feat(add-ons): Add observability stack with kube-prometheus-stack, loki and alloy

README.md

@@ -1,40 +0,0 @@
-# gitops
-
-Argo CD manifests for a single-node k3s cluster.
-
-## Node configuration
-
-These live on the node, not in this repo, so reapply them when rebuilding it.
-
-### k3s
-
-The bundled Traefik is replaced by the Argo CD-managed one, which is exposed
-via `externalIPs` rather than ServiceLB. Control-plane metrics endpoints are
-exposed for Prometheus:
-
-```yaml
-# /etc/rancher/k3s/config.yaml
-disable:
-  - traefik
-  - servicelb
-kube-controller-manager-arg:
-  - bind-address=0.0.0.0
-kube-scheduler-arg:
-  - bind-address=0.0.0.0
-kube-proxy-arg:
-  - metrics-bind-address=0.0.0.0
-```
-
-### Image garbage collection
-
-Kubelet only prunes images once the disk crosses 85%, so unused images pile up
-on a large disk. Also expire images that haven't been used in 7 days:
-
-```yaml
-# /var/lib/rancher/k3s/agent/etc/kubelet.conf.d/50-image-gc.conf
-apiVersion: kubelet.config.k8s.io/v1beta1
-kind: KubeletConfiguration
-imageMaximumGCAge: 168h
-```
-
-Apply with `sudo systemctl restart k3s`.

add-ons/argocd-dashboard/oidc-sealedsecret.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: argocd
 spec:
   encryptedData:
-    clientSecret: AgBqp25ilSAdFoj5LmPESSi/5Gq/Cai4vmZs1czKXmohOAMq7HIRO+fLWn+wU5B7R44s0kQ2Xw1ohF2hzTVljsK31PIdYNLbblfxYduKIJLCW1Um3/fCyYC6WSAFlZnaEn1iGghvR468Bsh8KT3OFIx3R6L5fu1dJ3t7JYE557GtkLbD7EWD70q57itUa+2OdL+1XdvSXOrqSVYjBcFdbxTRTUtvh8LR9J0Mg+uRYsk17UInfCqT3FRQtwRGQMQs+UX/4AuKzyTjw60w2lcfIsm/SBGvG/72FENUt46XGALoXmj3h4DaZBCH0j2LHWi3c+1psKTEXner5jw00Xa3eNOBKoDwIoEOIyGjIrhLf60d9Gm9Fp1weqcf8JTJdO3sXd4RXleUT+2zsu4vIeIXShXgCC/dz03kSXpPcM4/4XG/hWfu7Xgffc72Erdqbwj2SFpksVTQp1mWrhVu01qB45AwcaySpUovdYEm4DWhq7eB91sk8zhmHCNaDosnOlSjd1UD63L9Rg4y+objdVNEKODhFueSWh/Lb2wDQIxq3dR8Apy0cqSmrJ8QrJV8eAtsupHfn7Hg2zTvIM4jnKV8zQ+Jiut+Kpb+pC8jlcJPRfp6k3lpUjP9t95q+T8CVfvCMyEw8u0w9OUpGhozUMbW/BlP6tsWaJWKLnocIROxYPh3Rf4UtJ8Ol3qEW3Wkc+i6FyrIUlEGkQAad7USrADTx14Ge/XfZ6KO+Yt3FgyS8884u9dH8egkcEYZbHiZweAAd552JwIZn8gj7oUPxq8UQtNK
+    clientSecret: AgAuadGZNylY8/lomfIg8PybwBtfZ20BXDfNacgIMMdRanRgRnLhMghaZfcQbcGuKRaAIya/aIqbUKkQwat2elypOp374wvDHilnaQ0DQ4qCBGZlPLMSzyEoz+sSuB3c0YHLcj48DIF9b5b24jsysS9mllTQCeEBNsuXiEjEuSBUpu6EbR5ztRPnEi8OnuJYTMJtnMVX0iPEqEK4DsR/c7ActayVBG+sGDK/ZyACxyLg8cuhJ2p7SyxqCwqtaS4NaKC6d4WK+3LEQcAd65PWeSKbR7zv77EcUQ8yzaM3yDXIZMmgLMzynfPgyll9aLr31n2UOaNU2uZPT6JtlnPARU1WuzQHcRCdJBjuKneDahE2D3m7sClxUCNXTgXfZqsWl6/gSvZrREukQyJgIz6mmmN3rUjYRn0lG+0CU6o1uDFGHyn9GEmzTPT4zt/U0YD7LjwdR+tWHBUmzQCPbe2DcPQLb+OwyY0M9RC52btfJVyErjMXN7TP8ut1Gmf6p0phr9ebVH9hNAPWcfbWkNG4r8c4gzHDca9ULPrwjz1oJsNeHf6ZXu3Zu26xnFsLswSQqWSSpBrHA9F5bl3U3/ScNErD+wrP6lH6dqcGGJVpMMUhDDNBKkSsu8zL8M97x5MYZPwAI+EfNF5ijdzqZbgEU0iTjJv5fHX1i+rGhbzkfqvuI3ti/8CkcSB/dEAYQXwfmSrtPJISX1zEWhqzgIfIDuPk2BmD+rKmWL906+aff7M/Ns32wZlvN3eCPVjO9w80mkn6OJY11re0Si0eg4ksUZDH
   template:
     metadata:
       labels:

add-ons/argocd-image-updater/ghcr-sealedsecret.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: ghcr-pull
-  namespace: argocd
-spec:
-  encryptedData:
-    .dockerconfigjson: AgCRsZSHP+T0U4pLck8AJ++dCb47OklXOgediZXPUSENy2/W/o4ooDgr+vP9GmSMoSm/5FBahmiSF8WYth0TYL4bdTKMQfnFO4kAOxk5QXuyyaKL+ZxL3XFfKRUeVD4m+HFJrvUsHC36TeJy0SYwkaS5isWdNTPFPdNRhXQ9OiTKQlL2tPZgOzk48CH5wDCugI3uC6/1tuzoeNzbIWRFpbkDtwhdGBqnZIiZZhOliXBV5wGnEcPKpxBnE21PNBsr2A8/lisuTsmcsyZDj3uenLjcdITdTs57sss8HPEI9u+cIuNFCZVO/URtJEV1k24oEr3CAPJojic6vT6jS0Ow9H3VEJpEObAN4E02+yC/gZjkLOBSO9aq77SzVRJpTxmcuW4s2U91hegYzS33H0jBCB1EJ5y/rYZUFrdBQnr16gENbMo8HuYf0jnogDvyGjd4Kf4HWDl97yiOv2xdm7Jb3MBrgyCQSw2uU4QpvgwGpTCo8j3LrfqQjBZRyTn/HplLO+zGkQKcqsNosZ0a+fm990gDWEgBuNjf/2iVLsYMJrz8da3Fu4k2TTtzxtAZ0eFJbxa97CRC3d/4nx/vS/S3zTzoXhp2XHdlG3RfurrKKtxeretRlTtbTM8CjahMB0/oLgBKSaNs5gEtvaATKe8jBfAw+WHxCFJC+0Jxj8IfDq0KWv2I1OO2r+7TK+o2Ed/7SucJQd4e4NQJfWQW/xiq4RL3StJdO3WXcICloslTMtE9EaZn/w/dx98bLRus9mrkom+tPSHw63tHPn6C4B75Ya8qA5LSBylMEZXg8CG5xfqmR3C0F/c4XCYerfbzNg88AIw2VBsAgW6aySCkZCa9rkaCx5AyzblCVQxGZ+PpR0RdaBkuT2hXoWHBZZu9Dmhk6Qr1HyqCBaV2DmsYFcYB+pfHUKzT0BAWO7BdbiLFil0V779JZw==
-  template:
-    metadata:
-      name: ghcr-pull
-      namespace: argocd
-    type: kubernetes.io/dockerconfigjson

add-ons/argocd-image-updater/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ghcr-sealedsecret.yaml
-  - pixelos-applications.yaml
-  - redoost.yaml

add-ons/argocd-image-updater/pixelos-applications.yaml

@@ -1,16 +0,0 @@
-apiVersion: argocd-image-updater.argoproj.io/v1alpha1
-kind: ImageUpdater
-metadata:
-  name: pixelos-applications
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  applicationRefs:
-    - namePattern: pixelos-applications
-      images:
-        - alias: app
-          imageName: ghcr.io/pixelos-ci/applications:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-            pullSecret: pullsecret:argocd/ghcr-pull

add-ons/argocd-image-updater/redoost.yaml

@@ -1,27 +0,0 @@
-apiVersion: argocd-image-updater.argoproj.io/v1alpha1
-kind: ImageUpdater
-metadata:
-  name: redoost
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  applicationRefs:
-    - namePattern: redoost
-      images:
-        - alias: api
-          imageName: ghcr.io/whyredfire/redoost-api:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-          manifestTargets:
-            helm:
-              name: api.image.repository
-              tag: api.image.tag
-        - alias: frontend
-          imageName: ghcr.io/whyredfire/redoost-frontend:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-          manifestTargets:
-            helm:
-              name: frontend.image.repository
-              tag: frontend.image.tag

add-ons/authentik/blueprint-argocd.yaml

@@ -1,51 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-argocd
-  namespace: authentik
-data:
-  argocd.yaml: |
-    version: 1
-    metadata:
-      name: ArgoCD
-    entries:
-      - model: authentik_providers_oauth2.oauth2provider
-        id: argocd-provider
-        identifiers:
-          name: argocd
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          client_type: public
-          client_id: argocd
-          grant_types:
-            - authorization_code
-            - refresh_token
-          redirect_uris:
-            - matching_mode: strict
-              url: https://argo.whyredfire.dev/auth/callback
-            - matching_mode: strict
-              url: https://argo.whyredfire.dev/pkce/verify
-            - matching_mode: strict
-              url: http://localhost:8085/auth/callback
-            - matching_mode: strict
-              url: argocd://auth/callback
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-      - model: authentik_core.application
-        id: argocd
-        identifiers:
-          slug: argocd
-        attrs:
-          name: ArgoCD
-          provider: !KeyOf argocd-provider
-          meta_launch_url: https://argo.whyredfire.dev
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf argocd
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-garage-ui.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-garage-ui
-  namespace: authentik
-data:
-  garage-ui.yaml: |
-    version: 1
-    metadata:
-      name: Garage UI
-    entries:
-      - model: authentik_providers_proxy.proxyprovider
-        id: garage-ui-provider
-        identifiers:
-          name: garage-ui
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          mode: forward_single
-          external_host: https://garage.whyredfire.dev
-      - model: authentik_core.application
-        id: garage-ui
-        identifiers:
-          slug: garage-ui
-        attrs:
-          name: Garage UI
-          provider: !KeyOf garage-ui-provider
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf garage-ui
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-grafana.yaml

