identifiers:
+          name: argocd
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: public
+          client_id: argocd
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://argo.whyredfire.dev/auth/callback
+            - matching_mode: strict
+              url: https://argo.whyredfire.dev/pkce/verify
+            - matching_mode: strict
+              url: http://localhost:8085/auth/callback
+            - matching_mode: strict
+              url: argocd://auth/callback
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        id: argocd
+        identifiers:
+          slug: argocd
+        attrs:
+          name: ArgoCD
+          provider: !KeyOf argocd-provider
+          meta_launch_url: https://argo.whyredfire.dev
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf argocd
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-garage-ui.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-garage-ui
+  namespace: authentik
+data:
+  garage-ui.yaml: |
+    version: 1
+    metadata:
+      name: Garage UI
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: garage-ui-provider
+        identifiers:
+          name: garage-ui
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://garage.whyredfire.dev
+      - model: authentik_core.application
+        id: garage-ui
+        identifiers:
+          slug: garage-ui
+        attrs:
+          name: Garage UI
+          provider: !KeyOf garage-ui-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf garage-ui
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-google-login.yaml

@@ -0,0 +1,69 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-google-login
+  namespace: authentik
+data:
+  google-login.yaml: |
+    version: 1
+    metadata:
+      name: Google login
+    entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: default/flow-default-source-authentication.yaml
+          required: true
+      - model: authentik_core.group
+        id: admins
+        identifiers:
+          name: admins
+        attrs:
+          is_superuser: true
+      - model: authentik_core.user
+        identifiers:
+          username: whyredfire
+        attrs:
+          email: [email protected]
+          groups:
+            - !KeyOf admins
+          name: Karan Parashar
+      - model: authentik_sources_oauth.oauthsource
+        id: google
+        identifiers:
+          slug: google
+        attrs:
+          authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
+          consumer_key: !Env GOOGLE_CLIENT_ID
+          consumer_secret: !Env GOOGLE_CLIENT_SECRET
+          name: Google
+          promoted: true
+          provider_type: google
+          user_matching_mode: email_link
+      - model: authentik_stages_identification.identificationstage
+        id: google-identification
+        identifiers:
+          name: google-identification
+        attrs:
+          sources:
+            - !KeyOf google
+          user_fields: []
+      - model: authentik_flows.flow
+        id: google-flow
+        identifiers:
+          slug: google-login
+        attrs:
+          authentication: require_unauthenticated
+          designation: authentication
+          name: Google login
+          title: Welcome!
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf google-identification
+          target: !KeyOf google-flow
+      - model: authentik_brands.brand
+        identifiers:
+          domain: authentik-default
+        attrs:
+          flow_authentication: !KeyOf google-flow

add-ons/authentik/blueprint-grafana.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-grafana
+  namespace: authentik
+data:
+  grafana.yaml: |
+    version: 1
+    metadata:
+      name: Grafana
+    entries:
+      - model: authentik_providers_oauth2.oauth2provider
+        id: grafana-provider
+        identifiers:
+          name: grafana
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_id: grafana
+          client_secret: !Env GRAFANA_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://grafana.whyredfire.dev/login/generic_oauth
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        identifiers:
+          slug: grafana
+        attrs:
+          name: Grafana
+          provider: !KeyOf grafana-provider
+          meta_launch_url: https://grafana.whyredfire.dev

add-ons/authentik/blueprint-outpost.yaml

@@ -0,0 +1,34 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-outpost
+  namespace: authentik
+data:
+  outpost.yaml: |
+    version: 1
+    metadata:
+      name: Embedded outpost
+    entries:
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-garage-ui/garage-ui.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-pgweb/pgweb.yaml
+          required: true
+      - model: authentik_blueprints.metaapplyblueprint
+        attrs:
+          identifiers:
+            path: mounted/cm-blueprint-qbittorrent/qbittorrent.yaml
+          required: true
+      - model: authentik_outposts.outpost
+        identifiers:
+          managed: goauthentik.io/outposts/embedded
+        attrs:
+          providers:
+            - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
+            - !Find [authentik_providers_proxy.proxyprovider, [name, pgweb]]
+            - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]

add-ons/authentik/blueprint-pgweb.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-pgweb
+  namespace: authentik
+data:
+  pgweb.yaml: |
+    version: 1
+    metadata:
+      name: pgweb
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: pgweb-provider
+        identifiers:
+          name: pgweb
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://pgweb.whyredfire.dev
+      - model: authentik_core.application
+        id: pgweb
+        identifiers:
+          slug: pgweb
+        attrs:
+          name: pgweb
+          provider: !KeyOf pgweb-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf pgweb
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-qbittorrent.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-qbittorrent
+  namespace: authentik
+data:
+  qbittorrent.yaml: |
+    version: 1
+    metadata:
+      name: qBittorrent
+    entries:
+      - model: authentik_providers_proxy.proxyprovider
+        id: qbittorrent-provider
+        identifiers:
+          name: qbittorrent
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          mode: forward_single
+          external_host: https://qbit.whyredfire.dev
+      - model: authentik_core.application
+        id: qbittorrent
+        identifiers:
+          slug: qbittorrent
+        attrs:
+          name: qBittorrent
+          provider: !KeyOf qbittorrent-provider
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf qbittorrent
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-wireguard-admin.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blueprint-wireguard-admin
+  namespace: authentik
+data:
+  wireguard-admin.yaml: |
+    version: 1
+    metadata:
+      name: WireGuard admin
+    entries:
+      # wg-easy requires email_verified, which the default mapping sends as false.
+      - model: authentik_providers_oauth2.scopemapping
+        id: verified-email
+        identifiers:
+          name: wireguard-admin email
+        attrs:
+          scope_name: email
+          expression: |
+            return {
+                "email": request.user.email,
+                "email_verified": True,
+            }
+      - model: authentik_providers_oauth2.oauth2provider
+        id: wireguard-admin-provider
+        identifiers:
+          name: wireguard-admin
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_id: wireguard-admin
+          client_secret: !Env WIREGUARD_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+            - refresh_token
+          redirect_uris:
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
+            - matching_mode: strict
+              url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !KeyOf verified-email
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        id: wireguard-admin
+        identifiers:
+          slug: wireguard-admin
+        attrs:
+          name: WireGuard Admin
+          provider: !KeyOf wireguard-admin-provider
+          meta_launch_url: https://wg-admin.whyredfire.dev
+      # wg-easy makes every user an admin.
+      - model: authentik_policies.policybinding
+        identifiers:
+          order: 0
+          target: !KeyOf wireguard-admin
+        attrs:
+          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/httproute.yaml

@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: authentik
+  namespace: authentik
+spec:
+  hostnames:
+    - auth.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    # The ArgoCD Android app posts to the token endpoint without its trailing slash
+    - backendRefs:
+        - name: authentik-server
+          port: 80
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              replaceFullPath: /application/o/token/
+              type: ReplaceFullPath
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
+    - backendRefs:
+        - name: authentik-server
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

add-ons/authentik/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - blueprint-argocd.yaml
+  - blueprint-garage-ui.yaml
+  - blueprint-google-login.yaml
+  - blueprint-grafana.yaml
+  - blueprint-outpost.yaml
+  - blueprint-pgweb.yaml
+  - blueprint-qbittorrent.yaml
+  - blueprint-wireguard-admin.yaml
+  - httproute.yaml
+  - referencegrant.yaml

add-ons/authentik/referencegrant.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: outpost
+  namespace: authentik
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: pgweb
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: qbit
+  to:
+    - group: ""
+      kind: Service
+      name: authentik-server

add-ons/authentik/sealed-secret.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: authentik-secrets
+  namespace: authentik
+spec:
+  encryptedData:
+    AUTHENTIK_BOOTSTRAP_PASSWORD: AgCdmFtQtxaSvL+ggv8kdkufOxVEhBOPMWEKmv0k6LpakDZdXDKBEdcb4bj8eYSbAePTpoPbSraV0GxMxw/D+Xm9o0JbbXqW+G9MfxDTJDE8n1eFkw/bRjq2gIZq/MNRH0ORBMpviQeAFnzt2gfcvu3Fua2RIQji1JHR67d6xTtzGTIunyte7UFh1OIDr9JWE+6mfjKVuebbWq1qUXq5ScrWf0UYjJ/qHJiMjM7NZeEq8v9D9uYZoXoZj5Ew6BRP+UWGZOgoulxgJys5mdAo4k6NMYapT8vEyyyOmzDlBYPG0KucQgiVHBwW8UaBvRQ3WES/xYgD44fwSIiLwtFsU0rCfDQXUMlbA05wvcy8u0Fq8v8xKCWZhpWpxKzaLHRIFL9QKfRmil60nvwYferjVRtfObdY28hU+/vh/LDJ6NMj5d5APgQ/1/otX/XQ48Ezrmo2nZqhqdbFKlJq9eSukcfB5KARvKrY7tvFmGr8tyqqqn2eAeDlcy8ivNomF9sIqYKVadtv4UlO/SjwTM0UEUyN2tIGTWBGWI6kDWKFjUtjsJTmMSTKFvTHyd24sUa8QskZgGLqMmF1z+Z8upVK3qgo5EKjFvvT9MekVZp+gj0eD9dZreEs8QeScw0+Oxl+ksrp6bJWXwh/A05/QSkPQm7A1Fx7KoVRdo2PVEJun7Jk4HuOrYXG+EAvDE0A66psM1XntLPdUlHbdt15a9JxMrTc4LI3ARw9TFDi9tL89G1JMQdBJGi63AOuOtLPVXm96zI=
+    AUTHENTIK_POSTGRESQL__PASSWORD: AgAlxWe8VpLJ9qzrJJqIBbWgctSdBBjx8HUXVqLQtZx1zWURks7YsB8RGdBYO/o/aQ42Q3EI/YLGiNdvm+7M+Bmbmg4GoXTxNujgfg8W4BZ46Z2g1sq/4mJhj3Bx/fiRAL8QaqJNbSiSmGoCRXuwseuiqDSrEn69ly/Y+wRlV22ZyPqa4vU/cesOFVYu6EAWKhS/6Af5TrsxEVwFPQUmOpsMGTxHV4GSkbYiXAjq9Rr2JkgtmISDiSGTFB6QcITF5QzdaAKaDym1ol/j2VLAXACgesVvUs3cFtRCprusXctUtNZdURriytUn7UusbeB+7YeG4hJohgGRZne83OkPd2RyYj2XyS2t7G5vV83WDFFBsOkvXQDGlnfSgAovyTX8hpUbwvWq2nkpRm+NhJYyryXR9QRZcnUdf4LZgSwDWasy1nUwTuOs2W6YIsdN3yV+BLq+yC77vDRrdlNbibc54EycuwDPzMnqazlGoPrxO53li/qGJN4v+et1cfevk3dXguYrOH7E2Kmqh0nAjp3mojoPfG+1RTzwRoiMjaLxEbtkLWzq/gBJTsVdWtTq1CpfEVT47Todc44lDmtk64OQffxQbq+ryaR6q7V8bRynsTYPJVFi0+VD5mjdmWz5IDDP5+fCMb6xZD6oTqgVoFV3zWSAj05J87Ok/lR99xCU0WqxYrF6o+3Bvg5i9D7flAw8nrFmuNc7G7SXgcQu2QIHfOikVXL6WScJl1Ycu9v38KvtZep5XjzGgHQ2SvfkulhaSlU=
+    AUTHENTIK_SECRET_KEY: AgDZtbDVvUGwkMw+uBUv7CyPd1lNrh23svotEiD9v+8gDaJlE6P4r1qLijYn1dqH063RdmmW3wndlohM/MjAXzSJbdRX3hv5Dk6Rd2fJKZdOiGuHFNRTLXsVwe1k0JwyweOzdBYcjHnfvSwEpI1ahFEtsmA9QhJ1HOpMxoMyA6oBWGkcjdO888wrL7EkMTYeAtwtIdnqA45X4Zqi7hhRdtZjhWBZ0d3pel1105DAxd1vyiK1mALvXhfFI3ixKYyU3Mb9q8O6KXHrv4JqOW/Zz9OQVpf0/yVRxv2xkYFvgaj66xW0KcA5rVp68NSDEGE1O4a/W2B09n1vtb5ZRml2597j0/36/wYkl9Q87jFEBkXi2xfDUTBHlm2ik8DwcOK6f54j2sHmWJMywPHsBYBvxVdRFQMxXXETQJWaas5ToL78HzFLsL3uuoez7umFMXtta3Dg3t6AqC3NwbWqicKgU8zJVPWNJAoLr9wrmJBOBLXgMHGnowLAkfNJNwQIAu2SaQwLpOZEfTkyKc+HBm6/rM++IpvCg1KJXGoUPbAq7qt97t8d0ev2JdHs3kMU8G5PnNfE+nf/6limWxp29Z/vXdMZ0JHWk+ivCia9yrdP0IXEqvSAuewEniKY+nYWlPZpJwX6kNpVcSK7DTIVzv+l9vcSPrLnkjwuzmnd+Sv4lA0cYkwh0uZ+00FF/0RVCEj8OP/c840bINdsSX13BXkaeeA2InZFWvC5PrjNKY9RIb1k2Hyo2EGS1ZTuIUNMFN/XORlBC2IdT0Tld1LpmKL8GuW+2SLJUJRwv23SmmAFWhPljg==
+    GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM=
+    GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ==
+    GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA==
+    WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti
+  template:
+    metadata:
+      name: authentik-secrets
+      namespace: authentik