@@ -1,38 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-grafana
-  namespace: authentik
-data:
-  grafana.yaml: |
-    version: 1
-    metadata:
-      name: Grafana
-    entries:
-      - model: authentik_providers_oauth2.oauth2provider
-        id: grafana-provider
-        identifiers:
-          name: grafana
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          client_id: grafana
-          client_secret: !Env GRAFANA_CLIENT_SECRET
-          grant_types:
-            - authorization_code
-            - refresh_token
-          redirect_uris:
-            - matching_mode: strict
-              url: https://grafana.whyredfire.dev/login/generic_oauth
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-      - model: authentik_core.application
-        identifiers:
-          slug: grafana
-        attrs:
-          name: Grafana
-          provider: !KeyOf grafana-provider
-          meta_launch_url: https://grafana.whyredfire.dev

add-ons/authentik/blueprint-jellyfin-ldap.yaml

@@ -1,116 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-jellyfin-ldap
-  namespace: authentik
-data:
-  jellyfin-ldap.yaml: |
-    version: 1
-    metadata:
-      name: Jellyfin LDAP
-    entries:
-      - model: authentik_stages_password.passwordstage
-        id: ldap-password
-        identifiers:
-          name: ldap-authentication-password
-        attrs:
-          backends:
-            - authentik.core.auth.InbuiltBackend
-            - authentik.core.auth.TokenBackend
-      - model: authentik_stages_identification.identificationstage
-        id: ldap-identification
-        identifiers:
-          name: ldap-authentication-identification
-        attrs:
-          user_fields:
-            - username
-          password_stage: !KeyOf ldap-password
-      - model: authentik_stages_user_login.userloginstage
-        id: ldap-login
-        identifiers:
-          name: ldap-authentication-login
-      - model: authentik_flows.flow
-        id: ldap-flow
-        identifiers:
-          slug: ldap-authentication
-        attrs:
-          designation: authentication
-          name: LDAP bind
-          title: LDAP bind
-      - model: authentik_flows.flowstagebinding
-        identifiers:
-          order: 10
-          stage: !KeyOf ldap-identification
-          target: !KeyOf ldap-flow
-      - model: authentik_flows.flowstagebinding
-        identifiers:
-          order: 30
-          stage: !KeyOf ldap-login
-          target: !KeyOf ldap-flow
-      - model: authentik_core.user
-        id: ldap-jellyfin
-        identifiers:
-          username: ldap-jellyfin
-        attrs:
-          name: Jellyfin LDAP bind
-          password: !Env JELLYFIN_LDAP_PASSWORD
-      - model: authentik_providers_ldap.ldapprovider
-        id: jellyfin-ldap-provider
-        identifiers:
-          name: jellyfin-ldap
-        attrs:
-          authorization_flow: !KeyOf ldap-flow
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
-          base_dn: dc=ldap,dc=goauthentik,dc=io
-          certificate: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          bind_mode: direct
-          search_mode: direct
-          mfa_support: false # else ";" in a password is read as a TOTP separator
-        permissions:
-          - permission: authentik_providers_ldap.search_full_directory
-            user: !KeyOf ldap-jellyfin
-      - model: authentik_core.application
-        id: jellyfin-ldap
-        identifiers:
-          slug: jellyfin-ldap
-        attrs:
-          name: Jellyfin LDAP
-          provider: !KeyOf jellyfin-ldap-provider
-          policy_engine_mode: any
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf jellyfin-ldap
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 10
-          target: !KeyOf jellyfin-ldap
-        attrs:
-          user: !KeyOf ldap-jellyfin
-      - model: authentik_outposts.outpost
-        identifiers:
-          name: ldap
-        attrs:
-          type: ldap
-          service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, Local Kubernetes Cluster]]
-          providers:
-            - !KeyOf jellyfin-ldap-provider
-          config:
-            authentik_host: http://authentik-server.authentik.svc.cluster.local
-      - model: authentik_core.user
-        identifiers:
-          username: whyredfire
-        attrs:
-          attributes:
-            jellyfinUsername: karan
-      - model: authentik_core.token
-        identifiers:
-          identifier: jellyfin-whyredfire
-        attrs:
-          user: !Find [authentik_core.user, [username, whyredfire]]
-          intent: app_password
-          key: !Env JELLYFIN_APP_PASSWORD
-          expiring: false
-          description: Jellyfin

add-ons/authentik/blueprint-outpost.yaml

@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-outpost
-  namespace: authentik
-data:
-  outpost.yaml: |
-    version: 1
-    metadata:
-      name: Embedded outpost
-    entries:
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: mounted/cm-blueprint-garage-ui/garage-ui.yaml
-          required: true
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: mounted/cm-blueprint-pgweb/pgweb.yaml
-          required: true
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: mounted/cm-blueprint-qbittorrent/qbittorrent.yaml
-          required: true
-      - model: authentik_outposts.outpost
-        identifiers:
-          managed: goauthentik.io/outposts/embedded
-        attrs:
-          providers:
-            - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
-            - !Find [authentik_providers_proxy.proxyprovider, [name, pgweb]]
-            - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]

add-ons/authentik/blueprint-pgweb.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-pgweb
-  namespace: authentik
-data:
-  pgweb.yaml: |
-    version: 1
-    metadata:
-      name: pgweb
-    entries:
-      - model: authentik_providers_proxy.proxyprovider
-        id: pgweb-provider
-        identifiers:
-          name: pgweb
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          mode: forward_single
-          external_host: https://pgweb.whyredfire.dev
-      - model: authentik_core.application
-        id: pgweb
-        identifiers:
-          slug: pgweb
-        attrs:
-          name: pgweb
-          provider: !KeyOf pgweb-provider
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf pgweb
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-qbittorrent.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-qbittorrent
-  namespace: authentik
-data:
-  qbittorrent.yaml: |
-    version: 1
-    metadata:
-      name: qBittorrent
-    entries:
-      - model: authentik_providers_proxy.proxyprovider
-        id: qbittorrent-provider
-        identifiers:
-          name: qbittorrent
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          mode: forward_single
-          external_host: https://qbit.whyredfire.dev
-      - model: authentik_core.application
-        id: qbittorrent
-        identifiers:
-          slug: qbittorrent
-        attrs:
-          name: qBittorrent
-          provider: !KeyOf qbittorrent-provider
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf qbittorrent
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-wireguard-admin.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-wireguard-admin
-  namespace: authentik
-data:
-  wireguard-admin.yaml: |
-    version: 1
-    metadata:
-      name: WireGuard admin
-    entries:
-      # wg-easy requires email_verified, which the default mapping sends as false.
-      - model: authentik_providers_oauth2.scopemapping
-        id: verified-email
-        identifiers:
-          name: wireguard-admin email
-        attrs:
-          scope_name: email
-          expression: |
-            return {
-                "email": request.user.email,
-                "email_verified": True,
-            }
-      - model: authentik_providers_oauth2.oauth2provider
-        id: wireguard-admin-provider
-        identifiers:
-          name: wireguard-admin
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          client_id: wireguard-admin
-          client_secret: !Env WIREGUARD_CLIENT_SECRET
-          grant_types:
-            - authorization_code
-            - refresh_token
-          redirect_uris:
-            - matching_mode: strict
-              url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
-            - matching_mode: strict
-              url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !KeyOf verified-email
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-      - model: authentik_core.application
-        id: wireguard-admin
-        identifiers:
-          slug: wireguard-admin
-        attrs:
-          name: WireGuard Admin
-          provider: !KeyOf wireguard-admin-provider
-          meta_launch_url: https://wg-admin.whyredfire.dev
-      # wg-easy makes every user an admin.
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf wireguard-admin
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprints.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: blueprint-google-login
+  name: authentik-blueprints
   namespace: authentik
 data:
   google-login.yaml: |
@@ -67,3 +67,33 @@ data:
           domain: authentik-default
         attrs:
           flow_authentication: !KeyOf google-flow
+  grafana.yaml: |
+    version: 1
+    metadata:
+      name: Grafana
+    entries:
+      - model: authentik_providers_oauth2.oauth2provider
+        id: grafana-provider
+        identifiers:
+          name: grafana
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          client_id: grafana
+          client_secret: !Env GRAFANA_CLIENT_SECRET
+          redirect_uris:
+            - matching_mode: strict
+              url: https://grafana.whyredfire.dev/login/generic_oauth
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        identifiers:
+          slug: grafana
+        attrs:
+          name: Grafana
+          provider: !KeyOf grafana-provider
+          meta_launch_url: https://grafana.whyredfire.dev

add-ons/authentik/kustomization.yaml

@@ -2,15 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - blueprint-argocd.yaml
+  - blueprints.yaml
-  - blueprint-garage-ui.yaml
-  - blueprint-google-login.yaml
-  - blueprint-grafana.yaml
-  - blueprint-jellyfin-ldap.yaml
-  - blueprint-outpost.yaml
-  - blueprint-pgweb.yaml
-  - blueprint-qbittorrent.yaml
-  - blueprint-wireguard-admin.yaml
   - httproute.yaml
   - referencegrant.yaml
-  - networkpolicy.yaml

add-ons/authentik/networkpolicy.yaml

@@ -1,57 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: authentik
-  namespace: authentik
-spec:
-  egress:
-    - to:
-        - podSelector: {}
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 5432
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: postgres
-          podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - podSelector: {}
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 9000
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/authentik/referencegrant.yaml

@@ -8,9 +8,6 @@ spec:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: garage
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: pgweb
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: qbit

add-ons/authentik/sealed-secret.yaml

@@ -6,15 +6,12 @@ metadata:
   namespace: authentik
 spec:
   encryptedData:
-    AUTHENTIK_BOOTSTRAP_PASSWORD: AgCdmFtQtxaSvL+ggv8kdkufOxVEhBOPMWEKmv0k6LpakDZdXDKBEdcb4bj8eYSbAePTpoPbSraV0GxMxw/D+Xm9o0JbbXqW+G9MfxDTJDE8n1eFkw/bRjq2gIZq/MNRH0ORBMpviQeAFnzt2gfcvu3Fua2RIQji1JHR67d6xTtzGTIunyte7UFh1OIDr9JWE+6mfjKVuebbWq1qUXq5ScrWf0UYjJ/qHJiMjM7NZeEq8v9D9uYZoXoZj5Ew6BRP+UWGZOgoulxgJys5mdAo4k6NMYapT8vEyyyOmzDlBYPG0KucQgiVHBwW8UaBvRQ3WES/xYgD44fwSIiLwtFsU0rCfDQXUMlbA05wvcy8u0Fq8v8xKCWZhpWpxKzaLHRIFL9QKfRmil60nvwYferjVRtfObdY28hU+/vh/LDJ6NMj5d5APgQ/1/otX/XQ48Ezrmo2nZqhqdbFKlJq9eSukcfB5KARvKrY7tvFmGr8tyqqqn2eAeDlcy8ivNomF9sIqYKVadtv4UlO/SjwTM0UEUyN2tIGTWBGWI6kDWKFjUtjsJTmMSTKFvTHyd24sUa8QskZgGLqMmF1z+Z8upVK3qgo5EKjFvvT9MekVZp+gj0eD9dZreEs8QeScw0+Oxl+ksrp6bJWXwh/A05/QSkPQm7A1Fx7KoVRdo2PVEJun7Jk4HuOrYXG+EAvDE0A66psM1XntLPdUlHbdt15a9JxMrTc4LI3ARw9TFDi9tL89G1JMQdBJGi63AOuOtLPVXm96zI=
+    AUTHENTIK_BOOTSTRAP_PASSWORD: AgAPgYcs6IXUWk3VUgoPNQXwP43kEKP26OAJmu7dA4vTRhmWwmJXN8ybRhX7jS2YPwGWxAWflxiM3x7F3jUohOpqN37et4zFCoUq43mQ3blbTMV4zhsuyMx0JIqhsafzlVWiKqmqIykVq8yJQ6886FkIS0u14i//YTcs0QMS7gum6pDEhehAg+FhwiNgm92iVCyhoh+3rL549akXe53UJNKwVzuWavEHZFTKJNmFa2g9YzYcJgNf46f7maPbfSg09E27XC9L7KNxxiodU2h0D50La8LMEX+X0fAbLtrXPf9MsJjcfNvy0kXqy/AB+A5zL/Yh4uVztWikE27evDvfeoWc9svCTIbBzwx1EtR/nC71IvN61ADpFGbTXA44jSOtPg6nNtOAq8AEqIp0p3uNbQK17cEfbmDtq8husTYF1i6e+VFVGIltPiGdRSZb92xtLGkf63YfdYXSy+xaiIJ/8ki4vgw91KY0l5/9sS1BqWR312UUEAtOGt7M4cydVEWToc1AdYj3RDBgPjmqoddiR66EMzhCFz5sxlU/rji7j4DAOFA4gqAV5JAZO1HehNFp2GajTi36d0XLe06/Z+IbEmSeTlPTGZOvxTweYcWexplzp/ob/MwAaMouPRcmae4/VTlu9Lex1bMYugc6bD8B7V+gmM/MhY7heQl+mSyBV0CO6JsZwC1tipzcJfaiBzUF8sZ7Ast3v+7omsjFo/CXqxbPNZrolipiEjE9IT3n3r2m7gpIkv+A/ie77iJF8k6zFRM=
-    AUTHENTIK_POSTGRESQL__PASSWORD: AgAlxWe8VpLJ9qzrJJqIBbWgctSdBBjx8HUXVqLQtZx1zWURks7YsB8RGdBYO/o/aQ42Q3EI/YLGiNdvm+7M+Bmbmg4GoXTxNujgfg8W4BZ46Z2g1sq/4mJhj3Bx/fiRAL8QaqJNbSiSmGoCRXuwseuiqDSrEn69ly/Y+wRlV22ZyPqa4vU/cesOFVYu6EAWKhS/6Af5TrsxEVwFPQUmOpsMGTxHV4GSkbYiXAjq9Rr2JkgtmISDiSGTFB6QcITF5QzdaAKaDym1ol/j2VLAXACgesVvUs3cFtRCprusXctUtNZdURriytUn7UusbeB+7YeG4hJohgGRZne83OkPd2RyYj2XyS2t7G5vV83WDFFBsOkvXQDGlnfSgAovyTX8hpUbwvWq2nkpRm+NhJYyryXR9QRZcnUdf4LZgSwDWasy1nUwTuOs2W6YIsdN3yV+BLq+yC77vDRrdlNbibc54EycuwDPzMnqazlGoPrxO53li/qGJN4v+et1cfevk3dXguYrOH7E2Kmqh0nAjp3mojoPfG+1RTzwRoiMjaLxEbtkLWzq/gBJTsVdWtTq1CpfEVT47Todc44lDmtk64OQffxQbq+ryaR6q7V8bRynsTYPJVFi0+VD5mjdmWz5IDDP5+fCMb6xZD6oTqgVoFV3zWSAj05J87Ok/lR99xCU0WqxYrF6o+3Bvg5i9D7flAw8nrFmuNc7G7SXgcQu2QIHfOikVXL6WScJl1Ycu9v38KvtZep5XjzGgHQ2SvfkulhaSlU=
+    AUTHENTIK_POSTGRESQL__PASSWORD: AgAoQ04gX1QOUI5kfNMNy07pnaqDTp4X6LDlQBBwSs13SVGZCJAL61hQymOaL/U2cCyc0N5nr7FCswHcqBE8t1esKlK/NB+BL9aWfO7uPonhdzsc2iKBONZYickCyyD+8Hgu/McQDPVo6vMQ51/82WL2ZKfwJEfTKmo1OfJ/I2Tls2KmczzlkNrCC9M5moObXl+PJlKJuxAkeXJc61MSn/vvsvksG5O0AKtXHmTk8E1t7krAbOqKy9CbVwHJAwH/NIhiOgJr/KziceWhHHQiEwC631ZpM+fZWiUSKETwpnLWSl7s8SvsEUNA9s/W2w24tpqSKrHOZtS6J0sT84FsV9U9T5MaZtZT9NG3FmNehxQpIlet6BSyJh+JMq5LjzA8ANvVvlXs4jhJyTcotLf/m1ZJbetVjFGJjvxUbVuxObpMentVrAeLO8cZqk1iTzqPdkrEeV38DN2E9oJSyQeRP6sZTnDd9xweou8nwMZWidyIDorTKSwvggje2YDXefc8+aOVVCN7pBOwKisEuPH35Ov/A2RDzmE3mQRC3EDuHJ+3dZbVawIawV0ZUIL52X+ongbllOtHABUfODY7tTC/VQMk07d3/zG5q7bCE2D+R0XE4oQJy2h2wYHiYUoGYM5JKC2me4TIx6Y+haksl2mqfC/yal3FLWMBdK4eC9VyXugO25l4yLVOcKa/QMhImHB6lbyNLGDuafnIanMkraWo73EqqXpF3IIqfzfgkj4aOO3Cbuu6BeQ4bNmmam+cWLqq1QQ=
-    AUTHENTIK_SECRET_KEY: AgDZtbDVvUGwkMw+uBUv7CyPd1lNrh23svotEiD9v+8gDaJlE6P4r1qLijYn1dqH063RdmmW3wndlohM/MjAXzSJbdRX3hv5Dk6Rd2fJKZdOiGuHFNRTLXsVwe1k0JwyweOzdBYcjHnfvSwEpI1ahFEtsmA9QhJ1HOpMxoMyA6oBWGkcjdO888wrL7EkMTYeAtwtIdnqA45X4Zqi7hhRdtZjhWBZ0d3pel1105DAxd1vyiK1mALvXhfFI3ixKYyU3Mb9q8O6KXHrv4JqOW/Zz9OQVpf0/yVRxv2xkYFvgaj66xW0KcA5rVp68NSDEGE1O4a/W2B09n1vtb5ZRml2597j0/36/wYkl9Q87jFEBkXi2xfDUTBHlm2ik8DwcOK6f54j2sHmWJMywPHsBYBvxVdRFQMxXXETQJWaas5ToL78HzFLsL3uuoez7umFMXtta3Dg3t6AqC3NwbWqicKgU8zJVPWNJAoLr9wrmJBOBLXgMHGnowLAkfNJNwQIAu2SaQwLpOZEfTkyKc+HBm6/rM++IpvCg1KJXGoUPbAq7qt97t8d0ev2JdHs3kMU8G5PnNfE+nf/6limWxp29Z/vXdMZ0JHWk+ivCia9yrdP0IXEqvSAuewEniKY+nYWlPZpJwX6kNpVcSK7DTIVzv+l9vcSPrLnkjwuzmnd+Sv4lA0cYkwh0uZ+00FF/0RVCEj8OP/c840bINdsSX13BXkaeeA2InZFWvC5PrjNKY9RIb1k2Hyo2EGS1ZTuIUNMFN/XORlBC2IdT0Tld1LpmKL8GuW+2SLJUJRwv23SmmAFWhPljg==
+    AUTHENTIK_SECRET_KEY: AgAHHDs8mbJRc45DFgap2VUZn/F+m59hm9u2lebuJv70HSBxLLsHEn8nXLGUO3b2ScyPt1Qi2wbmRDENTjOHOYHtAQAjwV25r6RUiZ5TosRH2KhGx5N6gceorYQyk18l2CkKv4ObXjeGLJA0EqMarmFWiT24SFZdtIrOvWygLxg4XGful2h1Fw5uXK9PiUHgptrp/G5M5Htv0bvtD6m/FrgOlK6C6tK1D4vLL3VLX3/SceqNWVDIJmJao5JKO4IZTQxN8TN5k9K2CGrtOUhjCn4vLbYQKTPhiiidoQaipQ9FR+4KJMO0y8FbIy+3q7C/UZPyOTOu/2zI4t5h4TJY1+477A80GTLpE0aCBDpmFwgZY728wbTW4NyfIm15u0Um7OXhnJkXC1EqDbvlK4HYHiSDUjGChvlfMEY+D1datDlF1fEuIaeXtTqowpz3uy9qIEa0f1emS2J8TjIrKH3oW3mfmrJKSiySnCX1704ZPlwOJfnF5Z2vM6Oqo/mWHa6PSwPPRxSxEKVtSqD4KynzrUmx3GkrUs+7tntepA3yQoiDjyUyE71FwhJXO4sE3XcRGDUf4rB8CFO4+NgTbBAqFzNKYG32GIDhGjbMxBAJQMNXZhVcKceiaXf7G8LuaOEw39BkdtiFCdK3uXl9xaQPuStRsOYYQR2Dt0vt3AvDGjAW+McauCbYUD3rcAtVMo+rxEbejrotojWnb1OpGX0JqD5gHC68qlqY6BYkDbWpYojoKWJHuHlYxHIm8k7ghSq6npw94R526bxripNtcNq4Lh1NeM55LKruOEGr7n0dFcyAmQ==
-    GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM=
+    GOOGLE_CLIENT_ID: AgCV2Rwe/bHbkQ3nkkIs4EFTbsEqQWRaWlXa/fHzkDyNKpd0CTOgqVb6Rd2KYyvoT9iDR0xt/8reLPd9e7B3G3V1oVFV7G1XiErBmzvxr6591+tXzo8JLVpIy0363R87idi2xIKGVii+G5aJvxxhua8IRsNfi4SRtoqpDzjgNbFtm5UDhhlCzcRKkm0zHgLw83d4Uwszu9X9II2A4FuMPD6KvsTFrgHevR1v3OerKl5kvTlUx0O3XEg5mnNUVk46J+D9wfg58bIlgUhMV8NtfKa8I5zmRKhCJySks1zlCgIudCLX7wPYupFgt0nrZjJGx7a546ntPdMVE4IJ+VhlQ94gjdWsVFm07espaQLph9T4CZDKxb6TwyNswhfFxH1Z9auyFf3Cfk2wx5GChNOL0mZ8Zrzcw008c8IUShF8je8JZ60teBffbBNao7XN6JM6a4ac5aKnNwFch9IJUU1qkvcJaZk5hAkeGO9uHrICb6lkr5Rj7t4h9l4mvgfIKXP5YCCKZ+yqrSI8Jpkch/cB0Sphgp7m7QXgGwmWRgdKEk1rP7ioIfoF66mLsfgvOkc+1ySvPgW/rCLbHwzMqJn1Fkk/afbRoWp/guFj1cOY9MrEQIn8ftugeV/0xWiL+y5RyJm7QZc1z5fSj/NTrVCZV0LhBHttPZzoGGWEqjLYQnyJ8p38lK7EU6Pmk4WrEMj7mmdYHEijyPhab+b7guOc+ULbPT7k7sBHXbKrTTUJa09jIqSS4jl2PNrzPCPDIvRpG/cMgNklhNPfvpDQcLdVRA7bsf7navZvDsQ=
-    GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ==
+    GOOGLE_CLIENT_SECRET: AgDNFpqV5LGekTMvOBtPE9c6ZVPtT6wN+nCFRhZnvBKIz4I7U9jzisEN7yhc4ud22XJXpS5oR8hN4H+V6Js/bCZMDJefYcdstmHku14kUvoLRUtwPV9tdjiihmb57VLTnT1s1OzbnOqZPwXoCAmGAPLDgZrghBi0id21GgjU41jCHDJCcH1j9RHhE20JwsVG2uz9Tcp6MVYh94aq53V4//bvFXz4xQgVlN8c1jJ/W4rrNM9vmYdMwKyB5509oVWJigowsRlji0FXurR8ovz1AXpMuGj6hUGxLp0uHsqz7FV/0lsd4B2BR9cVRChAR8zDCiiKb4TH2Kmn676/Z+gtJ8vcOQg/WDT1ENzOr6dyndCLVxJvJuvl1EqinzhSqJjUy11HxqULApKKbX1iRJIAIGb6dpeKVoHDKg5xtcWGwaD6epG/tz20agkWBMCFNq5aS80npz28W5GeOQ8aF4X/rpjuEHVLrN+n0pgyS4wjwniB6UJMYRIYk45r0ICUtqyFjOiNzpU70NsPmEjDyItW1EVo+6tb0lRmOI5apm/9yayZXjFISwTAFPdBMrQL+ij4AGw4HMWMmN0aqDO+Kd1c9Jg6wUKluN2Lb6CaxehWeSJiz2wTEhEz8KBkInfezgSekNkw4wjJiBEZ4/M3G6Y/C61ekuVFarRc87cY+S3SomVZDGQcPysfQlieMVpHlfXq/CSDgHhZV3Q+S/wqpy5ZcfsyaU+v4PmvyEc12MZxQ1RGngVJow==
-    GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA==
+    GRAFANA_CLIENT_SECRET: AgBSE0QjGwtnyAjO/cy/TBKg+fuyKMSRgeQM/i7tPi9QcLpDjEHquGKmdBHUaeSaon3LRH3CPYQJ61T4d4xsp7EXzCM47MhO/rJ+6Xx+dGiIg071Ijj1qOBYszMNPXLZCst/9EfDEBRXQYmtr8X5UfcyXv8RHewvuqxcwy8qzsPsP5G/CpchGWlZRV3x+R+yCjVmTP7VuatPAltvGuAHsAv3Gh1aEXMJ1F3SsW/SP025V/bMiz1wKWe7/bkqJnXjLkNXWI/lpwzYWQl4/9v1Oiiw+1osH6fHNzXM6RA0ei1/FmlRwS9EqnUnl9hGE76GSllhwU9L6K9boJrKRnZIP6xBOJfrqimZciutTfiu6urghyimVACafQLWkeEB8m/zX1CSxVQ5M95n/dtdlBsWofMVyEtoeTip1HXZF1iee4yMv2yEg8yNSWmnb87fSYIMwpMiv5dYQTLg2WslnEe0DxcnyH+O0/MsmWHFz2f/Z4J6h+kWwMEv1pt8l+xkgbUthGGDx+HIcU9SZ/jyZjnzTt4i4BIbejAoXzMmm6q4zE0BD+9AbAQvEDOg6DW1TIu2mupoKVlqYljNE/9zVOAIBcFL0cJ4HNnW13+ufS4KoptZE3Rfv1tpU6g2MZ4y+QBCOczd+5HgXMtv3P9OweZg/l/LRdbFyH3OZviW/4suJFNbWZNgGUlqT/xyk/C5rn7uGSjSinp0lwkAqfxx7To/KP0jE7hJkVOH1vh+7COpFABJEx/cLAXAaIaVJsio38p5i4s+SMEq85Ew3uI46YKD8ljY7AQN3k66U7xQkLgjAT170Q==
-    JELLYFIN_APP_PASSWORD: AgCzqHmMF80Bh4OcOl0OStJb/zQk0BKzCjIblpELwMLsAuBtIOO0OK/IYrjlCO0T8Vn9jd00LQI1m7R5d+vCxcwbQVNhyw1zHDFg1MI28irvdJmp7439Si7R/T+gObB1I2Vww8d9OZJj5Zm9ngQoM+Oh5ne7c/+W7Qc9xgpWBDtcseCX5QDA1Uu4TJH1cShDQMPb3+KLq7MlKgoWw5uJZA/dJspdR1eqFyaXGHh+rceMZmzwG8sNz43KtVWKN0u7KrN+OE9RYdreQGCw09Yet8FwYA4+z4pAFbOIhyCfqdEW0uWA95f9PA27Z7GgO/CG2vonv73V7nvItIArPchdzdMwD+/UimLllH70tPB6GfZqMsU4FnwdhAyl/UhVO4/PILNZFyyku3SfWtIc2GAf8w0i7KB/zSZoo+HdrGsG8i5020XOG9lIqH/vNTeU4zPBWROEtCKzPjmewBdR2CmGtDu4RrN3XHK5sljwXU3o5QucrD9k8RZ+TjQh6dk/cp373xB1ywMAF9+NmFalnIy4RXJSvjh2H5NLrFFty2vxLqsrVNYdlc8UjNOB06pCnugMBBCx9UIc92ntfoMCmdK7EsUguYB7KWbygbBMfVZ/PusWNMFpmqca5LzcQnoYVKtExRzfofftws9yd0zyQ1MnrEHAC28GlJjYKoIfP/8Tkvah68w9dIoiJ2cIgwkU41JiJ9tjRDIYdvIDBZUPKl3gDF6hbb1K+XbjrEHP5FAZ3Dul0uts2BxRbxBi
-    JELLYFIN_LDAP_PASSWORD: AgAmgR2Br9bWrqKtnUmcbicWUqVPcgVGLOgTkEhiC5rQPr2W/VXQDecb5ErIfl7XmvhyjMh/4lVymaUntpvD7tYGh0F5IeFTe9NVGL1ssanH7YqY4vQAfDdgQYOWUzl4cC5Lo79bUQcNk31YuJkqDlEiHXWv8W7u0L7X3ijbMvFcgkMwPgZuHPAwJGB9Uok2odtAeSCIQDZ/ri+TfSAqD4rBqKbvueP1o+bkNXN8qai1obvTtPH7NrTy4Qi0JAGQUu43RtTzjxoSaqr3Xq7Z9l+HvYJTxqRUhrNkME378OvNqcH6ob0J6siFyiMJnzfGw2BzhzJ11Y9PEVnzL8c3fC/VtF7bErhid/x9OzFf4qBs9ba1S/710P5BB1cqI8MmqGvc1vIHeH/J8AyWkbWGPqLdsqLZ4k5lcwDJ67R6RwMQIivc2oaUQJnBU2IEzT+EydAyzSMO/Obfc32UFuk64B0IigsXKii274r1tAxa3Ua8lvpi1rQkqhx6Fe8Nwkvxe116gLjWKqBiJ6dTPMuwvt3OkRjMpKBs9AH9V8t90lWqO4cBGd1kZYKTcAHyQkIM8XqIiOuwyzjuW8Kxjl7skT9DuV+X6GLWoUnZNpo16Vu4OUigWb7uuNuMcp1bI7fX0U0CR1H58h1dAUfLRGP06tOK8xakrmmsC/QCu8ErC2broAPOWKLsFQVRafiSjRcvQ7z2OcN/JHLAPeJUJcFVhdTJSpVQa41KW3MX9uFO8oXLLyQSrFFrKF7Y
-    WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti
   template:
     metadata:
       name: authentik-secrets