add-ons/cert-manager/cloudflare-api-token-sealed-secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-api-token
+  namespace: cert-manager
+spec:
+  encryptedData:
+    api-token: AgAdOsht6DLr8etz8DyU3JJVzoinxnldvBWzS/GBJWzDvAUKw5O0Lu8JpPEZTVMj97uKs16YZsiDCwODBZSD2PJZUAmKwcaWFgCSqBjnWsaCgsEW4Fo9i/SnovgzIPRsc8Q0BOaGZ/85j2hsHHX9lGQZdzLvPFqtR8oU3gCQyFPOJnOFwegUUavf/OzbCsaSd5+g8RZdB5tGdoScw0rlpV2rMff3IqBvAG/drLj4zcjq1vviC0XF5E79rKu2wLPmVVXfLxt/hpO431OCxLyoBJ/2drb16hqUv0yrFVykllfnVu2YxMg7Tzu0m0F6QHEaIu3FTyTQyhX5iG6a0hjYjlmUY3wkenm6V+bc9/Z2w45cYkXwyjumjTzjGvofIjf4pV8F0jYlYcobnY0w8cfij5yLo6WcMuYWImxF7j+94cmANVgFhZkhevSpwFE7uP9x8KakTGHd12NTNvJE8n1hYy7vS7giJGy8TSKPoFr6B2793m532aVR4EeIF2BfU4zENrcr6w5zWQRvmh/UPYj0fd61kefIRorjt6Xt0ydwzgEE7ggxFYN/6Pbn8ZNOwQvGIppHVZCzH2IGh147Pmg/U7RQsPzWRVshhlr4sY1cBA1PGsdOODuGuvtVTR2EJ/AoL79X8stMXOxhv0/bzRiAhHS0sg4H0xp5z5x8g/xSva6KY0o6IKgBEbGDuIa1L39VNu/5TeP/+68ln76zJiWlO6W3Ksl4jwk+ALLCo2U7OXqTk/4HJygn10mLnlvF+YlfIfvq1a/61g==
+  template:
+    metadata:
+      name: cloudflare-api-token
+      namespace: cert-manager
+    type: Opaque

add-ons/cert-manager/cluster-issuer.yaml

@@ -1,18 +1,18 @@
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  name: letsencrypt-prod
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: letsencrypt-prod
 spec:
   acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
     email: [email protected]
     privateKeySecretRef:
       name: letsencrypt-prod
+    server: https://acme-v02.api.letsencrypt.org/directory
     solvers:
       - dns01:
           cloudflare:
             apiTokenSecretRef:
-              name: cloudflare-api-token
               key: api-token
+              name: cloudflare-api-token

add-ons/cert-manager/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cloudflare-api-token-sealed-secret.yaml
+  - cluster-issuer.yaml

add-ons/kube-prometheus-stack/grafana-admin-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-admin
+  namespace: monitoring
+spec:
+  encryptedData:
+    admin-password: AgDHA/P0QjtI0wgwOJTWOtRf49kKuqmX6sMCB4Vsk8LpGhFMYWgP8pnXxTAbV50qTnqVdY7GQfsabcWWaYDV7FTH3oRtAHbV+gplabbhlxIF3o+lwunkGcObbex9PrCI/9/qX4DL/wOVLTftlOKHzyX2+ajGnufDMuF3n4axiKAJNGiKiuawQIhksV4EgaGPtAhiInQUte5BylwlKIciTl6eiTDus3B+DVW0ubsX5VPVKRnJj2jKKM1woc+F3/+aSVKDzavjX2zKrptltWUgaY+KPIwuEsYB+kzy9JwtgD189NdGR+3f4zQNJ3pX+p9WzfhocyXdEiFAGPdqaPP0E4mMSd8WPpmdsCiFGN6aeu8vJJQOONyC/Bm63em+BJk1AaGWm1XgwC+GauUdkqAHNiva+XQpqIEBI20ddHJBN8HyS1xZajg2JI3Mxukfph0WjPoQ9kqhAkFjIfoIv1uvusL7fDAXhmAyp0s23f67WTzXB1ZWEyRGbgPZIoC0eHztILRIngUuC3L14/aTOhiTxcnX4VVUAJyXy1tM+NM3KCL6T7pQX81VnFerfzW+VeIzSpIU7AIaXuBf60d47j88Ff7Zm2qp257L0ov+sMY8jp33v8Vx4oB20h2bqdGbCdt4NWeD0hCBAU26vaFVuiUmZZuNuLNQqsCABa7cE86+BlRCVG0KXgylrFMNjE1IvgHj+LbazAWFQ0kSKpXKyD/AT0bX3ZNUQlL/U9jDMSuNTzYCjMe/znsQ
+    admin-user: AgB0Uxo17KMXzvE/IbxYE9M6xDN30OXhQ66hD+MD1fUmNriResa+iGpCknByxOWDtccojz6abbVTJBw/ACjWGWDcmuafrRmkXcy6/l7gcirb/TVubUlyurecr9n1Iqna2Ip4/5IhEnBuVzx2e5xe5r0npRmWI0qeFN795OO6++2I3rZUR8lUMpywTs6oyGSKKQ/9qOCaN+bARIvja4fxGw6mzPNkIHS7MAOsiUElNft8fmT+JufSfQ0npvxgimvsQCFyfxQjWwZwX+LLKSesPAcDD6iXQvaR51NCfwpfRptfom/99QeIXjv0OyBysQUWfZyYNx3I8VKOEWXLSvCafCQVJV/tuHkWob1hVZcaSRZxJolnSZQ3mQ4hgYxfr9QZp3D4rQMgpzvqsJ/EwShwWEFqrOy353X5PNvJhQTB005FGky9yumYpiJjtAyX1QWeM9wBedZfKYUi7YLV9YXiXk91n13nQxfJ/HRRZFvqnCYtTXFRfX8PGbYF6aaW2nop3xcaDZ932y9fZQ9Q6AlasKUm+qCfkfl6dUOfVHftJRLpvm/60GLw5ylz9XTHS1EEPJAPpty8YExuxYWdHn5RoCbRHjKyQWxckKjFG6qZ7LcQpQuitSqwzcCqE04n/naWLoKJpMJhI0Ecs1hYai7LCFKNqZJm9HqncaeZ9SZAd4jquKOoVIJAJMyGDdzLQFkuq/7Z75y9fQ==
+  template:
+    metadata:
+      name: grafana-admin
+      namespace: monitoring

add-ons/kube-prometheus-stack/grafana-db-sealedsecret.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-db
+  namespace: monitoring
+spec:
+  encryptedData:
+    password: AgAGsDkcxjB3fakl0/pOZF/ej8gxCo7BUac0LJxfRR106PA4V9n2otOAiyVhmN45sNE2pscm2vDJdHtv5fWaR7AyZLaBk3dSn8at5vFh6Zgx20KLXWXGUrPaJLD07fuvNI4fgmFqEHnWsYUiO35mBfr01s6gTJPPr+y9b9LUzAA+WCuJERNwt+hFwmRDkI8rUvwr2Jy3TGKAJFJCXK1vkPtsGvIi8zHONlo+DI1uEH5qFECzScjXy4zEwKd54VoZtmS9F+QCJhXeGxy28v00jYCjPuIN0vhbzlJbLxDfYRskOuIxU88LWbGd9CDse0ZQvNW0i4cZbhL4Xsr/rCYeQfVMjc9eC//h5hsF7FPtKp589/lnC2jnpSYUfAz6sORY5elmg9QgB7yin6ItOCkVTBLZ3KPicOzu9oVLks5oTb1h2ndyNn3ltThPUo3RQpqOlq70HVpeB5cnn1Vdlty7/DJ8EtQSpVl1Zh26xTSsK1BLabs/sEVKRT7D1qyFtUT7aZDD1e63giFJIZzOiO6i3gaeTlLUyUmj5XlwfI0sTlTVIn0v4af1d/rgIUWqHYw/LMxYAF/x1M8LIRwtFjpWDYH4QuB2Keu0vMcTiErL+OGfM06izLntIzdoNM96TEj1dpLOHBxAh6cGNj6K22AzXfaToDcSpdO/yVzQPuzIWwr/joiEakUHCAKF+wQbI5vtO2suZTadSlo4T5M5clrIDkRTht5d2p4DNBaSG18N0T0yoic5RqQyUbOdSkepyWbWJuiluOXi5/X0gRG1DUBtNkWR
+  template:
+    metadata:
+      name: grafana-db
+      namespace: monitoring

add-ons/kube-prometheus-stack/grafana-oidc-sealedsecret.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-oidc
+  namespace: monitoring
+spec:
+  encryptedData:
+    client-secret: AgDYt08vksKi/llySruExrqYKajxYNy6qlSze2pUy88XZOftNv/HEQrsoe5pcDK1fTBDgrPQhQgbX3mjD7I9psSVFrA6/tw19MQZK9QjyClz/92rGOf/iW7sqKJJ/rUYydPyPva48DwTvg/peGmUDleodE1bfogKrHfz36fJdop37KeTi8k0UZoyNQK0o/FayliyJzp9oX6rlJoa26szmQ0JP9/akBd2JTAruNw1JbOdmFx8GpIGU3Bl8uvbcDQwZ4LuGxn1hOiPutXuA5NTS8xrC7GnLBPMtAvg8etZr5JL6ZLh/cGPGyN7tWpjqrJ4Y9hyR+ryapZh4I6/uRrRG8BpqXILUri0T2CB7/VSFrRka2b3CWtrlUiaCYDK4d5UF1I3K9x7WnK9rWNDMx9hxOQ+4hL6wFhX9k3nfDH9yJ7C8+4u4jTJVOfE01HbR5d2ZBfvP8sEO8sAePgD84ViRVcAAZ2LmW9aPrMdNhlQXf1ODDOnj4FaXP+yZIEq+fqsiyQtLDNBsIwDDJgCv4l7ac6NQKbpN2rfEfs4UFk5g8Jj3TfvpXieFe4+VuUyAwy/7npvxuAn50xrcjAo/m6cyEgJ76oyK2tdHM44m5CX+MwMhNIVU1Mmuq4oZ98pRXx0f1xptcwcXiFV2Eor5lKmNx4mDaYDDgbFrPGJ8w9k6gnDsYUnxP5LfAhpcwFxQcSyhj2XdbSnP+mZio59W0+adGQoksNuZjF72COME7ijNREsAmUJ6d9EKffQsH8zf3rHb03vzNWVzofgOKDTHyfNy6bdiZgezxGjNdcgFixdU1Fqjw==
+  template:
+    metadata:
+      name: grafana-oidc
+      namespace: monitoring

add-ons/kube-prometheus-stack/httproute.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  hostnames:
+    - grafana.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: kube-prometheus-stack-grafana
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

add-ons/kube-prometheus-stack/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - grafana-admin-sealedsecret.yaml
+  - grafana-db-sealedsecret.yaml
+  - grafana-oidc-sealedsecret.yaml
+  - httproute.yaml

add-ons/loki/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - s3-sealedsecret.yaml