add-ons/cert-manager/cloudflare-api-token-sealed-secret.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: cert-manager
 spec:
   encryptedData:
-    api-token: AgAdOsht6DLr8etz8DyU3JJVzoinxnldvBWzS/GBJWzDvAUKw5O0Lu8JpPEZTVMj97uKs16YZsiDCwODBZSD2PJZUAmKwcaWFgCSqBjnWsaCgsEW4Fo9i/SnovgzIPRsc8Q0BOaGZ/85j2hsHHX9lGQZdzLvPFqtR8oU3gCQyFPOJnOFwegUUavf/OzbCsaSd5+g8RZdB5tGdoScw0rlpV2rMff3IqBvAG/drLj4zcjq1vviC0XF5E79rKu2wLPmVVXfLxt/hpO431OCxLyoBJ/2drb16hqUv0yrFVykllfnVu2YxMg7Tzu0m0F6QHEaIu3FTyTQyhX5iG6a0hjYjlmUY3wkenm6V+bc9/Z2w45cYkXwyjumjTzjGvofIjf4pV8F0jYlYcobnY0w8cfij5yLo6WcMuYWImxF7j+94cmANVgFhZkhevSpwFE7uP9x8KakTGHd12NTNvJE8n1hYy7vS7giJGy8TSKPoFr6B2793m532aVR4EeIF2BfU4zENrcr6w5zWQRvmh/UPYj0fd61kefIRorjt6Xt0ydwzgEE7ggxFYN/6Pbn8ZNOwQvGIppHVZCzH2IGh147Pmg/U7RQsPzWRVshhlr4sY1cBA1PGsdOODuGuvtVTR2EJ/AoL79X8stMXOxhv0/bzRiAhHS0sg4H0xp5z5x8g/xSva6KY0o6IKgBEbGDuIa1L39VNu/5TeP/+68ln76zJiWlO6W3Ksl4jwk+ALLCo2U7OXqTk/4HJygn10mLnlvF+YlfIfvq1a/61g==
+    api-token: AgCqVfWKc3TVZOWN2kWfWcEe+5pf5lRMOzcQUjgI7Wd4/0cDogagn0fF3MR1+tcm4kaxXyn0GzZLoOT4mWetg/BoGYY6X4DYy6fsyFzpvpY8mtdwiTrYtzdORSz1qw2U3yerB1st//Cy90D+sw8V13MGDh0vD0OEtYG4Xf1foRTR5KClzHmy16gjp64d4dbFWLO1oa99drQkCGRPhHcDzcrT0bFOutjN52p8AVcjBlzDMpP2k/Wo9wT4MiDv+clrXwOVyvARk5DrN9KY+iRiB0NkBvHaVNkQ9M62sIUJ9asBwIWZCY/aV4xGEvx9LYxAWvzIqmXBy+DOlOo3gOavQCOBI7Gdz015V1oIsViLQXG3j+5m0PSbguCNCXQhF9zmgqoJgiEpC2aFcU9oCZ/JS/DTiD8Xq60JSyY8bQE/yMX3vHAnXm5HOe14WJ60GkjGXPsBWWjmtAeBltAUW1WJfkTnHm/aPBflpZBkuJgkCpL2iMERETi0e4UfOuvf06cN3testuFfR9sIn6aD9mMY4B9e+6TLbjFF5uSf/W9/aMhLLTG8Mh5pZneGDndfRm6IG3Lj506xLOo3CAOA9BYF7MiShrgtuLmDH/pd8YCRTxsboYigQ2LrobpaQnkKYjHqLWNJi/I1rXefmEXK1mR8zZKJzBIsz4NG9TTary9v34yL22n9L+RtWJhrsFDXQqz7C860J7ifa28VJObo1QZN9bzsWoTPzUjK/Yw1GvrVUVUAsNyzbCgUjFUbrydoPmpx4ntmj6fSxQ==
   template:
     metadata:
       name: cloudflare-api-token

add-ons/cnpg/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - networkpolicy.yaml

add-ons/cnpg/networkpolicy.yaml

@@ -1,41 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: cnpg
-  namespace: cnpg-system
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - ports:
-        - port: 8000
-          protocol: TCP
-      to:
-        - namespaceSelector: {}
-          podSelector:
-            matchExpressions:
-              - key: cnpg.io/cluster
-                operator: Exists
-  ingress:
-    - ports:
-        - port: 9443
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: cloudnative-pg
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/kube-prometheus-stack/grafana-admin-sealedsecret.yaml

@@ -6,8 +6,8 @@ metadata:
   namespace: monitoring
 spec:
   encryptedData:
-    admin-password: AgDHA/P0QjtI0wgwOJTWOtRf49kKuqmX6sMCB4Vsk8LpGhFMYWgP8pnXxTAbV50qTnqVdY7GQfsabcWWaYDV7FTH3oRtAHbV+gplabbhlxIF3o+lwunkGcObbex9PrCI/9/qX4DL/wOVLTftlOKHzyX2+ajGnufDMuF3n4axiKAJNGiKiuawQIhksV4EgaGPtAhiInQUte5BylwlKIciTl6eiTDus3B+DVW0ubsX5VPVKRnJj2jKKM1woc+F3/+aSVKDzavjX2zKrptltWUgaY+KPIwuEsYB+kzy9JwtgD189NdGR+3f4zQNJ3pX+p9WzfhocyXdEiFAGPdqaPP0E4mMSd8WPpmdsCiFGN6aeu8vJJQOONyC/Bm63em+BJk1AaGWm1XgwC+GauUdkqAHNiva+XQpqIEBI20ddHJBN8HyS1xZajg2JI3Mxukfph0WjPoQ9kqhAkFjIfoIv1uvusL7fDAXhmAyp0s23f67WTzXB1ZWEyRGbgPZIoC0eHztILRIngUuC3L14/aTOhiTxcnX4VVUAJyXy1tM+NM3KCL6T7pQX81VnFerfzW+VeIzSpIU7AIaXuBf60d47j88Ff7Zm2qp257L0ov+sMY8jp33v8Vx4oB20h2bqdGbCdt4NWeD0hCBAU26vaFVuiUmZZuNuLNQqsCABa7cE86+BlRCVG0KXgylrFMNjE1IvgHj+LbazAWFQ0kSKpXKyD/AT0bX3ZNUQlL/U9jDMSuNTzYCjMe/znsQ
+    admin-password: AgAvoctRn9pH4kx3i0Q75rwFQYuAavZ7/1sgIHzmuOhzR8qPJVLeMwgmbZHz/dcNwD59tKpk1WmzrazUSdTAgkAKCs+CsxXxmxYoaDx+tUEMxHzpUKtW3On6a9YMzhp1e7iTewSMQVW+JZxnubxgT8Ws5N6iDlb/SVKGqrGMMk0436L4qRrXJvtmFRbcjn0h6dZHjuBNDBsGXh5TJCk07IIDYkaCpkZoJvH4Brf3Zla0jgRI3FQ2qFygButR1HLZQ6n7CPq9rhKhzSt3NWktV4zuU3GnZXgk8h9TML09UVEfv8W3NkKmIoXb7DewMhTbtcGw61eV6oCAERv0G2lVIBUQ6Zrfj942QB3KKvXLWzKNlCOMgV/JJUtEFw+lnsB9CLJzEl7eSodsIIFQIaby4iEozjaB2QtWtrROmR7mQDEqk1N0AUHx8oiuJFtJDeTn/0dzswPT+SRWlYoGr54uxHo0nFwkAZyEQehdrsd0Tor9BlXYt510fTSC4VZKHjFbDggyLPn+rmNrShQKB8yfeouovR/SaMa9LG0GpGR51dmDmtH64pN8ukCvMyjXrttD8qiArj+ysywTA2Fge61m1bw4dhen5v7HUrfZW5TxualndhhcUA1VWB9rljZvCqrzeYAwbdj36uTC37mqqhwa36SNKG/AHjKBJ0968TQRgf+DvP+xyIeqFk/tBA4FIfYkDM1jHrSlydWQ7vPca6pbXFtTVA6xUYpqraeCdcIK1n9mxFBG513W
-    admin-user: AgB0Uxo17KMXzvE/IbxYE9M6xDN30OXhQ66hD+MD1fUmNriResa+iGpCknByxOWDtccojz6abbVTJBw/ACjWGWDcmuafrRmkXcy6/l7gcirb/TVubUlyurecr9n1Iqna2Ip4/5IhEnBuVzx2e5xe5r0npRmWI0qeFN795OO6++2I3rZUR8lUMpywTs6oyGSKKQ/9qOCaN+bARIvja4fxGw6mzPNkIHS7MAOsiUElNft8fmT+JufSfQ0npvxgimvsQCFyfxQjWwZwX+LLKSesPAcDD6iXQvaR51NCfwpfRptfom/99QeIXjv0OyBysQUWfZyYNx3I8VKOEWXLSvCafCQVJV/tuHkWob1hVZcaSRZxJolnSZQ3mQ4hgYxfr9QZp3D4rQMgpzvqsJ/EwShwWEFqrOy353X5PNvJhQTB005FGky9yumYpiJjtAyX1QWeM9wBedZfKYUi7YLV9YXiXk91n13nQxfJ/HRRZFvqnCYtTXFRfX8PGbYF6aaW2nop3xcaDZ932y9fZQ9Q6AlasKUm+qCfkfl6dUOfVHftJRLpvm/60GLw5ylz9XTHS1EEPJAPpty8YExuxYWdHn5RoCbRHjKyQWxckKjFG6qZ7LcQpQuitSqwzcCqE04n/naWLoKJpMJhI0Ecs1hYai7LCFKNqZJm9HqncaeZ9SZAd4jquKOoVIJAJMyGDdzLQFkuq/7Z75y9fQ==
+    admin-user: AgAzRobKF4UVBc21QSAN42jmMSULMTO5F6wkOYIBqgUMyVAdSD1yW+9KP8s7Bu0+1efiqeAJGtB74IJ/8Py7szgHVv1jqHpKz9hqd8A+nJjAhAXvCaERMzM5KZu1ArAmRX6X6H2OdveOgii8la5mrOBDOXVFiG7AMYzjlP+Ia5H/5HBHsEAEKUUNZF1DCznOS448dGftyKK8XEDkCca9B62rFyV+fjEhnTVkvqlg++wgCv/YqHOWzT1uSXLtOBQzoTiYJM6D1oC4n8+xuQx6o7Z/sy6K1Cc5Ypx0ENPpuPwrIUgfpWt84XgKKM94tzN3szFXrlZe2uGkh5gNTEiSnjRa5azsGU/pp8uNV01FUwCORKbWtvyHm+mLM3V1qMhlQpenF92pOVlsMspvxMMaE9iWz5CaQl7QWEH25rjrlI1FGIQx5tQwZrOD2u7qRZ1xv1rsG/GfvKN3tTj7HkhbHL+OIkJHxEx4Doc6yoW57M8sV3b/18TuUWuRazBxn9RkNhcEd/CP/ZhKW13OhMm/U1fuzPDGqgWHoz+jVM7XCb9/p+X0vxUAt2ZiOAc1n8tGDglxkSYhoZX6agn6fviSaEWskalqpisiSpvpzQra/HxoyWqNG4+ovHiRM1yCdSxdsZoziVuVdnjP2wDV525nuU+38uDxMgAxWEigEFr5sOb5LFKKC+nnSwxaQ/+vk4NPJGqTuu9tGA==
   template:
     metadata:
       name: grafana-admin

add-ons/kube-prometheus-stack/grafana-db-sealedsecret.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: monitoring
 spec:
   encryptedData:
-    password: AgAGsDkcxjB3fakl0/pOZF/ej8gxCo7BUac0LJxfRR106PA4V9n2otOAiyVhmN45sNE2pscm2vDJdHtv5fWaR7AyZLaBk3dSn8at5vFh6Zgx20KLXWXGUrPaJLD07fuvNI4fgmFqEHnWsYUiO35mBfr01s6gTJPPr+y9b9LUzAA+WCuJERNwt+hFwmRDkI8rUvwr2Jy3TGKAJFJCXK1vkPtsGvIi8zHONlo+DI1uEH5qFECzScjXy4zEwKd54VoZtmS9F+QCJhXeGxy28v00jYCjPuIN0vhbzlJbLxDfYRskOuIxU88LWbGd9CDse0ZQvNW0i4cZbhL4Xsr/rCYeQfVMjc9eC//h5hsF7FPtKp589/lnC2jnpSYUfAz6sORY5elmg9QgB7yin6ItOCkVTBLZ3KPicOzu9oVLks5oTb1h2ndyNn3ltThPUo3RQpqOlq70HVpeB5cnn1Vdlty7/DJ8EtQSpVl1Zh26xTSsK1BLabs/sEVKRT7D1qyFtUT7aZDD1e63giFJIZzOiO6i3gaeTlLUyUmj5XlwfI0sTlTVIn0v4af1d/rgIUWqHYw/LMxYAF/x1M8LIRwtFjpWDYH4QuB2Keu0vMcTiErL+OGfM06izLntIzdoNM96TEj1dpLOHBxAh6cGNj6K22AzXfaToDcSpdO/yVzQPuzIWwr/joiEakUHCAKF+wQbI5vtO2suZTadSlo4T5M5clrIDkRTht5d2p4DNBaSG18N0T0yoic5RqQyUbOdSkepyWbWJuiluOXi5/X0gRG1DUBtNkWR
+    password: AgCHwt3pHs+dvK/Dg3/PlRvDnC+LjOg42GXKVl61+wXcJdeIc2dtAHLnu1/OOyOOuIYFvovgS02GVH2RmWQ5kkfZ/lD7XRTJxmYBsBiiYqU5rMENy+EJ4bBLcDw7AoPZBowR3y+nl49qHSuCqPWvLwpQ4hh9OXtB0XpEOD8Vqdpr7t3reEMA0T3xd8TrdriNo2sHro5v8o8qMJvZ/6QGmqZWr0yOPMuNSfm4cTaJLCL/MsYQRsUuJ4+1+LLoldrNjSalYqhamQvA6UsVOnuH0Ajp8rj7lnbyf/PbUx+cvqT+4IkDxDnDffdN66Q5s+oND+fMEM64QhFBP7KPrw1rWQMTC+awe5mjf37h0J1JFtnty4p4gJ6eXjc2wQVleuxDzZP9m26bp0Lf00cMTxxWDSHeZsKg4aQ0aqsSKYyXg2i2Nu/UEX/NBrNGTCFNk8+QIGowYr8KJkgC/WmaUNBLxpiNW6YIPwYPqUQw1Kg8EIUOTFeCOMolnafeGC4DmHHEQzN/jbIdlCaIyBBC4sd48v/e3Cx6+Idz+8al27OnHzHCzD+2NGf+n10i8wJq6+YvOjgHuqWLjQ8G1pATTmdEZ2N++1q9EkY6GCvMn/iUfKZGrmW9ozeXrOr6ZMNKOyiv6wgNUpVf7Y0DERVRcwjdvJKu8UNtSJXD3MVj8Q0G/SyE2wVDf6PYiQHEirlUxCJQpZPAJAqnuqcNQ0QJG3caJZ3nCUNDT8Qp3PqjB5AjKlGYIblwYZuHj2xnDoDWwORVA3jHm25Niv9KTB/Qow/oz7i8
   template:
     metadata:
       name: grafana-db

add-ons/kube-prometheus-stack/grafana-oidc-sealedsecret.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: monitoring
 spec:
   encryptedData:
-    client-secret: AgDYt08vksKi/llySruExrqYKajxYNy6qlSze2pUy88XZOftNv/HEQrsoe5pcDK1fTBDgrPQhQgbX3mjD7I9psSVFrA6/tw19MQZK9QjyClz/92rGOf/iW7sqKJJ/rUYydPyPva48DwTvg/peGmUDleodE1bfogKrHfz36fJdop37KeTi8k0UZoyNQK0o/FayliyJzp9oX6rlJoa26szmQ0JP9/akBd2JTAruNw1JbOdmFx8GpIGU3Bl8uvbcDQwZ4LuGxn1hOiPutXuA5NTS8xrC7GnLBPMtAvg8etZr5JL6ZLh/cGPGyN7tWpjqrJ4Y9hyR+ryapZh4I6/uRrRG8BpqXILUri0T2CB7/VSFrRka2b3CWtrlUiaCYDK4d5UF1I3K9x7WnK9rWNDMx9hxOQ+4hL6wFhX9k3nfDH9yJ7C8+4u4jTJVOfE01HbR5d2ZBfvP8sEO8sAePgD84ViRVcAAZ2LmW9aPrMdNhlQXf1ODDOnj4FaXP+yZIEq+fqsiyQtLDNBsIwDDJgCv4l7ac6NQKbpN2rfEfs4UFk5g8Jj3TfvpXieFe4+VuUyAwy/7npvxuAn50xrcjAo/m6cyEgJ76oyK2tdHM44m5CX+MwMhNIVU1Mmuq4oZ98pRXx0f1xptcwcXiFV2Eor5lKmNx4mDaYDDgbFrPGJ8w9k6gnDsYUnxP5LfAhpcwFxQcSyhj2XdbSnP+mZio59W0+adGQoksNuZjF72COME7ijNREsAmUJ6d9EKffQsH8zf3rHb03vzNWVzofgOKDTHyfNy6bdiZgezxGjNdcgFixdU1Fqjw==
+    client-secret: AgB2ONbIJxJkVYHuH8kTXuMX5UEFOrOw+UMASkYVQeDT9RBlswBTjtAOuQoZ/++H735rWvV2SD/Hq6PI0rX42lIbasElI83Hnc3PtwvUXajHpvvvB+mM9DH6iPwKzP7M+xgCFXib/4xgWCGa+OnmwfcmYKvWfvBClWQ7t3F0z3jQZNQOytFlXlD8hSCK8w38NwNc4E7JT1YVoH5oUPQq1PE7blsNtM9xqfPqQ+vPfRYjp/j3xXxQhqUHEN7oVZyWDH3UKnhbP+Vd4DzyPvdGZbNbFkzrEqB7ogJOzZAgcsDVs/3NyfDChlCE8MLQ7EnEE7puOdMt8gZhel8kVwBwyARZxy9Y+gvXe//qTyIPcvUdROzycI0QLj5Y8R/QH+AywX70Y7oyezaqcpaS7mRjl8duG8Jg52xFL8z2AjwMZo01vh2GkhxhuQ0ys+jJarQYRUk+cE28ZEZTT22KWmmCo/X1zarymgXO/hzUZwZTDy+GaTh30nCyXOwVipKirQhZCPEVVrT0GOyNz8iMgvbcQgOIFsgSF50vwo5yq2zTTPTtcNJUnfDkN/se/HNpyoEKXaNu2dsio3t7KE8VTaa6rBqw7GvZ81k+nR9stQh4a0U5uxC5Req/CHKvVxtFJXn3TZhlzpYN11zvWjpRMF505jOQVbqYa7xyLio17XF3tYuGUVUJK3AQklL7sO+9ilZhJG5GiqhERxexwEjgKO2j3GFkIPjjnk0BxXLrZtiNDCbW9UvtCBto0Q1qdOoyQTg0Dm0s/B4SmEaRl+9Bfd2943aSxnD799TePoIvgWjXeH9NBA==
   template:
     metadata:
       name: grafana-oidc