add-ons/loki/s3-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: loki-s3
+  namespace: monitoring
+spec:
+  encryptedData:
+    LOKI_S3_ACCESS_KEY_ID: AgCy95N0v+X9sAZ6eLZ1dT4x/TZbZdJdKDBdoB1EB0XD69KtjRnTIp6fnK7fWhJK8LBQMinvses1ZT8zxjXoYtP+eP/UMF3A5BPKp3GtwWqgGLWWcDEdRIPryf4isovw/5JRV7EoaS2GOqmXrGmzqW3S5B0CkGBBfp4vE22ClkONw0lh8RQorAHnHAQ5oBjdnUwcudKkqzCUpymZsLEU19TFx1xuHrI1b9pPBDUZKJc5sRQeJpMh0TOmP6G21SHvoVpfGb91nX7rFqt5uCxwXp00rWTJQDLmrBHITTzw/regKbtDz/hnow/Rmw9VvrKeh0olIxUjDwPfRFLalu2OKmV1oa60ta99Q5OExqQKKIWjOyOHovBAtpTP6q6z0/mMg/O0qoj+PyW6OJ8Ojkf7zYJAEyDil66ijALwXQd6bARjnePcrrmNCFcHVDIKRgraO4ZJDkPdfekKdCY9nepxGGdYDbFcl+CgieiKp5C+DQ2MAurAiWVIy07gfc0EwTneTIZa6gJsL1extnD1QMxF+Q51q6v4raTyvydMg7q2fcJNWs9E8c3buVJ+xbyuTGdotqaEgKgL9h7AGPznuXLBEv3jsZ0DZzooaXQr9e2eSOaj1Wdj9fBTkTDwtcCQOkWVTzQv0jdRzHkyadKaCkSLEy+wFvyoCmm90I1v41kUNAKb+OfErQF2oneR/kFvCRR63fHkrqeLlpfYX0yu6yWOKhDHN7WsQ6wd2s76PA==
+    LOKI_S3_SECRET_ACCESS_KEY: AgCR6N449J9uv9ZIb1CCZzlEMIgmnnWWGiYqDj5awSzun/j7nnU5CiqY0Q7YNUztKI2y/0TQAHdrS9Q46d3c27ZIiCwDJGK69w6Bcc8XPotzFZl7htRvc792CZtx9OShqLYrltoGvmNCLB1AY5wnxTJPQJ7p8Xat9GJA7CgRHerwhfhtuT3vKGRVOkjpQ5tRDaIYGQO8o7Tj2eaIn/dBwMgCVlfd2x2XLS7RzV8F+DTQ+94jpS7h+zJGsnEqH4nEO40OaD87ZTn8CnHlw9H9TL9shu8dNVULYK3j5Z9vHHPjBQ5oiTBdwtayJ0lBDOjimlMMYXiJhczsoR8PwYG7TNL/OZZIF8uMvuZX7lFLa/15W99XhLZSKoTbtYNT2HAzWNLM29unor3eDBebwZGyVu8VzQVECtU1/6EGnY0enMpldxUhJnVq3YmifZ74lktIcLy9g96lIYvJs10OrMZqMf7ANr74T6tLj+kDvlTS7AZF+27m5bK7Da3Uj15qvLsxox5XYsTfZa82Kz9XM67/Dif5PdGz3LCkVJHKBpSbAwoy54NqaIIlRrl08J947o7AR7M6T+L+kbU8JTREH0bbnAIgFvkBZow0LvL0rNB6I0A5aSO9jrMnb04I876Tf2JyRX0pLhtovo+253I3kQf8X9S49suYcJeTdATKtIMC2sE5wb23AdFeHLZz603HobieozAm7X5sDCaXQSROHUMPF2+f2sRifTxcryPP9YhpBZvm7zuqFDSjfQI3dtLrl8I7/Ohbn3J6whP6rgSqKBQaLS+s
+  template:
+    metadata:
+      name: loki-s3
+      namespace: monitoring

add-ons/postgres/authentik-database.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: authentik
+  namespace: postgres
+spec:
+  cluster:
+    name: postgres
+  databaseReclaimPolicy: retain
+  name: authentik
+  owner: authentik

add-ons/postgres/authentik-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: authentik-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgDLpRHzrgu7ZjiHPa6Ryk1SJ7/hWlN50lKj6vwUP8IXWhsqKD75eniNRVEkogcsL4bxoL+xD5PK+A9p3MQe7gLlBlH0EJd0f5J3tSN+scxFpYxwjR8Dma1+sIlC2l87rD276Vr9rqXNe9x83ooJ6nHSDPGMidEryUzNUNzcObjG53BgQRW39ZzjHIlju3wt6iRcAxalfRC3v2mTPJyYaiz+He9ipO6LCJ/sv/po4QloASghBUK4zUGHyn8UCQzDuhQ3nnYZCyFG4T4ey8XWL53pFopTzWpRn+4g0yQXI+qvb28kfy4L8QvNgRhIzoWYMLQVswVVvzRE2y3nrkWRhG3Z4FgJSfGuOOR6obXboWNA008d4Q0In58O7lTxh+cwDNzGRY9WrWmFhx9ib1b2O729I+Vu1aTUa7IkaYg5BpMLuUjEiY6DfVZW+OvvQYPd6+a3mhitjk+NwVGZBdR20lW3bz35SY63yLfDrA1bBex2iq4jLGXEBlJz+loAU+yko1zua2RYC/tgfJpyU9NrSy+9ti59I8e0+I4o9YkJ2VmVtcoFd6L0ZOmdayw4r6hDtB+EHW6Wz0vnIrwx3fxMjSaXEvtNjZOVeKVvm9Cv2qJqTJGcRfiUeSbqEXtti1tlwupTe3bBXfotV1MqjmsAUJehhdfwYscvdmo60XMKJheyoAfB3LQw+uAg6CLtmfe78W9IUK23ofFfgtiQwp2/3gXmmp4XPAEctwXe//SaZWbVTdl5bKEiNvrrqGEI0zdcWfU=
+    username: AgDRt25giEz0pQQNgaKjvHh7pM5PKgp+LasT7uBRtkjdzvPVgjnmYjo5EIGMv16VGk1AzxoHk/gI+ERlVGACzrOoi7n5LoTwqmnbcw/AcsBB2TM18KdFKzMjJFZ7S65+lC2y1jt2fOaiTdlQ/OzU251x9NSiHPnLBw3K14M8kD6Yyq93kN2q78o9gD06KjXWGmbnADH1H9gJSCwSJmLMS9WWri0Mr86l/JgMwVCdEoDKOFwlqQWWr8SAm1P/5q61TyIOPjjUe1AMFMSZTFezFuchf6NBieztHN/JW5nmPWSc43aH5u1zjjaTJu2qk3ipSN5BBCkoKZ9boW/wqy4AriRJfitq8LxIObAFgkJMHG5RTjtxU8j2z8oKHll9UxO0yRSIkdhBI3h6iJAqDmi75bH+RIfdx1kiT3g+nkXsmR5/ptBORyNejppeSYsh/jptdJNtzjmBlGlORtLX9Ah8I3Hj/gr6x++GjwphYZLlwjVa1S7vSnWwpdGKP/0RwBNMFeqf8PerN/tp519b96toja9QyA0y0lJzh9XmMcfOUKYamg2i31tn+4ab1GOGlMGeck/MQ+3G4skJmEiCMvxQjGSOuNjL9W1DnSvjPsK8pNnJ5ndUCQatu1a04psQ0dJK/jVluwuIm34u3lOmisWEoTzb9Y2PYUavIpkPt5be0qmCh9+r5xdL+gBLccGdVdrB4zQ7caW26Lp76WE=
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: authentik-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

add-ons/postgres/cluster.yaml

@@ -0,0 +1,49 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: postgres
+spec:
+  enablePDB: false
+  imageName: ghcr.io/cloudnative-pg/postgresql:18
+  instances: 1
+  managed:
+    roles:
+      - ensure: present
+        login: true
+        name: authentik
+        passwordSecret:
+          name: authentik-db
+      - ensure: present
+        login: true
+        name: grafana
+        passwordSecret:
+          name: grafana-db
+      - ensure: present
+        inRoles:
+          - pg_read_all_data
+        login: true
+        name: pgweb
+        passwordSecret:
+          name: pgweb-db
+      - ensure: present
+        login: true
+        name: redoost
+        passwordSecret:
+          name: redoost-db
+  postgresql:
+    # Each app role may only connect to its own database; pgweb to all but authentik.
+    pg_hba:
+      - host sameuser all all scram-sha-256
+      - host authentik pgweb all reject
+      - host all pgweb all scram-sha-256
+      - host all all all reject
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 1Gi
+    requests:
+      cpu: 100m
+      memory: 256Mi
+  storage:
+    size: 5Gi

add-ons/postgres/grafana-database.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: grafana
+  namespace: postgres
+spec:
+  cluster:
+    name: postgres
+  databaseReclaimPolicy: retain
+  name: grafana
+  owner: grafana

add-ons/postgres/grafana-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgCS2VPTseFFkdtaDAjYv6+9M+s6ndiezfWjV+OyPTPurfHJxLFkUlPC8gnZkut9gRhz1jsakP91an0aFEZTWHlM/amvSkomUWbwxKw6l9Co1U0IjK6PUPWKkQtLA++vFaL40u8yHFMbMLkND3oLPqNadcCGl+cmLgmSq5VgEayaClx4MPlhSBFYBvpJJ3B/CkK2odnXYO1aSeBIKPQFIlbiooSWjBA0CzJ9gQQFSnEVkDqHfkd3nEVHaziCdhpOCDyH6twQlafMqUjIbVKPJ2yd2dZSJZRLh6t6FY5EHhTh6PIbniRJ3ZtX2uTaZJ/tJF2af3QfRMUJ6go4r+16IKM/Q1ZrOcJfa7Zz+9RoC4d9dkl30hysr88WX2+GHx1E+beEd0v0Kv5IR8CZlbRyQV+DYDgwjFD9ALE37EMhpkCyb1qi1ulhl+8LIXLB08nedbIqqvPrmjUd3+y1EpuATeCgIsaVeACxBN2iUJ+JjVOFE/umnSgEGVctSIQSl4kZz/SFpS1Ygy0yrVOSmt9rtvPaWSWlg8yN4TTli1OKCJreyLDVSXV+/Pf+3UoN8p/SR7r1cC3jb4KBy61O/7jovMgO3XuhYHtUyJdrgp0h3DS116yBtFVomGKhCRMriLXb7VG9zD/spgYpmikPMrMABm9OPaLOBiKMEz+VN8Nd7cXZ1/us6kV77lSUInZV4osall09avYn8NaTN93hIS6J/Xb81b7yuH6Au6p13Zf6dkefEF6vu/g3m0eP3ZlgIkroF1rNe6IrkzxA0U9dDvrr3ayB
+    username: AgB1nXmxGuR6ObktViN4tvpH9W5B2HdzDVAwd4dtv0nBSGkS4NXA5B65BzF8NpWRVcnbS5hr6H0KfnAWHguDGL3/pEU6fdam3At8F+2i0oXSH9Pt+C2SxEcH2ecRHK+7VqNgJhd8j9i89G8DQGAgFjWj9UpfOCwr65G7UrHkomdBgitSFQD0dXMPJ973ZSlRZOxECT8NKjmgMX/iHztBszIms/ACB6u4Yfg64nAZUta1/Ky95ZSb5ZgrqABE+GLgRIKngAhr4OlpiVZelsTz0ccjCU4bT6a4ZqiqkbDLS19nO2rOSMDsnxgqoVBRF1Bz4Ry4R3e3jpQx4xBQrV4x+FFCymEi1rpZ8KQCrRf88YD+A+jRsBGnsB79wcaq996zw2tQ3kZd743C7AM9ZzXiNuGVGlhXqld6IbvHzyh1F9X02+diPVFftAO9owPEiTBcZVscj6RREmkOGcYHLtjhCghzHR0iQZ1DvazqyPSyUuvKyyXcX5m1b0DzgONqEgdmHD+saZZbAacQakUdoOS1hGLGgExaXS1pLV20eSIpoAJls9WbRXCeAIfWbN2MV2y1BUUDvmIAkdkocQbthovl2NeOy1FYVZZSmS6jY4zv59PDXFx2HMcNsj8qzZu4gDlEfngY5L+L6Lqr0XQKN250gYEkuduYaPoftCiaThMKCc9eJkAlQ9GdvrQrW49wBcXnErvFVmfuNcWr
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: grafana-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

add-ons/postgres/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cluster.yaml
+  - authentik-db-sealedsecret.yaml
+  - authentik-database.yaml
+  - grafana-db-sealedsecret.yaml
+  - grafana-database.yaml
+  - pgweb-db-sealedsecret.yaml
+  - redoost-db-sealedsecret.yaml
+  - redoost-database.yaml

add-ons/postgres/pgweb-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: pgweb-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgCCnUlPp1buEwCQDC/q1Fy8JHfi5QzuUCMoIXJoi5xgJewkI7ti0JctSrJJvdvS0QUm7se5s85tewKjsA1tIGrC8/nsSSeGbNmqRXS5BbGVdr6SIQhExTmVNdQqQwoyYtV8/ebW4ntt+HrIdgO16o6nsDb5lXblYguZps535SqwSN6vRLHhD3+Wg8SBjHZV11i/9w1nufy4KhgW5jlBhosKOaGVpgH33OQdsDMvkSF5FcljgeUm7R+R5sBYXh5VfPpEjsBB0zi8nDzSNS8aDVrQuv3aFeNnJ4vgBRV8a8/VclaMO9RqXgnl+HjHczbEau+x8AHZ19lLVXJ3rxi4itgOGXevVGEdHi+i+WJX3yfakGrleBneqkbY4VUuuu8T0l1wveLxRGBNwR39xl+wSZU8skDWoDh0Qdgcxpiez9Ewit3s9WE7SALtdUhVdwBdzZVctqZMVUeUDDBGYk5cyTZmRAMR0oBYAHSFD+C7+oyVjJsnZOp4sn/1q8vOOZzLeMu640tyopCChL1eIqbUxz+c0WsVXOQkIZFO2XErkLi0mpf9/rksRc8jWPZL3xTqcgQmGPujpm116K6nclf6urgghj+UW2KWilZRD2M1qXFEi4UdyDFPMs9bOMqymuk0zr8bM2+xJUvaC5AAByjFOEvwoqrXMp/55+4OhcEXkce482Ohl22EF9UznwegpxgcSvDVsdvA63nqkA6/ScYVf6vOJMV1IV3V/xrCmCfvrgzw7oOdfLMFF3DFlK7b2bcwdm7tJGnjIVxRKEk/Oac0hcmb
+    username: AgCrlxpjKHYriSWpb27Yy244lRX8YJFTWFxfT6Zpf/FG3nJ0BmcFRCzADbE9+E82Uugbsomv7Bx+GG3PbdzZGZJkxnGptLLIMIXbFlRr0W7cKFCWasmti8CW3KmVSp6YSZ/QR17GPmEkehFnmooK5DGhxZJcrK2+yFhN16JtCh/XGuXHVwVGMZMcVm8mKWcPKgH1yCfxQfFCk/xD8+3FySTKz1B/eyaUhaWncL8iCaMQgTd4G9YUomL0ykqwu6RzO/UkC7taq0dnvSg/XC6NDfZJ3juqdAw86RagJH3H41T41WM42ItXHCVy8XEAkJALZO8+caJC1Aa8kqvtPQh+5ParKpQK2CGGoIpcy8gicfWsGC2Ohtmoma0J37Ha/ur4BUuEbesnrvkYGDyf+j6rwJ1tA1Ff5w1POeySqRbpK8M7pEwLNTA3dNzhqBfY8sLdIwDx6W5ElBDz/481IzC1vKgNCaINjvCIvT4ZMHMVEwaAHxTyjv/On0Gi/U2m38Qnu+IxZXC/Zi1LPvFCCE3ieVHOKA4gyxooKIriORzxzxZbD7hvg+o4Dhkd6hxWRYfpIMZBQi6Ov7jHzY2VJroJ80wzsLXFLNwP4pEpSjcQsmus/ErLJGwHUeWYASo5cVmBdrbtQEDWGSFm2pi1FSCLnC/7/eWsPJqqS0tHCT35+Iabgk0EbXEPHgE3ShR7b3j/+qwhACLktg==
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: pgweb-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

add-ons/postgres/redoost-database.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: redoost
+  namespace: postgres
+spec:
+  cluster:
+    name: postgres
+  databaseReclaimPolicy: retain
+  name: redoost
+  owner: redoost

add-ons/postgres/redoost-db-sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgABXpIKEczwyJR1ZLvcmtcQluGi0ACDO3SCC+D2OfaSxpUF0ZtmE0b5ngq2HmYj7GPMZ3vAEaJ42oXDgEiS8Teq9ACxmCIo7XMeA5X2w6w7RCmhgQdx7N3G+nL0fO5l49URckk8xDZVFCSo4wjbtmjQrdes5CbMlImtG11byFAyjs5lBAN9niJZ2tnJqJhpEvI9/6St0AlVjhsRhwvaV0zlVBtKFcBvSKemcBHkTA2gPBeJ3xmizuc4NsJHhCriiOAhJ+IA19eBzvN/bmfSxdJb2F1LdSQxlLDstnuO/dJDKkvIul6TrWwtqRbCI5tM3K0lHbGeeDmIRVPmsK99Kw3FAoSSKIZ0u3FTXqMF5mi9+abJAxHgD/JYn0Ecx/09Hp4lUwEWK3RIqmbfq6ose3YcSRULJeksSIQtGsOmkE0LxZkQV1F15lOAWL9QhYTDXZbD2JTnkc06SLSk2THpl9o0+F4ZNI+TpLHGASIH8nu95qVh3u7odwjaqe5Czh/njIGw7zuh718hLQtXi7P4soAj46Db2Gw9ZjSw412LGfU3ETDjeIeA4wQXhp78HtEn/vsDRMgx9EQH/726Y3BehdEzpx3g95zBvyT2T04UPc+J+K0zwp3c4rLmkyqxlXOq8NW2p1huQsdk8QTMojCep73k8VSzKpq9i2I9ktWTPJbiXP1KpLA8q0J6awgFD3c1IjYoeeOptfz0kR5oTQa8syTdlj4QVYrxopWqGhK7Cn2G4zwc1Gv1F2sO+KL7/KUe+Z/vp4kICKdL6JfQbUJf4WAU
+    username: AgB7DGwIppwLvtb61d9cn/FnzC9bwAdhvk0XR2BTiO4EaA9py79Y55Y0pmSmdi167MCfsQNBZEYHV/pD1RncdzHbMV+rKs1Y9Q8ghFUcuTaXC03tkYfZX/JnwdKAaqhyMqGkycyFWsVip7i2uoodJ2M0QhuD3L6dgXeq6rFQhrc5GjL/7bWiKcYY6X82qbYToJCHAHzmZ6lXcRwGqtV9TcC72CtHgP6vsBTaTZLadptxh9xI89SiLej/9m2D1lhSshJ6K90BTeaLVqeR19hP/VCOltnQfeV2GfJgBAfstTEnTHpqtGuPct+zo/IvbFnnjLmcNgVwzCerk6O25mgIuOQxkQp/gnoswnzMojPzwWnKsl5mrlrjkYRuGrFZjykB6th/xat/VarHyMJUpKlmNcealkWvy9TfHzCyQtCHW/fwHiWJ6W2/Cvf6ABBDl5kn0oj41l1Ekm8zxR7GCoucd/iAvizWJ8V9d4g/P28gBl7UI+WDFRkKcYATKZ2s6P60ORXj+aeYnoV0s64if+Er/fdbYXdSo7YiZVOtKy3nGIRsq9pl17QM1GXNmKNcpSE3SwKudEwIKcLSKZ8oCAn0gm2KwGGbJ6sRWu2+zysxgcoDnmpZje4SoO+xXLKDJ9NMCI1RBmDByk8IoNxn6efQXZesn1TQd0QqdjRF4+yXxPgpfzjK5TBEFx8ya8LMZWlhU2dxIQpJusV1
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: redoost-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth

add-ons/traefik/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - wildcard-whyredfire-dev.yaml
+  - wildcard-whyredfire-dpdns-org.yaml

add-ons/traefik/wildcard-whyredfire-dev.yaml

@@ -4,11 +4,11 @@ metadata:
   name: wildcard-whyredfire-dev
   namespace: traefik
 spec:
-  secretName: wildcard-whyredfire-dev
+  dnsNames:
+    - '*.whyredfire.dev'
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
   privateKey:
     rotationPolicy: Always
-  issuerRef:
+  secretName: wildcard-whyredfire-dev
-    name: letsencrypt-prod
-    kind: ClusterIssuer
-  dnsNames:
-    - "*.whyredfire.dev"

add-ons/traefik/wildcard-whyredfire-dpdns-org.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-whyredfire-dpdns-org
+  namespace: traefik
+spec:
+  dnsNames:
+    - '*.whyredfire.dpdns.org'
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  privateKey:
+    rotationPolicy: Always
+  secretName: wildcard-whyredfire-dpdns-org

applications/add-ons/cert-manager.yaml

@@ -1,35 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cert-manager
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  project: default
-  sources:
-    - repoURL: https://charts.jetstack.io
-      chart: cert-manager
-      targetRevision: v1.19.3
-      helm:
-        values: |
-          crds:
-            enabled: true
-          config:
-            apiVersion: controller.config.cert-manager.io/v1alpha1
-            kind: ControllerConfiguration
-            featureGates:
-              ExperimentalGatewayAPISupport: true
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-      path: extras/add-ons/cert-manager
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: cert-manager
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

applications/add-ons/cnpg.yaml

@@ -1,40 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cnpg
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  project: default
-  sources:
-    - repoURL: https://cloudnative-pg.github.io/charts
-      chart: cloudnative-pg
-      targetRevision: 0.28.2
-      helm:
-        values: |
-          replicaCount: 1
-          config:
-            clusterWide: true
-    - repoURL: https://cloudnative-pg.github.io/charts
-      chart: cluster
-      targetRevision: 0.6.1
-      helm:
-        values: |
-          cluster:
-            instances: 1
-            enablePDB: false
-            storage:
-              size: 500Mi
-          backups:
-            enabled: false
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: default
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

applications/add-ons/traefik.yaml

@@ -1,53 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: traefik
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: default
-  sources:
-    - repoURL: https://traefik.github.io/charts
-      chart: traefik
-      targetRevision: v39.0.2
-      helm:
-        values: |
-          providers:
-            kubernetesGateway:
-              enabled: true
-            kubernetesIngress:
-              enabled: false
-          service:
-            type: ClusterIP
-            externalIPs:
-              - 192.168.2.5
-          gateway:
-            listeners:
-              web:
-                namespacePolicy:
-                  from: All
-              websecure:
-                port: 8443
-                protocol: HTTPS
-                mode: Terminate
-                hostname: "*.whyredfire.dev"
-                namespacePolicy:
-                  from: All
-                certificateRefs:
-                  - kind: Secret
-                    name: wildcard-whyredfire-dev
-                    group: ""
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-      path: extras/add-ons/traefik
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: traefik
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

applications/kustomization.yaml

@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  # add-ons
-  - add-ons/traefik.yaml
-  - add-ons/cert-manager.yaml
-  - add-ons/sealed-secrets.yaml
-  - add-ons/cnpg.yaml
-  # services
-  - services/app-argocd-repos.yaml
-  - services/app-autoregexbot.yaml
-  - services/app-betterslcm.yaml
-  - services/app-jellyfin.yaml
-  - services/app-legislative-summarization.yaml
-  - services/app-scriptscribe.yaml
-  - services/app-seaweedfs.yaml
-  - services/app-qbit.yaml
-  - services/app-stirling-pdf.yaml

applications/services/app-jellyfin.yaml

@@ -1,40 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: jellyfin
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  namespace: argocd
-spec:
-  project: default
-  sources:
-    - repoURL: https://jellyfin.github.io/jellyfin-helm
-      chart: jellyfin
-      targetRevision: "2.7.0"
-      helm:
-        values: |
-          service:
-            type: ClusterIP
-            port: 8096
-          ingress:
-            enabled: false
-          persistence:
-            config:
-              enabled: true
-              size: 2Gi
-            media:
-              enabled: true
-              type: hostPath
-              hostPath: /srv/media
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-      path: extras/services/jellyfin
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: jellyfin
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

applications/services/app-scriptscribe.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: scriptscribe
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/whyredfire/scriptscribe
-    targetRevision: main
-    path: k8s
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: scriptscribe
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