add-ons/loki/s3-sealedsecret.yaml

@@ -6,8 +6,8 @@ metadata:
   namespace: monitoring
 spec:
   encryptedData:
-    LOKI_S3_ACCESS_KEY_ID: AgCy95N0v+X9sAZ6eLZ1dT4x/TZbZdJdKDBdoB1EB0XD69KtjRnTIp6fnK7fWhJK8LBQMinvses1ZT8zxjXoYtP+eP/UMF3A5BPKp3GtwWqgGLWWcDEdRIPryf4isovw/5JRV7EoaS2GOqmXrGmzqW3S5B0CkGBBfp4vE22ClkONw0lh8RQorAHnHAQ5oBjdnUwcudKkqzCUpymZsLEU19TFx1xuHrI1b9pPBDUZKJc5sRQeJpMh0TOmP6G21SHvoVpfGb91nX7rFqt5uCxwXp00rWTJQDLmrBHITTzw/regKbtDz/hnow/Rmw9VvrKeh0olIxUjDwPfRFLalu2OKmV1oa60ta99Q5OExqQKKIWjOyOHovBAtpTP6q6z0/mMg/O0qoj+PyW6OJ8Ojkf7zYJAEyDil66ijALwXQd6bARjnePcrrmNCFcHVDIKRgraO4ZJDkPdfekKdCY9nepxGGdYDbFcl+CgieiKp5C+DQ2MAurAiWVIy07gfc0EwTneTIZa6gJsL1extnD1QMxF+Q51q6v4raTyvydMg7q2fcJNWs9E8c3buVJ+xbyuTGdotqaEgKgL9h7AGPznuXLBEv3jsZ0DZzooaXQr9e2eSOaj1Wdj9fBTkTDwtcCQOkWVTzQv0jdRzHkyadKaCkSLEy+wFvyoCmm90I1v41kUNAKb+OfErQF2oneR/kFvCRR63fHkrqeLlpfYX0yu6yWOKhDHN7WsQ6wd2s76PA==
+    LOKI_S3_ACCESS_KEY_ID: AgDIqzolb+yePeOimTq+WJwLyTsPnCJcivE3UmRURoRHklxpNUyJl6Webd0vEhIsa5rLlb/4UQkz+Lv5MCoqFJJ42z1mZWh3okHFRkf3S8cZlOo11KUlitUbz2YsVuWXEascbb0ScyM0iXvp2BeZSOB2cXX8FnOXs7uw1Zy9lKAEsKaT02p0IceXItCzYmQtNFt94Rzeq0Qej3rXHnXP33XgEsq40JvhAmENAEcfUwWKWksDraGNgBVDHntTRIYUbE4UuSF2ON12baNye7IQyPQJ08FtCYEokLLbcgCe58oUjyecEa2Gx9sGqEyRuumru7bpeQ0N4Uu6O0udhlY3Xpk+Oeo5pt0fJc0b82wG0obVo+/htbVvGvx40vAyjRIVsjJJB03/aMvM0qUystor92PnSn7jxZoe7XS8VS/bq9dqvWDe3CohoxBHU1oib7DB4uKGstUHIqgNQJHZYCtmnNYWEQLfZZlam5qks53nMmlB/BIR3Mzeiui59kjv5peP1JEHEduxOIjRKEP2FPNCds92fNTaIfvbrbrfxWUgeMJNMwauG7krTTgMEosMAM2fQzbQSgzcQS3tGzBDXZBTUSqcadrL4onvlthmh9XrHEsu7m3Ig62BJi2dIWcuHB4345hcaR/B2wtpJJIg+Sy9J8Gu/RfbeiKY80lQFDM4IVX2OExmcp3OTIoDmygyTIj91ydz9HPT8Ly+Jz2oYsmojhWxBeySp6Lm3mH+Ng==
-    LOKI_S3_SECRET_ACCESS_KEY: AgCR6N449J9uv9ZIb1CCZzlEMIgmnnWWGiYqDj5awSzun/j7nnU5CiqY0Q7YNUztKI2y/0TQAHdrS9Q46d3c27ZIiCwDJGK69w6Bcc8XPotzFZl7htRvc792CZtx9OShqLYrltoGvmNCLB1AY5wnxTJPQJ7p8Xat9GJA7CgRHerwhfhtuT3vKGRVOkjpQ5tRDaIYGQO8o7Tj2eaIn/dBwMgCVlfd2x2XLS7RzV8F+DTQ+94jpS7h+zJGsnEqH4nEO40OaD87ZTn8CnHlw9H9TL9shu8dNVULYK3j5Z9vHHPjBQ5oiTBdwtayJ0lBDOjimlMMYXiJhczsoR8PwYG7TNL/OZZIF8uMvuZX7lFLa/15W99XhLZSKoTbtYNT2HAzWNLM29unor3eDBebwZGyVu8VzQVECtU1/6EGnY0enMpldxUhJnVq3YmifZ74lktIcLy9g96lIYvJs10OrMZqMf7ANr74T6tLj+kDvlTS7AZF+27m5bK7Da3Uj15qvLsxox5XYsTfZa82Kz9XM67/Dif5PdGz3LCkVJHKBpSbAwoy54NqaIIlRrl08J947o7AR7M6T+L+kbU8JTREH0bbnAIgFvkBZow0LvL0rNB6I0A5aSO9jrMnb04I876Tf2JyRX0pLhtovo+253I3kQf8X9S49suYcJeTdATKtIMC2sE5wb23AdFeHLZz603HobieozAm7X5sDCaXQSROHUMPF2+f2sRifTxcryPP9YhpBZvm7zuqFDSjfQI3dtLrl8I7/Ohbn3J6whP6rgSqKBQaLS+s
+    LOKI_S3_SECRET_ACCESS_KEY: AgDE/X9NIn7vSjjQQjStswNmTw1Xg/40GlyCUTYWMtL3AizRG8h4BI/NftlM3AfmBeoE0guSOB7S9NG318Wa3wzT9/NB3qW/oHB/Mck+jx+mTvso1jsgTilcKgF1L9HoORG+uvlKp35WX1+8PupdBX9GJ6fvOSimzmBDbukhgjBbf3XMj1obrT89nKHUP5PJYNj/6RSeE7X9jjl6Q2IVH9J5WOt044kSDPliyP9iw09E/70RWxE/KJ4fBZEO/oe1diy3if580rdAG/po3txgs7x0NwC9cHR8V6KehdoJRjzq0a1mgabrn6bbVtfWHzIiKIX47eyjmyPqYMrBG3mXu1SnvbLlyVjG2u67eK+zO07ii5BMF8CzLtuGcMiqusY4HKWVQMYRQRk+A/pTEWWTyAcuwhBfhdF6bVttIQiTia4Uo6qJ2ddwqm5k0Gk46KzfMYcQFn0SAJYfO3s41F0PxfdQ4qEQN+1gb7yw4wZXPCwUYkX+Isc25lslf62R8Aj9NV/rxvFMAFoDNwhLjQZlU2KW1CxfkNpYDaxcLdcXccidHvGrqohPnfDqEEhDDlZIn0xTmM8DcszO3/Pwqz63gX7fBA7zBoRH4ecK3rAFlbeg2vxj+zgtqA/rQ2RUbpmYpI4UiF7xvwKJ7LY5EljPjOiUW7QZ9C158v1jD5sSoWY7AUkfZNX6XUwXq9Cqr7ovA2cxlP7cfZwNb/t3j99KhIEiZVup7PlL8kMJ9tJNqf7iQdM1poq+DpWP+kBjGmwAWk91DMJ8JvSBWePmOf0rJBti
   template:
     metadata:
       name: loki-s3

add-ons/postgres/authentik-db-sealedsecret.yaml

@@ -6,8 +6,8 @@ metadata:
   namespace: postgres
 spec:
   encryptedData:
-    password: AgDLpRHzrgu7ZjiHPa6Ryk1SJ7/hWlN50lKj6vwUP8IXWhsqKD75eniNRVEkogcsL4bxoL+xD5PK+A9p3MQe7gLlBlH0EJd0f5J3tSN+scxFpYxwjR8Dma1+sIlC2l87rD276Vr9rqXNe9x83ooJ6nHSDPGMidEryUzNUNzcObjG53BgQRW39ZzjHIlju3wt6iRcAxalfRC3v2mTPJyYaiz+He9ipO6LCJ/sv/po4QloASghBUK4zUGHyn8UCQzDuhQ3nnYZCyFG4T4ey8XWL53pFopTzWpRn+4g0yQXI+qvb28kfy4L8QvNgRhIzoWYMLQVswVVvzRE2y3nrkWRhG3Z4FgJSfGuOOR6obXboWNA008d4Q0In58O7lTxh+cwDNzGRY9WrWmFhx9ib1b2O729I+Vu1aTUa7IkaYg5BpMLuUjEiY6DfVZW+OvvQYPd6+a3mhitjk+NwVGZBdR20lW3bz35SY63yLfDrA1bBex2iq4jLGXEBlJz+loAU+yko1zua2RYC/tgfJpyU9NrSy+9ti59I8e0+I4o9YkJ2VmVtcoFd6L0ZOmdayw4r6hDtB+EHW6Wz0vnIrwx3fxMjSaXEvtNjZOVeKVvm9Cv2qJqTJGcRfiUeSbqEXtti1tlwupTe3bBXfotV1MqjmsAUJehhdfwYscvdmo60XMKJheyoAfB3LQw+uAg6CLtmfe78W9IUK23ofFfgtiQwp2/3gXmmp4XPAEctwXe//SaZWbVTdl5bKEiNvrrqGEI0zdcWfU=
+    password: AgALpscM7BiDoZuUSlAI39CZYz3DvSaHQwzOpZEKp4tqfEYQ1r2DALOAbi4l3+6LzsMo63RNv3SYlhxFcbjjrDMiiaaB47iKDEmbSW/LQTJibiaoy67rgTs8T3I4awQbHeylwJQr5nS0BN6MeYh87PCmqFc3Orc5kCokSL9j7gVwOqNkq27RMJkghulUxAEONQrixFOiCHTFWCD/IybR1olUUacz7nKxCTLmcqDfzimGlF92VBbFaUzZH5W+0yd59zNqjhnmslIRiqli/ZVB2Z5ECuqr4YmrSmaCQvR5mzRmNjpmAeqCF/byFjfanPM6ZZ4NM2x7flqu8sULzZfBdXWmhIy03jPFFDBIvznHHW6y0K2r8kqewkoUsKgJEgZcsEvwe/F/gode3ukI02LuD2dKMNjeDaf8A4xaRx6h9U9cDiggmpHPW2HjO3kLp6ViEGPlGm3JuisnqncsBgfIh1T8ZMpmuM0WgAe6E3hFHnR6vbWYfSIi6nrEcpfLL+F2bBGYdUFBfjflaxXzhPnGDJ29GEBuyJcHPVRTqBhybS9rl+77dhCbPEsC5GN9MdCdS3uVWyKN+xIV1f/cJNsUFhDyU2rbkbFAebJurjPbKi92HPDaEq6OK3kunN9nNEZ9rE7d6ouw/gQ5Uq3CmaNDiVDorFfaW5DHVbRnm3MLdbLoUuN1AlU96/cDuSqDZjfLB69iB/+nt8TQLHopwQxj9AajfMyF+y9c2XvYZWvZGaCE1fTEfpIJ2fV1McnwbFi0uHk=
-    username: AgDRt25giEz0pQQNgaKjvHh7pM5PKgp+LasT7uBRtkjdzvPVgjnmYjo5EIGMv16VGk1AzxoHk/gI+ERlVGACzrOoi7n5LoTwqmnbcw/AcsBB2TM18KdFKzMjJFZ7S65+lC2y1jt2fOaiTdlQ/OzU251x9NSiHPnLBw3K14M8kD6Yyq93kN2q78o9gD06KjXWGmbnADH1H9gJSCwSJmLMS9WWri0Mr86l/JgMwVCdEoDKOFwlqQWWr8SAm1P/5q61TyIOPjjUe1AMFMSZTFezFuchf6NBieztHN/JW5nmPWSc43aH5u1zjjaTJu2qk3ipSN5BBCkoKZ9boW/wqy4AriRJfitq8LxIObAFgkJMHG5RTjtxU8j2z8oKHll9UxO0yRSIkdhBI3h6iJAqDmi75bH+RIfdx1kiT3g+nkXsmR5/ptBORyNejppeSYsh/jptdJNtzjmBlGlORtLX9Ah8I3Hj/gr6x++GjwphYZLlwjVa1S7vSnWwpdGKP/0RwBNMFeqf8PerN/tp519b96toja9QyA0y0lJzh9XmMcfOUKYamg2i31tn+4ab1GOGlMGeck/MQ+3G4skJmEiCMvxQjGSOuNjL9W1DnSvjPsK8pNnJ5ndUCQatu1a04psQ0dJK/jVluwuIm34u3lOmisWEoTzb9Y2PYUavIpkPt5be0qmCh9+r5xdL+gBLccGdVdrB4zQ7caW26Lp76WE=
+    username: AgA9pxBlPvKPAX/NaHHFSN1ypRxKmd8CNcs92+l3JpDar81IYWaQPG0p99wYxrBp0414GIhojpkWks7+lVDSgmVzw9T+JQzow54lRxe7dHFOzfAQx1oQyGp8AkiGtjAIdUx9kgYhM01xQUDYtFDe3XnhVUkvjQNARctWyX+o/vyYTnK5BMHZB6viQOWrifNUmPQQRFnB9oEPGVqysYlJ2+o1sMyJYXOiTEMVkuk0rFp8AE2WGeyfR0pFwhSyn2g7bbFvUoQbECiG4y83AKmpmX4p25bAlzsIxb1kgUpYlqZXGMqLuQaVBJsBs3u7sDUjQZFRfz3rH2OLfNGZcCGT3c9Ueg05eRpAyWHP1kHWmkK2Yl4kPcyx54bBk2yv2h4lW7DmlsG6jE6bzKPtMTJOiJdkqkNSkerd062ktWYrpAg6iuGWB1A7Et+J07JaWd6xfANRknvH/D+CEQHuRM5qEtM8HVLuTlKSxX464d0nNKUw0rrSokWJWT5olroc+VjaHyXdF6LEYmgNXxtUwa95q6k8J78ZLidx7SawbFC5d5ErFbkq+6xOPWeKzcDExtcMd9UF1Ti90Ybp5ncyxoQLXCWhSV9SxjeS+f6H8Cs7JM39kxeOfLvvxw9qz2rSW6qbimh5KaXmO8KK3BFtrui+k5tlnv6qJaRbtMUV+p7WyK36wBk1fUMR0lfK8FRuWfnUuslP2wk17vlkvto=
   template:
     metadata:
       labels:

add-ons/postgres/cluster.yaml

@@ -19,28 +19,13 @@ spec:
         name: grafana
         passwordSecret:
           name: grafana-db
-      - ensure: present
-        inRoles:
-          - pg_read_all_data
-        login: true
-        name: pgweb
-        passwordSecret:
-          name: pgweb-db
-      - ensure: present
-        login: true
-        name: redoost
-        passwordSecret:
-          name: redoost-db
   postgresql:
-    # Each app role may only connect to its own database; pgweb to all but authentik.
+    # Each app role may only connect to the database of the same name.
     pg_hba:
       - host sameuser all all scram-sha-256
-      - host authentik pgweb all reject
-      - host all pgweb all scram-sha-256
       - host all all all reject
   resources:
     limits:
-      cpu: 1000m
       memory: 1Gi
     requests:
       cpu: 100m

add-ons/postgres/grafana-db-sealedsecret.yaml

@@ -6,8 +6,8 @@ metadata:
   namespace: postgres
 spec:
   encryptedData:
-    password: AgCS2VPTseFFkdtaDAjYv6+9M+s6ndiezfWjV+OyPTPurfHJxLFkUlPC8gnZkut9gRhz1jsakP91an0aFEZTWHlM/amvSkomUWbwxKw6l9Co1U0IjK6PUPWKkQtLA++vFaL40u8yHFMbMLkND3oLPqNadcCGl+cmLgmSq5VgEayaClx4MPlhSBFYBvpJJ3B/CkK2odnXYO1aSeBIKPQFIlbiooSWjBA0CzJ9gQQFSnEVkDqHfkd3nEVHaziCdhpOCDyH6twQlafMqUjIbVKPJ2yd2dZSJZRLh6t6FY5EHhTh6PIbniRJ3ZtX2uTaZJ/tJF2af3QfRMUJ6go4r+16IKM/Q1ZrOcJfa7Zz+9RoC4d9dkl30hysr88WX2+GHx1E+beEd0v0Kv5IR8CZlbRyQV+DYDgwjFD9ALE37EMhpkCyb1qi1ulhl+8LIXLB08nedbIqqvPrmjUd3+y1EpuATeCgIsaVeACxBN2iUJ+JjVOFE/umnSgEGVctSIQSl4kZz/SFpS1Ygy0yrVOSmt9rtvPaWSWlg8yN4TTli1OKCJreyLDVSXV+/Pf+3UoN8p/SR7r1cC3jb4KBy61O/7jovMgO3XuhYHtUyJdrgp0h3DS116yBtFVomGKhCRMriLXb7VG9zD/spgYpmikPMrMABm9OPaLOBiKMEz+VN8Nd7cXZ1/us6kV77lSUInZV4osall09avYn8NaTN93hIS6J/Xb81b7yuH6Au6p13Zf6dkefEF6vu/g3m0eP3ZlgIkroF1rNe6IrkzxA0U9dDvrr3ayB
+    password: AgCVRR7/XrxDHRCzJwfWhC8sPCXuWSMiAQt82cHikAjyDWbTllBVVcZTA5M4U/I1Lz5SVm7rrBNjZuRGYk0q0UXKEJ35HjLAPkAYJ/1/uVy9EdwuzofS0UtzxkcCHwdkgfwHXKRFjCBKP+JoK3bsC2QVJwon9y1FdALv/2lsf+Eed2ncirk3RCyop7R4by9cYvzNt9BU5RYTSO+PtHRF1s2LkmCV+68FQHiVXu7tTw2DfDaTHlflWWIWYNx466+0qZIA0VxZO4wBtzN2q4BxWb/e5pL1Vr3F7HqkAVTAauUoLadc9x8fye2HYfI5MHJSsMhk6OrheqmUaiYZGvWaWHcBTa7HimEAp69sMPv7FSKUME1/g6vh5rQVbX5osmWwKQr68/8Q9CY7uFQfnT7G+C6k0h2dSkbiaczDlOGn2qzrLD1UsKjtaVHxZKzb6FWrbbaCJxiZLm/2Jn0JXZKFpjdk1CYy4xB6ZTNWyqrPkaLqPpMoQV5Zgw44vnhudsTlNWDPYNMdSVJXXsFplxnaxhbzbBjy7JZmO/B3snaxqlZCk57yXW88ZSaNbrRQs1hS+MTNbviy4a6fjcrE5UIBfSFtOle5hPVeLsCOV7h5cdXsZDBYveha2eHC1fnCgK0A7GS65XByJ/wW1J1XDcSz5AIULjLWcLa37W2ftMgYiyOeZsP1vEto3ceKia+vMdY9uyJVmAwN7EiVVGzF0CGbrlTbNRAoMWH/tpKewdkSKLyGHcOp5hWFE+5YxRdSY3maxg+ZskYhJcrWwKK8XIdim+SM
-    username: AgB1nXmxGuR6ObktViN4tvpH9W5B2HdzDVAwd4dtv0nBSGkS4NXA5B65BzF8NpWRVcnbS5hr6H0KfnAWHguDGL3/pEU6fdam3At8F+2i0oXSH9Pt+C2SxEcH2ecRHK+7VqNgJhd8j9i89G8DQGAgFjWj9UpfOCwr65G7UrHkomdBgitSFQD0dXMPJ973ZSlRZOxECT8NKjmgMX/iHztBszIms/ACB6u4Yfg64nAZUta1/Ky95ZSb5ZgrqABE+GLgRIKngAhr4OlpiVZelsTz0ccjCU4bT6a4ZqiqkbDLS19nO2rOSMDsnxgqoVBRF1Bz4Ry4R3e3jpQx4xBQrV4x+FFCymEi1rpZ8KQCrRf88YD+A+jRsBGnsB79wcaq996zw2tQ3kZd743C7AM9ZzXiNuGVGlhXqld6IbvHzyh1F9X02+diPVFftAO9owPEiTBcZVscj6RREmkOGcYHLtjhCghzHR0iQZ1DvazqyPSyUuvKyyXcX5m1b0DzgONqEgdmHD+saZZbAacQakUdoOS1hGLGgExaXS1pLV20eSIpoAJls9WbRXCeAIfWbN2MV2y1BUUDvmIAkdkocQbthovl2NeOy1FYVZZSmS6jY4zv59PDXFx2HMcNsj8qzZu4gDlEfngY5L+L6Lqr0XQKN250gYEkuduYaPoftCiaThMKCc9eJkAlQ9GdvrQrW49wBcXnErvFVmfuNcWr
+    username: AgC75g98/7Jys5LOEM2ik0fY+mGxfVisA59k/cJPBdARI1uGApIZ27/BE668Ga0WsDl8aSbybGAZIdEFlPYFs3fGBaJIO3I9ZyOEBH1+KQVto4BkZ+SwqfrUBOw37QFQIbO/Fx3ScONYz9iC5koK857I+G8+ZptRg7ZMRWwFSCynaPu4ju5+3lpPDoaeykvp+wKFt2cPY0r1xcOWGBXbQhTPoCj6UQW1LSClws2pV8I4GIgTW2IvEdx+CT42cTWqZXQO7aCQUxxpgHUXVsB+t6mldQYwn4tEAuPU3IzvCjf7xqGi5XgRGlxfJayUdAOglzSNmaK++YW48YzvWLDSk4/G0oDQzdiHqWldKD4Z3gVnKdhqK07duK7+I2CzusixzoYkjZWATtIC4VWeQKDKNXKwQ513QrHFhjQDYzGQsEdpR5A38Y+S5yNduY+TkivNvx5O24/J/OIR9U1MOqTKsAURl6rAbWGndBlYi2X8/jtFMADo7PO2xZdDSaPlRpM3PvDcD3Iz+7d3LDZUg/L45HJMlp5WmP84ciKL/YfnQgbQWYT4qg+JpvEv5TlDB9aPPt3JDKWJhe6LK1zM59tRsg3YCZNoLp6DdqNnw6TG74ZhaPES/HVLOxt7Efer4vUMPjIOVXZoGmtGlrC5BLN4M7q2ktmj2xUGct68t6NVfPxnhFnHV56QpghLoMZOULLBKaXc+FGHKKst
   template:
     metadata:
       labels:

add-ons/postgres/kustomization.yaml

@@ -6,7 +6,3 @@ resources:
   - authentik-database.yaml
   - grafana-db-sealedsecret.yaml
   - grafana-database.yaml
-  - pgweb-db-sealedsecret.yaml
-  - redoost-db-sealedsecret.yaml
-  - redoost-database.yaml
-  - networkpolicy.yaml