applications/services/app-seaweedfs.yaml

@@ -1,36 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: seaweedfs
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  namespace: argocd
-spec:
-  project: default
-  sources:
-    - repoURL: https://seaweedfs.github.io/seaweedfs/helm
-      chart: seaweedfs
-      targetRevision: 4.33.0
-      helm:
-        values: |
-          allInOne:
-            enabled: true
-          master:
-            enabled: false
-          volume:
-            enabled: false
-          filer:
-            enabled: false
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-      path: extras/services/seaweedfs
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: seaweedfs
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

applications/services/app-stirling-pdf.yaml

@@ -1,40 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: stirling-pdf
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  namespace: argocd
-spec:
-  project: default
-  sources:
-    - repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
-      chart: stirling-pdf-chart
-      targetRevision: "3.1.0"
-      helm:
-        values: |
-          fullnameOverride: stirling-pdf
-          persistence:
-            enabled: true
-            size: 512Mi
-          deployment:
-            extraVolumeMounts:
-              - name: storage-volume
-                mountPath: /configs
-          probes:
-            liveness:
-              initialDelaySeconds: 90
-            readiness:
-              initialDelaySeconds: 60
-    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-      path: extras/services/stirling-pdf
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: stirling-pdf
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

apps/bentopdf/deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bentopdf
+  namespace: bentopdf
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: bentopdf
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: bentopdf
+    spec:
+      containers:
+        - image: ghcr.io/alam00000/bentopdf-simple:latest@sha256:3d62b8f8eece5fe947026ac3925ff08fda245b3d6ba2c3916b94da91e0010c74
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          name: bentopdf
+          ports:
+            - containerPort: 8080
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            limits:
+              cpu: 100m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      securityContext:
+        runAsGroup: 101
+        runAsNonRoot: true
+        runAsUser: 101
+        seccompProfile:
+          type: RuntimeDefault

apps/bentopdf/httproute.yaml

@@ -1,24 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: stirling-pdf
-  namespace: stirling-pdf
   annotations:
-    argocd.argoproj.io/sync-wave: "1"
+    argocd.argoproj.io/sync-wave: "2"
+  name: bentopdf
+  namespace: bentopdf
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - pdf.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: bentopdf
+          port: 8080
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: stirling-pdf
-          port: 8080
-

apps/bentopdf/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml
+  - httproute.yaml
+  - networkpolicy.yaml

apps/bentopdf/networkpolicy.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bentopdf
+  namespace: bentopdf
+spec:
+  egress: []
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: bentopdf
+  policyTypes:
+    - Ingress
+    - Egress

apps/bentopdf/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: bentopdf
+  namespace: bentopdf
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: bentopdf

apps/garage-ui/httproute.yaml

@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: garage-ui
+  namespace: garage
+spec:
+  hostnames:
+    - garage.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: authentik-server
+          namespace: authentik
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: garage-ui
+          port: 80
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/garage-ui/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - middleware.yaml
+  - httproute.yaml
+  - networkpolicy.yaml

apps/garage-ui/middleware.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: garage
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true

apps/garage-ui/networkpolicy.yaml

@@ -0,0 +1,40 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: garage-ui
+  namespace: garage
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 3903
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: garage
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: garage-ui
+  policyTypes:
+    - Ingress
+    - Egress

apps/garage-ui/sealed-secret.yaml

@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: garage-ui-secrets
+  namespace: garage
+spec:
+  encryptedData:
+    admin-password: AgDIy9i34wa9hD57pft2B8SmSmCF5UyksaOD5NyUovQhLwJqv6QuZoXOQ8dS2aCMK9B2jFw2oaycJPgW02HEsUiuaorifAz/wmjrU8yXtGTcxpqxQfS0+EUhefHtcWBYVcTc23qMpllJZLEr7+aR+sCF6jAq1CHeuSCdAOTkhjBTbFmcodIZWCspxrqoxF4NLBGKSdKIuWLekH8w8oJ1ymf/VUj/LizJIKZn7QoRpS5KYVBM2hzlXipUr1FWSjmCmolTPv/ICW6CYHtlOnEvYUTOnEAdmAx5DD2HocKs+OjBUuFgnYwj2XIyLOoVI+nrACrQSvmzXOUrKNI5y54DU2PNgAa1zetWfHk/Xv468bLQc9bSBFhSSNTrl3mi8Aa381mKJ5aRXLGa89fCqGWAyrzKle0yc1msg90jriJMh5kN026KHXw/yeqcrTCD9MdTMr51UusfhzkE6LSnKmXX0XQNjP4OLOKu7kFXj8xRox0W0CNbXyg4keQcWnWKF1LUgG3X2+1CIZNFex7S7OE8KYtxP4O7aqy1kRZvgVsUONafaIPB+k+Gosnw7ImEQ4Zu8L1ATqpeEioHoxeac+RhavXjte7UqSjIV6moxWrwrK2EMZPHhm2Kh+h8S3ROA/78Y58hFkEYQFnJQwwwByGctS0zLIOCybVm/lz8puohlZAcfzf+J++0R6sxkWZtIa4YWG2g6RuTjUoqcgHPwrRYmbvB3WmYu9/w+717HZob13QP9C4mpT7Zhposw44JuJMN7MA=
+    admin-token: AgAJHn+bv6P/JJVplonJWgc/vnqXRQSsaKlTnrEUmH+P72YqMPEbt/Ma9ptkWOewQNr6mceYHUpXQuhczuAmeebe0GS7jr1md+Clnap+8NMKHbhYSCX0/MwvV7JUcWfZ6xJcttPHbP6a8s6SToidDOohBtY6gkeuA+12AtGI0t6xugAcCwBKqZnAY2lacD1nEqyatUP2cGHXTMmaNzsyz3g9QvuhCPrOx6FeC7JjmC/JdwqyLHN/b/NvVdCZUmvNjsPaq0U7UK7UCbcWYbjxof2u/3QF+EFlNBrpb4DYipOVqtrY57IrfYbUNucd+e5X71Kjpg+iwR+IPyGXS8OGJQQsh1ytYeZLbHpaCpmm2HVU0JMZx7p25QSqwNzP81wjU1VKkw1WEZG4RW4eHS6/aISSBouG4g/IRo8E93nskfj6Ue0+feFv1k50l2L4ROYtEUwMaeaA7zpwr6tTei1fenJ86sa3HAIwgIdiV1qqp2TTWwpr4xFHlVYdYvb+igt7Q4h73FwvYt3kAMTmH5O2iatGZfo36pqTGOqrfBPu5p+agkuA97MSumqHKzqADSPyNz0BmqzV7DPvuKsKxaFYAiEbNjD5bCIyDUwNnQIucMUbHtEfLngN+yD79kZiwBY1xS7sf8QG5yOYi0U5Ra1f/AEKasPUEOsiphrypcTZ3GzVv6aIaF/AJPWZZGDT0S0kXIB6u19Lyl6V5NUEXImnpBI8gyoMflIiFB18qt0nX7CBbNdRcwHGzcCjy2nshkvhSRmW0OiWw3v4UkDu8YAaSZDRFGjKJQ==
+    jwt-key.pem: AgBLwseufpRTqJdLEFeRr4ZN4VihNmua9GMPEEm/iARbWgNqCl64QzvJGy6XWM+RdXkS4z5jrjMg2Z2AJDHvd8qnFpDPBd4peAYw03vaxxpkz/TNz2+9HO4Nultn2wA2bd3CfA43doSs1T49lksCKn33puYEh8q5BB9hMUgU8JFc1sEMKS7auWoPQlwAOnJ4Qi4ISQZZ/C2IPLVW1VUJfPTsAenJ7ZgqE42DFFmghDfaFEQb8BcMNDuQCU8BJSqC3BoSMiuxmtkurzk7aXegVOEBcbdmPEkKa0h63kuTJCHZth5mVz4NatpgO6EDovGahO2EJkuAY1fyDhL0EpUSf+XHyaTpsDa/M+qvPZvd6wjGLjIH2CV1bHkvqx2GjKqv4zPkki3ESlxan/qfh0uFcGG2a2bSezmFbibvXr6uvmKo7KcbZWevc2GYgmODRJRW4bl5MTp0YDKcxF4I2kFboJhnCG5aw8hfw7LLUdk9iCT89u7UV/cHafG9TpoxkpIHyZmKrZLLczAvkLdABFX+6UYbFG3N+kVlFUXe6K7Gt1LrMVievNDIlds0y4b1paXIsj855znXZO7+zLcmpJKEnmjOJ9wa6TLCsI3wdTzEoLQOO9HPgywGRo3lxNu9mbiYnRbjwpO1pXs8RNfQj0ERNwE/EZoE+51SkGAADvqeWG/fT4bHadKaTYWitiVwXOjKJeXjEm3BpQI6hNyLMO4J/JMTAGHdqNttv3yeu5FJWJ4MrYS/tyXUSVBTojU2599/soFPqDUn/1IClkOKrdG15ZJCedMB55qOPf1k51dvIbhUVBEQlDyRDGksqPItVf1tM/+RhuGrasRk58zVuY5qm9JQFReNiNZv
+  template:
+    metadata:
+      name: garage-ui-secrets
+      namespace: garage

apps/garage/httproute-s3.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: garage-s3
+  namespace: garage
+spec:
+  hostnames:
+    - s3.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: garage
+          port: 3900
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/garage/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - httproute-s3.yaml
+  - sealed-secret.yaml
+  - service-admin.yaml

apps/garage/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: garage-secrets
+  namespace: garage
+spec:
+  encryptedData:
+    rpcSecret: AgB5qZc+lP+J11wyLaNSG++stokqfiu0KuX+FPIzO9WZIHsdNGoBlcCifn9jsbVxB5z9tbSlteSTS/hVLHvYWEGPK5MNdRZORG5lSGqf428+jmdCp4kXAQp80nBHsqsOpJeHJtuM3IlEEpHMfV18cXnz9Q3fOj7hcSBRb28XzdAdyEIr3ZG7ThPScXR0lQFwYe5/W4GikGQvLUHSn8DwZgsJesP4bJdHlHaifPYZMLFa4JSv0bcwrz5+WjsKWU3xa5wkHrMT05ihaK63n9vUOb4/AwPQHBL2BJfl95DlmoRAIvAqwlfA3d7N7Nekb9G8ZupUTnPRZBQ2+32JsHZ64B+nIR1/WC6+8U+2McTMJtORCidHbf0i0E6Q6ClpMeoGobtVy6z+rOkUF3Z9xW/WwS1hznb5LXRW1My/KPvo0pztyEipdTZFqRkq2teGf1pXvELORlA3yoE3K1JU3RgCmDWOD4sUbuacWhjG1127Zo+W3gnxudVbODJ+s/F7HLC+6IHlWBarTd9QbTHemD/8/iZpkqWmyg1oexowvzWlG6jWFsxBe+hMQ9vzFmPkYDsfzBNMeJohwhOxPG3h/aWkBw1FHqd5/VOY7R1t+BpCI9xanWKL9F/rOa5wH5wfOyLptLv057ZxCBCRZQNDeVsAaU+Z+odBYhGQxnsZIPly9L8vAnS5h68A1bnTHhyob4RuIaLoSTKGDHnNOvzIhclu5DSfr5cSkRxbRRFPD67KSpNhoU7NUnjJJE171yJZADI/f5XZPVfe/1mu7Y3epDExT/oD
+  template:
+    metadata:
+      name: garage-secrets
+      namespace: garage

apps/garage/service-admin.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-admin
+  namespace: garage
+spec:
+  ports:
+    - name: admin
+      port: 3903
+      targetPort: admin
+  selector:
+    app.kubernetes.io/instance: garage
+    app.kubernetes.io/name: garage

apps/jellyfin/httproute-local.yaml

@@ -1,23 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: jellyfin-local
-  namespace: jellyfin
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: jellyfin-local
+  namespace: jellyfin
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - jellyfin-local.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: jellyfin
+          port: 8096
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: jellyfin
-          port: 8096

apps/jellyfin/httproute.yaml

@@ -1,23 +1,23 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: jellyfin
-  namespace: jellyfin
   annotations:
     argocd.argoproj.io/sync-wave: "1"
+  name: jellyfin
+  namespace: jellyfin
 spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      kind: Gateway
-      sectionName: websecure
   hostnames:
     - jellyfin.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
   rules:
-    - matches:
+    - backendRefs:
+        - name: jellyfin
+          port: 8096
+      matches:
         - path:
             type: PathPrefix
             value: /
-      backendRefs:
-        - name: jellyfin
-          port: 8096

apps/jellyfin/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - httproute-local.yaml
+  - httproute.yaml

apps/pgweb/bookmark-grafana.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pgweb-bookmark-grafana
+  namespace: pgweb
+data:
+  grafana.toml: |
+    host = "postgres-rw.postgres.svc.cluster.local"
+    user = "pgweb"
+    passwordvar = "DATABASE_PASSWORD"
+    database = "grafana"
+    sslmode = "require"
+    readonly = true

apps/pgweb/bookmark-redoost.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pgweb-bookmark-redoost
+  namespace: pgweb
+data:
+  redoost.toml: |
+    host = "postgres-rw.postgres.svc.cluster.local"
+    user = "pgweb"
+    passwordvar = "DATABASE_PASSWORD"
+    database = "redoost"
+    sslmode = "require"
+    readonly = true

apps/pgweb/deployment.yaml

@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: pgweb
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: pgweb
+    spec:
+      containers:
+        - args:
+            - --bookmarks-dir=/bookmarks
+            - --bookmarks-only
+            - --no-ssh
+            - --readonly
+            - --skip-open
+          env:
+            - name: DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: pgweb
+          image: ghcr.io/whyredfire/pgweb:sha-2c734cc
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          name: pgweb
+          ports:
+            - containerPort: 8081
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /bookmarks
+              name: bookmarks
+              readOnly: true
+      securityContext:
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: bookmarks
+          projected:
+            sources:
+              - configMap:
+                  name: pgweb-bookmark-grafana
+              - configMap:
+                  name: pgweb-bookmark-redoost

apps/pgweb/httproute.yaml

@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: pgweb
+  namespace: pgweb
+spec:
+  hostnames:
+    - pgweb.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: authentik-server
+          namespace: authentik
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: pgweb
+          port: 8081
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/pgweb/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - bookmark-grafana.yaml
+  - bookmark-redoost.yaml
+  - deployment.yaml
+  - service.yaml
+  - networkpolicy.yaml
+  - middleware.yaml
+  - httproute.yaml

apps/pgweb/middleware.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: pgweb
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true

apps/pgweb/networkpolicy.yaml

@@ -0,0 +1,44 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  # Only traefik may reach pgweb, so authentik can't be bypassed.
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - ports:
+        - port: 5432
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: postgres
+          podSelector:
+            matchLabels:
+              cnpg.io/cluster: postgres
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8081
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: pgweb
+  policyTypes:
+    - Ingress
+    - Egress

apps/pgweb/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  encryptedData:
+    password: AgCCLx1xyP6tj0NnqQpB20SXNfb1k+Y2jL2U5JEz1UMR+bx7LXCGkFoWBGdvLBEO0gOtoYwcG2zQf89ukurqVx4V6Z7/22/0ERvOw1HiFrqnHh9B+1KhO/76iC2V+0a+2elCYrPuTUeV8MaBbleY8qPHqTVbx7P5umvtrvmI9YcLaROw/6FKmgwN75JYMWjeeAhrhW4knOgJKgZqXFcGUIqPeC08TBVvRfIfkxyahx1mS3Bi4Wu1GdYaaUOfyrhCUuyhhE9Fo/dAFVkshnJGRPpBvIjM/iFsR8LZYO+WuVE4HbX2Jf/re7jZMELs+PbliX4I4RUNUTo8P6J0GEMlpHXTzkpVvtRsSy6SZynEmr3u3rLFW6y7xvqx+fMNEIO366Vn6wkDMCakHroo7ZCCgMIhwTqtbIkJ1wLm89SzMXaAapR0ZPpF2W2t//XZ6XAPnAXuwW1aynLddHd/4q4H4GFJgH1igMtAU4Rdt69P7F6V2w/SgDR5kAXVzh9VOFdiWQ0cB00E9d19PpAIbEhx6SJ8zgout/RjYGZJyr+jLML97KqiSwaH7k6dH4JfezLeBnlknulbge7NRoL1QiN0h+rs/O66+lD37mlQV63mWDgbkqhzDIV7Q2ORRyj1PZ1mJ9arzNnWOGD3DpjO3IRVW95XEHqj4Q7FGZ5AOMHYG/Jh92LWqLmVjKG74omWf3gsFAdN6SojEf40TICFCaiPUpo7rwPCBialScmMBVDq9RJmlCjdXrIlEbBx5AxI/HR/oT2wrS9Z7slwN42jYq3T9f7A
+  template:
+    metadata:
+      name: pgweb
+      namespace: pgweb

apps/pgweb/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: pgweb
+  namespace: pgweb
+spec:
+  ports:
+    - name: http
+      port: 8081
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: pgweb

apps/qbit/deployment.yaml

@@ -0,0 +1,140 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: qbittorrent
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: qbittorrent
+    spec:
+      containers:
+        - env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Etc/UTC
+            - name: WEBUI_PORT
+              value: "8080"
+            - name: TORRENTING_PORT
+              value: "6881"
+          image: lscr.io/linuxserver/qbittorrent:5.2.4_v2.0.15-ls480
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          name: qbittorrent
+          ports:
+            - containerPort: 8080
+              name: http
+          resources:
+            limits:
+              cpu: 1000m
+              memory: 2Gi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+          volumeMounts:
+            - mountPath: /config
+              name: config
+            - mountPath: /downloads
+              name: downloads
+      dnsConfig:
+        nameservers:
+          - 127.0.0.1
+      dnsPolicy: None
+      initContainers:
+        - args:
+            - ip rule del table 51820; ip -6 rule del table 51820; exec /gluetun-entrypoint
+          command:
+            - /bin/sh
+            - -c
+          env:
+            - name: VPN_SERVICE_PROVIDER
+              value: custom
+            - name: VPN_TYPE
+              value: wireguard
+            - name: WIREGUARD_IMPLEMENTATION
+              value: kernelspace
+            - name: WIREGUARD_PRIVATE_KEY
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_PRIVATE_KEY
+                  name: wireguard
+            - name: WIREGUARD_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_PUBLIC_KEY
+                  name: wireguard
+            - name: WIREGUARD_ADDRESSES
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ADDRESSES
+                  name: wireguard
+            - name: WIREGUARD_ENDPOINT_IP
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ENDPOINT_IP
+                  name: wireguard
+            - name: WIREGUARD_ENDPOINT_PORT
+              valueFrom:
+                secretKeyRef:
+                  key: WIREGUARD_ENDPOINT_PORT
+                  name: wireguard
+            - name: WIREGUARD_MTU
+              value: "1280"
+            - name: WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL
+              value: 25s
+            - name: FIREWALL_INPUT_PORTS
+              value: "8080"
+            - name: HEALTH_VPN_DURATION_INITIAL
+              value: 30s
+            - name: TZ
+              value: Etc/UTC
+          image: qmcgaw/gluetun:v3.41.3
+          livenessProbe:
+            exec:
+              command:
+                - /gluetun-entrypoint
+                - healthcheck
+            periodSeconds: 30
+            timeoutSeconds: 10
+          name: gluetun
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 96Mi
+          restartPolicy: Always
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+          startupProbe:
+            exec:
+              command:
+                - /gluetun-entrypoint
+                - healthcheck
+            failureThreshold: 30
+            periodSeconds: 5
+            timeoutSeconds: 5
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: qbit-config-pvc
+        - hostPath:
+            path: /srv/media
+          name: downloads

apps/qbit/httproute.yaml

@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: qbittorrent
+  namespace: qbit
+spec:
+  hostnames:
+    - qbit.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: authentik-server
+          namespace: authentik
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: qbittorrent
+          port: 8080
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/qbit/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - middleware.yaml
+  - httproute.yaml
+  - networkpolicy.yaml

apps/qbit/middleware.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: qbit
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true

apps/qbit/networkpolicy.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 8080
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: qbittorrent
+  policyTypes:
+    - Ingress
+    - Egress

apps/qbit/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbit-config-pvc
+  namespace: qbit
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 500Mi

apps/qbit/sealed-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: wireguard
+  namespace: qbit
+spec:
+  encryptedData:
+    WIREGUARD_ADDRESSES: AgAgYz7lVospXNvfy7IZOK/fxQe2OWJ6cc7ZzQf7kfXtZgARrffOg2trievpkcimVhi2dL8CTbYwuiJ72M0FirxOq9zTyUGh48AagZk9JygQntCrkJp7O9E3nSpyTJanq2L5QWug3WePvrjK8ShzmSJLQT43l/hAxFPy9u2JbblU5vjpvPpZCHpVU7HuZ/lqfNEI5zRj6mzxZnphmctEGzXW+wilw+WHENvDBL+jqSMgylAycu/5+Uc5X1JGLqEN2DWRyCQBRMDxkiMBnVvE+ImfkxHU+ZcTMUANllnqNwjot/jpFDZb1b916n8eBLMoSUkwKpTP5DfT0slez7hC+bJ9tkUXAAUHDRm18XTtGY1Ouh1uqtIQl8HiuY0hoShfPF3BfC/4wNXMRZjsj1R++z6kP/vQyiSu+z2PuEI8yzDRnNQGEnSnog7bTJBdui/MXHUc7Q+wgVNZ0/c4HfViZbw4zP6GVf+jshdUbOR8HC+KxRlKzU8cNDeUdnydUxplF+By8gyWg1hPY/GlD+8hRWqi1QDLdgl5JXEwDpU++WmKhiBHrm72f1BgZ5jlIiMON3Z2Vo18DzY8j9zUA59uAQsxDhSu7+wiuWQYbZrSVdFY006eBWaI3gVPeu3e3++i2ogKFfc6q5gmmaxhs1CLhhUypddKUzkfXDz7alMuauKq/h4uLesoqIFEXD9eWPs4mP9qirYx8MAZP9txx/YP
+    WIREGUARD_ENDPOINT_IP: AgDEkEaKaG9zfbuT9Hx3HMWZJzVT8QnMWN7eebCx654Gwn6XNtxD/22d8wxIRfhllrv47HCsCUR855ptHD9HQjeJ08WhMFm7nQl1rYI/5vKfZDyWdSR3grBzGConz0Eue3y5uljXcr0yN+9kqzURPr5MPs6fKRJVfSWaMFbsjb2S1Y3HRPXU3+xdoDxeOeVmMV/pP1enGRnZX890UF5QR2wfZcEXB6WPWWC1XnPxc7CFmLNRi4RRhLjh+A9WDIqEny5gviBTFXQsOEnFqAEFSmey/zMF+Rk2lGEWl6ROFzdH7ypr9KNA0dtMmfCLJ9AQF9P6MMD/uh2CyB5K9Jk5xNGoy3EgpQyjHp7q6FGiUG/jT2RXBdfoiJoq/NPsgQB3leIzEBBQk/DRau+xcob6H75nVtS+fVWOJFt6tsWKVAQhDc7YO7WvwRyTups+3s0iHxS8SXbshiC+ndZPZClPO4UXVY9OhMAUZ3sKwS2c0Ffj3xzJZWTnO7JBcONYmjo9qASd6FJQKPvIy6T4t9EEe6iL05t0/mIsnOIEdoN2le5Lv4DK5mmlboCW3FzSK/e/QD1iZLJVwrTF7gvBKvsGk+hCng6GZMsr/3++t2bZYMUjMZPTpDaTk2z3N2An8Qg0X2HM57D/pTZiaiKTy83cjQsnFhkLBHzsqGhtJbScJHtasAMt07+kW9t/8T5LTGSv8h6w0e2Iyj/TsShc1ZuA
+    WIREGUARD_ENDPOINT_PORT: AgCANmOaOgGnXywiDn755qCxBADq995QPGwBQYiApioSaYC32UP64SVP6RRDBGvC+jjFqhmXZlSDTN0LdrKG0x9d7klVIlF2awTIdRKAzN9wki0lLZQZ9Xx0wQl/YVXTKgcVtiuWeOmSJOEPm8Zxw8/1Rj21bg1PV05VZc4jxqsq+s0AdDy8DDIphD0Pobp0/U8MpowFRFEGnjmfE+Ap0wV/L7CR1opFr0PJHuEbgjp2+WfgnnG2Hwqj8nEUXiZzZzd0YIQ53sE7rlpBfTgWIBpeisOD1NAmAr5UxdTSlYhKn11pdMgIdybYGS22RTYMdKh9S6I+S0AjA0Gnci2O62c7y1aFIMxLrq2G8LhTlCEiRrYirGzNQZiVooGAnJE2evcTVnjZTGS2eHH5d+86Fq2anD+YzYhW9QLyp8goEyqHjuf7EoGF5H78Ij0lJ+rPreA0dSU0uOEC4dKZQpvdjkMZFu++uusNWLh1x8tvQBdRBDqExc2qbulBnn8VxRk1jwMKjwRarGrt0K4f2Dn3pWGc8d7JuLxnJ5QDljp/BaNlrOhnp95h1Uh4vQoj6fvn78aMkAQDbIIVaCx2IFVPEJBXCfbYIbV7mY1M7roRTZPUQ4+mGDe3IEPeXLvI96QK5en+0VsksB37+eFp7BIsNibzViJI5KgBYp+Hd9PECPYKivPjhP15vqLEcqGuskahvxp7xblS
+    WIREGUARD_PRIVATE_KEY: AgB1iJHqHhWudTU26hAXvWpp8OsCccV7ASH1BG+hmo5nXTEyBpjCQ58yuYMIYHIJq+iLlrHTr3cn4s2Q9CO+BEnca1O6sfOYzewoIqvVVjF4ol2TurPz+Q+FhqO1W+IAE4qrg/2/qTwyg7HcvBHEsKvIH0M9huAk6hgzGrh0Hx1NK2AyvtEkW11Bxubux4LVNxjqS9RuNNzIvVURU4aN6sDX1Jhkvv6cr/DU8QwopojHJnrxVOA++rWgF4IFvkz0K487WKkE7Pn+aTW0t+vN0JgxIobznoyMVRkUqeEDbE1nBaf+/JSQ1FREcv4CSIzT+Zcb1XslkGB4vOjEC0ZBkiQaAxHQdl0Fdthmt/5NnXonl+5mFDVepDmoGPmsk272uMGxl0vvTXWZXQfasspf0MBGBjR/NF6MPVkEf2n6Gkk3INvtQUbtwjKpmbQj1INBKVhOgEH5RDwyYsHz6FkrtPQmv8odwcTpQzL4gC7bZ5aRY/MGJDnWRNHZsU2j4Juqpc7q8t15xT26gvhedGwcD07uYM97gGvMtVhiCFAYj8XOKJAfhqeROgbGjWSpUC/9D5ERNg9BYhYyYjcOmrmdL3x2LZEiWCwKI6jR0YssmuGsAgX0z01h4OvLTN+kjc9hurdPdat2zqNr7w48CdE117ahLd3li//iYWlEC5mVCnHQ6iRrh65LstfCDwWBdFHTLfdpAhe0Ugd6rcVJt1sHPGL/5E6tLECU8zwOThU6WygHmvWpjLzWIX1bO2eF6g==
+    WIREGUARD_PUBLIC_KEY: AgASGQ2/lkGyl0HYWYlwuJZ1EtxoHrCIf/Zgzk7hCe3he1kHZHrcDpdoMPVEd5ys72wHW1crygowq1h1ySHPRb/gU6OgxBQHvZkGXBxmXon8u3KIuahuAnXwHsftO7qIepAGTka9S8/7GTeXEutXGMOWgfdRO3RzBUzkmoFH6lyFwco1U6SBfyfN0MVfPTTlMk4fV6DBZk4ygOf6Slow3/CR5+2otNRFx3fnzPTU2bEg0QvuMXg2RPmse9YnjIiSKl5gVmt5FwIyo7IDpgJy67rwfGu17Hv3cIhOdLLskPkakd97MVxpBp8xeGLSOL+5ogeoi2rvKvF3AbRyuMhi1eUlTuYuFp672tPQqkrTr512LsL44+WZdivhEAAl/bkMSJDHejAyta0n/3BJTIBaF9T7/ZPagfMSE6rBwpI9qpiNHNaCD+qeo9f4+f9VvVj0TTvhGku3ERh3cWiaJ3RElcpzhlWNlBb1Rnnmz5d++ES85W78vq58HjfYv9Y0JzOWmjdk0PhOxd7us4qNGOUaEs9CnkdDKU2AAnbbPkIw7CIGR8fTeNsyQw4L0VtP9X5X9NvjAsBsCgzPKQg8dcGFL07G/JLWVOCFQidn9L0SxQXH5O6bH4lic2jFQjCdwmOD9CkT/49Gb6ZzxwUnlYTO6mlNtIiFKhH/b+WAjDc9LMfwvSxNft1fkjgFjrSvk8No9NyU8QVvIPxQLJnKdVxSWWAaI8pePPeKaTD3a/qeANkb8HWIh6Z17zNx1ggC9A==
+    wgcf-account.toml: AgCmivAwuSXzJouUpC2FRB5vzLQ6Zj4LYzTbpwo6S6FuB0npes/61jtvdBuT+zdw+GuXhANRW0g4IBo8B/m/rtOzauZ0Sao6hqvlwTBbTPd6B/lnwQMMF/u4SrdsmRjFrlPxRWWs4rVZfDVcoeQqy7GCpRRHx36z/uwTGoFbz1yvTWO9RLJWCTMI8es8zoHzudpe9fS6PcAo4Cxv4ezA7kPMqQ88JkT5C0HdTNj5xEm/lhkrA/5mdF2ScDC8JOVJnJkURirr0glPRRoYlKB9wlSXcLtXMjlVWu72cND29QcOmJHaSyVZLzWtu83rA8axZBjX9c2Dgtw7zwtf06Lapcj91Qo2ul4vKXMfH9CoCzEpMwllSWKZZndV+OgkG53qKWzvrDj/bagK4qX4TLibCAdGd0hQ+/IX9ATJdmdRgHMu2AW3dudsLMXJJF8/5NdKS9ULeWXA/Fi1P+Ahebi1mS3NyRIQpAB0Fa9+FoaHUIp4itNOaOVQEQP/xKUCBeB4yFTqcCqnOwogPbzpsvPJWnoUTKCKDB9PCActjAiRPkGsxj+rh8FGfm/xjSbuzdLg42fHiFSO17zMr1xWbuhhUv4/LM0JXJki61e7/ZOPTjzJACykH2L9KYoC+jHv1+Tfr+tXnhO5yX9G7BUKF4r0CCciVufnH1N0j8ZsSDoqxT9avimH0hJJiJ596pW/UbM9KXbf8omqShd88rGHF++eX51Kp3eU2+JVFhpYsrWjtYOSUHobU6NqJZDYMc1TE3hAa8GeiGtuKweovD/mcbhEXvNksIOQqB2JZ8dODgFtN8WAcRQqRALoag5OyokcpZcnpd9NUgvPVUpCyddnKnF3oF9hR1uhhG71U7rf7OTtNO9KZwy0tg20cPQ+fz88vXLRejezCqf7yfVgd6pqxXtw7XgPHMR0j0RhKMrahee3Q/TWBou/XB1kVYkJHLfg6QLmRiaWVT4I/xd7zEZF7Li0VNc49g==
+  template:
+    metadata:
+      name: wireguard
+      namespace: qbit

apps/qbit/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent
+  namespace: qbit
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: qbittorrent

apps/redoost/auth-sealedsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-auth
+  namespace: redoost
+spec:
+  encryptedData:
+    REDOOST_JWT_SECRET: AgBlwaY7ZaZZSSpLoS4XOF5+dghrmIXZu4YN7kQxlm2WunpxMjw4VjCz5Iz6OxvsJrh0R4rf4YfIotHTlbs1Ylc9JtjrjcO0joi3+VwenIGLbGKi3tq0JJCJohrAkFF08Ro9d2UEFx39vhEXJ6EFDoNqhZp8v51OXdLRe5gAU7kwEHyWIxZMzxC9LeVLCPN3Ss+LJCALa+ePoYOENYADy9PK0BgsvXddnUmRIaxRVv81qc74c1tHnzCL79nazVtFw4gdqV9m9QuPzRem2pHXRvIC8O8J08LeCSrp1XXJnRB7SDWEdKYS6iSL+/ohOhxYGRUSDq+bG68b7pWTQu8Gp/jHyPiZWcjtL5V6fzs4otE8Ur7prAbflXZHLuxzUjPHsUJ6JMoP/Eousb5ui/rcA2jtjVOlPmxaIncj2Q5JK4jABMt8s19oyFedlEHD2Er7WXF7ZoYY2LFu5c645ltju3HlUflxac66NDhVDqy5BGpFyjwkC/XJ6mrl3gqp756UaFrFW8ViuJllhYty08KBU5eA9AOvi9JRl0AVHGQPAE0kV+4SC97Q0zXcqNb0FR9PloOUNvoqyFyjU/n8LUO8ObWw8zrCPljigexHRKEawwgxEVCrqMNHaAtzEhD5uXrDvsTZ4ONFOAooR+dSKM13HSMyvwFyPY+vzZr6D1Mef4dxYfHwJeV6WtZuAFFsfQFS7QhFpCIDsDXV3FDxY4PJnREG9jFr/lkgShlLFD7IcdDBYC1BxwjNUNdMUW5oA1AiKyByd5aCQgetHy1UbJKGy7yO
+    REDOOST_OIDC_CLIENT_SECRET: AgDS2dN+lFtGk/DHb7TNj3+trQLgxNIQZBth1nHLH90gXh1Etz04wKwWmI+/OJWGqxaa4xbxrcJWJDaAQeAK34qOQ6nu3uVV10lK0PBHqaGVA9s7uu9LsMy08dGC3IcHGI7dSyNaBoWAgO/CbRJYRBIEl9ePibm5bvhMo0VQZk8LtiBxrsySLyYqBSEDLOxbrGGtEO6jAlAe21jKTFOdaSdwZ+oGPWAuKICciA8bl4A5iqkJR8P0AD0azZ/HjYtygOL9Lextlf2IcRyzFC6lmyYEyn/O02rTGgFuCZHHDcF1fS9VOXDXlJVpvFSd7fsbvLa1BOqZ4y0UlJ7BVP03IzmieJIbl3Ey57Pr/mWlpQ9j6a7Fo90zF1Z8eribSZvJIuRdLPWIBfHJTqBVB6S0YiUNcn2KArwx5hKbRqEfb1NDFyDV0cfT7dXTN69xcc4YByBdaUmFjZZKfz0gYIOYKZo8bkA/vHiIjYYOdamSJpdThNFMLuqD6mJdsNx3EZLoXjkezmbWig764AudHfkzU9OOqi095rW1tP2mSK9T1qAxjs/lr/PGNjTQU5CNQ/XOi0qZgnjUmRZEyuDz79lvL8LeE9XWLVQ3eQ+z2Mm//YNcx1soaHdDnhUKtFXEqcl3tj9InWmCloHtB8xtxyBoB2yEUR5eEls3qHCfdiebt7mINDMdO0QqmNdleFKz3TTs7/2NgJ3xfzK/cSkkfXxvUHmRgYpGWG8887KifIEONZvn6ZLDfg==
+  template:
+    metadata:
+      name: redoost-auth
+      namespace: redoost
+    type: Opaque

apps/redoost/database-sealedsecret.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-db
+  namespace: redoost
+spec:
+  encryptedData:
+    REDOOST_DATABASE_URL: AgBqe7ze4oAAyWrbSdLWaaQ3laVs7WxBobr0/H/YFpXIyALuVZP2O5rtB/0BGauc1xPEQl9aeYkmSzAvaK0ECtEvU/Wj9QLfSJ0WCcGXrK+Cou7ykW6lSwFfbTOzDylCDpZtSEKanFFj8KCmeu/7PS/gwi9zsJXKR4xgfaWEPztCr6ND8iHY6RkBAxljl3NLeR0y6auC/eq/Tj08IkTGlXHeF9nQN7SaCl4t+kxtjY+k1CLbXUmbmNY16c0H2DFwbLQ9RgsyvL6aXnJ2LeqRvNsg3QdZDPDJwvs1wqR/4U+hTRh8tAGrmIoqQKuxcasEL5bmBX6Bo1JVlS9xgULf9bPbHP4mncClHFJrXTHmNv10cLLuyd/o0YdBStWoaeIv2YSchnaoRH0Qu26GbF1CF2KrgE9Dwu6iCJn9Ux5LPhWBvjsNfJ6r7unw97IwEHSsrWT93osddiPi4rGLXS4rP89CouvUbN3LYsyJuI832Jj163lk/+EERxXR+ctVQJsgH1gZuHlswLXEkn0BvCT44w5+Sc0NgPkGeKyld4Fnn5FmHlba8qkyks9+J+mZBJC26fh9wZJN0JFbTkLov6sk6nGEMEvrIJyVBrAJi1FmEG0Uec8Fr/NyLv+1TZm0eeRZ1mk8J5h6QydsBu5Cq2wabfysnMsIJmS4YpL6kYSIcF0j8zr/ISfjEFchfnI9AcGQ8rhqYcytjkud+I+kpaq6R9wDMpUB7FV0S2J48A7seXmvJw7wA1ojdXFuQ7Ix0HCUIcFrvTPs6KqXe75DfXEtQ8Lm2xc+OWz7xm9DfbPkeo2s1CSmHpUg7WeRjNp7aoiJgFvy6+xZi8xe7nt8B7P87SHf5IbtLLpY9v2bcPjXJ8R/lzyXE/kOK+H/Dr9YDrGDZvZm
+  template:
+    metadata:
+      name: redoost-db
+      namespace: redoost
+    type: Opaque

apps/redoost/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - database-sealedsecret.yaml
+  - auth-sealedsecret.yaml
+  - middleware.yaml

apps/redoost/middleware.yaml

@@ -0,0 +1,9 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: compress
+  namespace: redoost
+spec:
+  compress: {}

apps/redoost/sealed-secret.yaml

@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: redoost-s3
+  namespace: redoost
+spec:
+  encryptedData:
+    REDOOST_S3_ACCESS_KEY_ID: AgAsARN/0zM6asSlm+13UwKz2YvviQDwuvzPiP+Xy+kCi8VUdaQohzG0f7FfDhmG/0zvgc2EawNenf8QfUuEVYUMw/xa3orbvardL0RkOZN7dnm9bLm0LiuzRs6i5VgWSOBhCVZd3oMhlVyI2Pzbu09VtcTIqbIPrrrcrQzA5a9rIes8MKGEQbU3pdZILSKLFXgFWCqDGiex9ugkweI6jp9gk71hRzqpYOP9AA2df5kB0n+7HcIB4rDq7WlA/iXkCMH1NGhjDBMpRE/HyxhP0Td2WXqNsYKDM8Licq1qBnuSGT2FaTsCKXZ0X3ClFpbaXipzAwimqK4eg65tneT5NKbLnWjNZKx08scw98PcQzS4g+9l8nH8IIKOVq2+MuC+85e6yEgfkEjwknltEGSJl4VwdFUm5Ec2GVi1X9zWW4BzHuGWJYE/tj3atoCHfUnht3O8WVo1s4pSOMyInsetSlhV2YVMncOKVDHciY67+ih71jqiHqABGclbDzaQKFeXFY/e2J6o1tTRQ2ej5jxdjU+hdqig5/jsGqRc67t4oiOPEgEq4FmDTp27FGUIM20w3l74PC8vhX7GWOJfpl8DqvYgAJyYLO0hzSeE/Gl07/UZalq2Cinl0BwvROJ7kPVB4H+NqfbGl77AxMXWu49AUV3BBKG3xFI5eEVY9CRTL5lAY+WKW31543pgvB9lvYbq7LuTnvlOcKSwlXD0EeAWo4eyLuwtPOk0n8c26w==
+    REDOOST_S3_SECRET_ACCESS_KEY: AgDEE69d7G2xfvL/SyMz4HbsYO6bilvv0lh7gtSgfGLSBK1K3Bzn4tf3h6xRFLlO/mhlQCiozWSB9TQdltZyDvYswYH23kEaPR5m27yudHK7nxN1G8I/uyKFzm6o48keU+SGCakutYJ3Mqrbicj/Ogi+5VPG8M6Yxh/hKYcMO9i3cJDoqn93Ldyv9jRty8q9nNhaZDs52di1p+1S4FOZ0+ryrIPVtdPGfM2KViFnLG3DEBqMkxHNegWGRjie+AVKY/MOqVE64I7t+XBYnjLfy4aRpGFHhEXhihkfGklQMMKFwlIc8OChs0RfPHTWHlbTg73Xmr9uDyUDWgAG7VPfjuQU6RfgkWCGe3WjLF/7hPZmfzR/S2nhPZzNugFRBeWG6Q2FJ+ACPoJQFCmht2JackU9X7HivJee3UgfG0q63Ja2OK35oiwmHcPj2Wfv7YGarmnMw6QRiKY6ZpQN3/mlUyWNPMnwoRrb+JWQJTkVrRL1lZloydgtFX1y25v3XYjR6jU0s0aN1jacxIVto1C5UgNhLBIjhebXBnqVlWn4nJzYTLZvKnY0mHv8sF2cEXZNi4wqa8VdifZjSriqJKDCnQSPX0Gvr9XTRiqRWFNzoTRr0U6AnV3/zlxJaBb21zXAY7QbpbzExEbazJjhaaSCGoCGhVsVFOdn2KydbZd0mFR/o5KUDR7GXMJj/6wvNsjduyvlNFxJgCwElhApHTWxtsXWYR0yFeuIuTfyn6hbTo8TMQqPqAGKowSst+q0DvOKz7E7P5HZrvFBGkucSr5JdIxY
+  template:
+    metadata:
+      name: redoost-s3
+      namespace: redoost
+    type: Opaque

apps/rustbin/deployment.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rustbin
+  namespace: rustbin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: rustbin
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: rustbin
+    spec:
+      containers:
+        - env:
+            - name: DATABASE_URL
+              value: sqlite:///data/rustbin.db?mode=rwc
+          image: ghcr.io/whyredfire/rustbin:sha-75418bf
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          name: rustbin
+          ports:
+            - containerPort: 3000
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 256Mi
+            requests:
+              cpu: 10m
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /data
+              name: data
+      securityContext:
+        fsGroup: 65532
+        runAsGroup: 65532
+        runAsNonRoot: true
+        runAsUser: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: rustbin-data

apps/rustbin/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: rustbin
+  namespace: rustbin
+spec:
+  hostnames:
+    - bin.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: rustbin
+          port: 3000
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/rustbin/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - httproute.yaml
+  - networkpolicy.yaml

apps/rustbin/networkpolicy.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: rustbin
+  namespace: rustbin
+spec:
+  egress: []
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 3000
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: rustbin
+  policyTypes:
+    - Ingress
+    - Egress

apps/rustbin/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: rustbin-data
+  namespace: rustbin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/rustbin/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rustbin
+  namespace: rustbin
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: rustbin

apps/wireguard/deployment.yaml

@@ -0,0 +1,108 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: wireguard
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: wireguard
+    spec:
+      containers:
+        - args:
+            - |
+              # The node's kernel only has nftables, the image defaults to legacy iptables.
+              for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
+                ln -sf xtables-nft-multi "/usr/sbin/$b"
+              done
+              # Only skips the setup wizard; password login is disabled.
+              INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+              export INIT_PASSWORD
+              exec /usr/bin/dumb-init node server/index.mjs
+          command:
+            - /bin/sh
+            - -c
+          env:
+            - name: DISABLE_IPV6
+              value: "true"
+            - name: DISABLE_PASSWORD_AUTH
+              value: "true"
+            - name: INIT_ALLOWED_IPS
+              value: 192.168.2.0/24
+            - name: INIT_DNS
+              value: 192.168.2.1
+            - name: INIT_ENABLED
+              value: "true"
+            - name: INIT_HOST
+              value: wg.whyredfire.dev
+            - name: INIT_PORT
+              value: "27299"
+            - name: INIT_USERNAME
+              value: admin
+            - name: OAUTH_AUTO_LAUNCH
+              value: oidc
+            - name: OAUTH_AUTO_REGISTER
+              value: "true"
+            - name: OAUTH_OIDC_CLIENT_ID
+              value: wireguard-admin
+            - name: OAUTH_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  key: oidc-client-secret
+                  name: wireguard
+            - name: OAUTH_OIDC_NAME
+              value: authentik
+            - name: OAUTH_OIDC_SERVER
+              value: https://auth.whyredfire.dev/application/o/wireguard-admin/
+            - name: OAUTH_PROVIDERS
+              value: oidc
+          image: ghcr.io/wg-easy/wg-easy:15.5.0
+          name: wg-easy
+          ports:
+            - containerPort: 27299
+              name: wireguard
+              protocol: UDP
+            - containerPort: 51821
+              name: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 10m
+              memory: 192Mi
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+          volumeMounts:
+            - mountPath: /etc/wireguard
+              name: data
+      initContainers:
+        - args:
+            - |
+              # VPN clients may reach the LAN, not this pod or the cluster networks.
+              set -eu
+              iptables-nft -t mangle -A PREROUTING -i wg0 -m addrtype --dst-type LOCAL -j DROP
+              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.42.0.0/16 -j DROP
+              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.43.0.0/16 -j DROP
+          command:
+            - /bin/sh
+            - -c
+          image: ghcr.io/wg-easy/wg-easy:15.5.0
+          name: firewall
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: wireguard-data

apps/wireguard/httproute.yaml

@@ -0,0 +1,23 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+  name: wireguard-admin
+  namespace: wireguard
+spec:
+  hostnames:
+    - wg-admin.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: wireguard-admin
+          port: 51821
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

apps/wireguard/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - sealed-secret.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - service-admin.yaml
+  - httproute.yaml
+  - networkpolicy.yaml

apps/wireguard/networkpolicy.yaml

@@ -0,0 +1,48 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+      to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+    - to:
+        - ipBlock:
+            cidr: 192.168.2.0/24
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+  ingress:
+    - from:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - port: 27299
+          protocol: UDP
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+      ports:
+        - port: 51821
+          protocol: TCP
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: wireguard
+  policyTypes:
+    - Ingress
+    - Egress

apps/wireguard/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: wireguard-data
+  namespace: wireguard
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Mi

apps/wireguard/sealed-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  encryptedData:
+    oidc-client-secret: AgDML2QiPv8lLkyYYOXVI7IY+F3F6x4AoJP7OwNWcFzN699HTvud78sYW1zs9P3BX8FfUArkXHZhjG07OyP5HYxtbUvv4t1IyJaMqg1NsBSB9F3QPEVoanrEIwfUbrzbIcCjD9J0RRrf7aBeAL+zTI1odEOFQhdXwrwEliombjLTcjMMBZGW8IVAQ8/2Ip+Vl8fIGpoS0kP6PGW7NZMTehxBMImyLipzJeYrg2gHN8dlHgE+TWKIuAxV0TSmWV+QvjW6ivSWEwDOabGvQ9GxH3DCwSvPM4kEm5SfFXodzyEvFVsK0MFyY/TvsIU8kursZrSWNlhu437ncjPp4H9X/AYikYHqUnx0hbLRqspIP8OmdNu4A3VdQjGVJcqwsSWmKBIpXrKaoO2GmQQWKKhmbFfgJaCXDmnPBG1A4ngLnNzFdG4JuT5zZwfQRLe0BHxkVbTaN2MtsU47G2dS55TXoJk8q54Gi/buarf0eNj515DsgiI/CqaUchp3I9U+SWC4cHtAF8EncC1qbfqtMTpI/mEsK+L3RxKZFq0EPXmrOLYbrqjA4H44l7cdg8/3aVxmILCh0wleytUuYnQG0u1+vNk/5H73F+RZQT2UbOzQZ5VVIvzT1vNgu8EAfX8+HWvbRANuGB+4hAdOLv73myL2qnxyz3N5btXFOGbjDjAkxeLKf/qEsAXUBPiBGPh5NEdCEgMSzrgvdtfzQ/BzT8i0xUPBzjVvXAQQckOprZAuz9IOq5N4Ug7VRFgktyDpzQ2acpcWuxeq4opfrj5PGM5rUPkv
+  template:
+    metadata:
+      name: wireguard
+      namespace: wireguard

apps/wireguard/service-admin.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: wireguard-admin
+  namespace: wireguard
+spec:
+  ports:
+    - name: http
+      port: 51821
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: wireguard

apps/wireguard/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: wireguard
+  namespace: wireguard
+spec:
+  externalIPs:
+    - 192.168.2.5
+  ports:
+    - name: wireguard
+      port: 51820
+      protocol: UDP
+      targetPort: wireguard
+  selector:
+    app.kubernetes.io/name: wireguard