add-ons/postgres/networkpolicy.yaml

@@ -1,72 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: postgres
-  namespace: postgres
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: cnpg-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: cloudnative-pg
-      ports:
-        - port: 8000
-          protocol: TCP
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: authentik
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: authentik
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: monitoring
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: grafana
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: pgweb
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: pgweb
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-      ports:
-        - port: 5432
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      cnpg.io/cluster: postgres
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/postgres/pgweb-db-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: pgweb-db
-  namespace: postgres
-spec:
-  encryptedData:
-    password: AgCCnUlPp1buEwCQDC/q1Fy8JHfi5QzuUCMoIXJoi5xgJewkI7ti0JctSrJJvdvS0QUm7se5s85tewKjsA1tIGrC8/nsSSeGbNmqRXS5BbGVdr6SIQhExTmVNdQqQwoyYtV8/ebW4ntt+HrIdgO16o6nsDb5lXblYguZps535SqwSN6vRLHhD3+Wg8SBjHZV11i/9w1nufy4KhgW5jlBhosKOaGVpgH33OQdsDMvkSF5FcljgeUm7R+R5sBYXh5VfPpEjsBB0zi8nDzSNS8aDVrQuv3aFeNnJ4vgBRV8a8/VclaMO9RqXgnl+HjHczbEau+x8AHZ19lLVXJ3rxi4itgOGXevVGEdHi+i+WJX3yfakGrleBneqkbY4VUuuu8T0l1wveLxRGBNwR39xl+wSZU8skDWoDh0Qdgcxpiez9Ewit3s9WE7SALtdUhVdwBdzZVctqZMVUeUDDBGYk5cyTZmRAMR0oBYAHSFD+C7+oyVjJsnZOp4sn/1q8vOOZzLeMu640tyopCChL1eIqbUxz+c0WsVXOQkIZFO2XErkLi0mpf9/rksRc8jWPZL3xTqcgQmGPujpm116K6nclf6urgghj+UW2KWilZRD2M1qXFEi4UdyDFPMs9bOMqymuk0zr8bM2+xJUvaC5AAByjFOEvwoqrXMp/55+4OhcEXkce482Ohl22EF9UznwegpxgcSvDVsdvA63nqkA6/ScYVf6vOJMV1IV3V/xrCmCfvrgzw7oOdfLMFF3DFlK7b2bcwdm7tJGnjIVxRKEk/Oac0hcmb
-    username: AgCrlxpjKHYriSWpb27Yy244lRX8YJFTWFxfT6Zpf/FG3nJ0BmcFRCzADbE9+E82Uugbsomv7Bx+GG3PbdzZGZJkxnGptLLIMIXbFlRr0W7cKFCWasmti8CW3KmVSp6YSZ/QR17GPmEkehFnmooK5DGhxZJcrK2+yFhN16JtCh/XGuXHVwVGMZMcVm8mKWcPKgH1yCfxQfFCk/xD8+3FySTKz1B/eyaUhaWncL8iCaMQgTd4G9YUomL0ykqwu6RzO/UkC7taq0dnvSg/XC6NDfZJ3juqdAw86RagJH3H41T41WM42ItXHCVy8XEAkJALZO8+caJC1Aa8kqvtPQh+5ParKpQK2CGGoIpcy8gicfWsGC2Ohtmoma0J37Ha/ur4BUuEbesnrvkYGDyf+j6rwJ1tA1Ff5w1POeySqRbpK8M7pEwLNTA3dNzhqBfY8sLdIwDx6W5ElBDz/481IzC1vKgNCaINjvCIvT4ZMHMVEwaAHxTyjv/On0Gi/U2m38Qnu+IxZXC/Zi1LPvFCCE3ieVHOKA4gyxooKIriORzxzxZbD7hvg+o4Dhkd6hxWRYfpIMZBQi6Ov7jHzY2VJroJ80wzsLXFLNwP4pEpSjcQsmus/ErLJGwHUeWYASo5cVmBdrbtQEDWGSFm2pi1FSCLnC/7/eWsPJqqS0tHCT35+Iabgk0EbXEPHgE3ShR7b3j/+qwhACLktg==
-  template:
-    metadata:
-      labels:
-        cnpg.io/reload: "true"
-      name: pgweb-db
-      namespace: postgres
-    type: kubernetes.io/basic-auth

add-ons/postgres/redoost-database.yaml

@@ -1,11 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: redoost
-  namespace: postgres
-spec:
-  cluster:
-    name: postgres
-  databaseReclaimPolicy: retain
-  name: redoost
-  owner: redoost

add-ons/postgres/redoost-db-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: redoost-db
-  namespace: postgres
-spec:
-  encryptedData:
-    password: AgABXpIKEczwyJR1ZLvcmtcQluGi0ACDO3SCC+D2OfaSxpUF0ZtmE0b5ngq2HmYj7GPMZ3vAEaJ42oXDgEiS8Teq9ACxmCIo7XMeA5X2w6w7RCmhgQdx7N3G+nL0fO5l49URckk8xDZVFCSo4wjbtmjQrdes5CbMlImtG11byFAyjs5lBAN9niJZ2tnJqJhpEvI9/6St0AlVjhsRhwvaV0zlVBtKFcBvSKemcBHkTA2gPBeJ3xmizuc4NsJHhCriiOAhJ+IA19eBzvN/bmfSxdJb2F1LdSQxlLDstnuO/dJDKkvIul6TrWwtqRbCI5tM3K0lHbGeeDmIRVPmsK99Kw3FAoSSKIZ0u3FTXqMF5mi9+abJAxHgD/JYn0Ecx/09Hp4lUwEWK3RIqmbfq6ose3YcSRULJeksSIQtGsOmkE0LxZkQV1F15lOAWL9QhYTDXZbD2JTnkc06SLSk2THpl9o0+F4ZNI+TpLHGASIH8nu95qVh3u7odwjaqe5Czh/njIGw7zuh718hLQtXi7P4soAj46Db2Gw9ZjSw412LGfU3ETDjeIeA4wQXhp78HtEn/vsDRMgx9EQH/726Y3BehdEzpx3g95zBvyT2T04UPc+J+K0zwp3c4rLmkyqxlXOq8NW2p1huQsdk8QTMojCep73k8VSzKpq9i2I9ktWTPJbiXP1KpLA8q0J6awgFD3c1IjYoeeOptfz0kR5oTQa8syTdlj4QVYrxopWqGhK7Cn2G4zwc1Gv1F2sO+KL7/KUe+Z/vp4kICKdL6JfQbUJf4WAU
-    username: AgB7DGwIppwLvtb61d9cn/FnzC9bwAdhvk0XR2BTiO4EaA9py79Y55Y0pmSmdi167MCfsQNBZEYHV/pD1RncdzHbMV+rKs1Y9Q8ghFUcuTaXC03tkYfZX/JnwdKAaqhyMqGkycyFWsVip7i2uoodJ2M0QhuD3L6dgXeq6rFQhrc5GjL/7bWiKcYY6X82qbYToJCHAHzmZ6lXcRwGqtV9TcC72CtHgP6vsBTaTZLadptxh9xI89SiLej/9m2D1lhSshJ6K90BTeaLVqeR19hP/VCOltnQfeV2GfJgBAfstTEnTHpqtGuPct+zo/IvbFnnjLmcNgVwzCerk6O25mgIuOQxkQp/gnoswnzMojPzwWnKsl5mrlrjkYRuGrFZjykB6th/xat/VarHyMJUpKlmNcealkWvy9TfHzCyQtCHW/fwHiWJ6W2/Cvf6ABBDl5kn0oj41l1Ekm8zxR7GCoucd/iAvizWJ8V9d4g/P28gBl7UI+WDFRkKcYATKZ2s6P60ORXj+aeYnoV0s64if+Er/fdbYXdSo7YiZVOtKy3nGIRsq9pl17QM1GXNmKNcpSE3SwKudEwIKcLSKZ8oCAn0gm2KwGGbJ6sRWu2+zysxgcoDnmpZje4SoO+xXLKDJ9NMCI1RBmDByk8IoNxn6efQXZesn1TQd0QqdjRF4+yXxPgpfzjK5TBEFx8ya8LMZWlhU2dxIQpJusV1
-  template:
-    metadata:
-      labels:
-        cnpg.io/reload: "true"
-      name: redoost-db
-      namespace: postgres
-    type: kubernetes.io/basic-auth

add-ons/traefik/kustomization.yaml

@@ -3,5 +3,3 @@ kind: Kustomization
 resources:
   - wildcard-whyredfire-dev.yaml
   - wildcard-whyredfire-dpdns-org.yaml
-  - wildcard-pixelos-net.yaml
-  - networkpolicy.yaml

add-ons/traefik/networkpolicy.yaml

@@ -1,39 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: traefik
-  namespace: traefik
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - namespaceSelector: {}
-  ingress:
-    - from:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-      ports:
-        - port: 8000
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: traefik
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/traefik/wildcard-pixelos-net.yaml

@@ -1,14 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-pixelos-net
-  namespace: traefik
-spec:
-  dnsNames:
-    - '*.pixelos.net'
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
-  privateKey:
-    rotationPolicy: Always
-  secretName: wildcard-pixelos-net

apps/bentopdf/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - deployment.yaml
   - service.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/bentopdf/networkpolicy.yaml

@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: bentopdf
-  namespace: bentopdf
-spec:
-  egress: []
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 8080
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: bentopdf
-  policyTypes:
-    - Ingress
-    - Egress

apps/garage-ui/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - sealed-secret.yaml
   - middleware.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/garage-ui/networkpolicy.yaml

@@ -1,40 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: garage-ui
-  namespace: garage
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 3903
-          protocol: TCP
-      to:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: garage
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 8080
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: garage-ui
-  policyTypes:
-    - Ingress
-    - Egress

apps/garage-ui/sealed-secret.yaml

@@ -5,9 +5,9 @@ metadata:
   namespace: garage
 spec:
   encryptedData:
-    admin-password: AgDIy9i34wa9hD57pft2B8SmSmCF5UyksaOD5NyUovQhLwJqv6QuZoXOQ8dS2aCMK9B2jFw2oaycJPgW02HEsUiuaorifAz/wmjrU8yXtGTcxpqxQfS0+EUhefHtcWBYVcTc23qMpllJZLEr7+aR+sCF6jAq1CHeuSCdAOTkhjBTbFmcodIZWCspxrqoxF4NLBGKSdKIuWLekH8w8oJ1ymf/VUj/LizJIKZn7QoRpS5KYVBM2hzlXipUr1FWSjmCmolTPv/ICW6CYHtlOnEvYUTOnEAdmAx5DD2HocKs+OjBUuFgnYwj2XIyLOoVI+nrACrQSvmzXOUrKNI5y54DU2PNgAa1zetWfHk/Xv468bLQc9bSBFhSSNTrl3mi8Aa381mKJ5aRXLGa89fCqGWAyrzKle0yc1msg90jriJMh5kN026KHXw/yeqcrTCD9MdTMr51UusfhzkE6LSnKmXX0XQNjP4OLOKu7kFXj8xRox0W0CNbXyg4keQcWnWKF1LUgG3X2+1CIZNFex7S7OE8KYtxP4O7aqy1kRZvgVsUONafaIPB+k+Gosnw7ImEQ4Zu8L1ATqpeEioHoxeac+RhavXjte7UqSjIV6moxWrwrK2EMZPHhm2Kh+h8S3ROA/78Y58hFkEYQFnJQwwwByGctS0zLIOCybVm/lz8puohlZAcfzf+J++0R6sxkWZtIa4YWG2g6RuTjUoqcgHPwrRYmbvB3WmYu9/w+717HZob13QP9C4mpT7Zhposw44JuJMN7MA=
+    admin-password: AgCQeGAvd1QdDC8IUwNYqHJxRES1jfPbonYTyutCklms6tjebQw1pRKnbDWGRaFmgWg5jFRPYf6TAMRnZnA/1dKJMOrV9vGjqx++r+khWbe5oqvcoQInqVdbkfulHoP/Bf6jc2mj9znGqpW6E7e6Z94pwwYkpaY2CIYhfcs7PiaTh7HiFMmoNWlGmHBh+lIZ//WJblgpFdQRWR9j7CiIJOLC3OmAvGV+Uh5i15fdA9aTBLZaB1pWh/kqug/mmj6q5E3Bp7BlC7Pm20Dbyn85kfA9RjAM/AkWSycGcBgk+FaJKFVJnPzrHcx6CdkbUnczxGVrbs+C89pzCk8ysaOVSNDErW0rCWNaHrflRx6P1+OUamCWWafZdkWTGQ4m0I5pX5IQ40zIK1uE8Zzil8EJPynfs37fNzn54wVBmsaKpsFC/3y+d8UTVgf1shJF0cqPimWjCZPqvUZrimL/20tPhTSERaxtWSq14l39bQUc4sNZdaKc69IkI04geI9OPvE+XXQNYe86XPYlNJ/R5curg1RvQxAR59sb04RmZAfdSvcwYxpK1Ekchq/e9IK4ft6Ul70nE/oN43NE2Ck1+5/EOjucFmIQzZ49Jq2OIjHuBjA/p/BmwAhiZVwPObRJ0VoL9XDv7BVB+S/+RWnFjDW7J5YhWquZ2Y6XwspHhpjvHmH+LLSio/34VpWQgG/lSAhvSPuRkIp/XxhQwemti+3yQNeqfXtvpfKa1IgAg9ic/rbocQIUtQDaT4yYFi7cruTpx7U=
-    admin-token: AgAJHn+bv6P/JJVplonJWgc/vnqXRQSsaKlTnrEUmH+P72YqMPEbt/Ma9ptkWOewQNr6mceYHUpXQuhczuAmeebe0GS7jr1md+Clnap+8NMKHbhYSCX0/MwvV7JUcWfZ6xJcttPHbP6a8s6SToidDOohBtY6gkeuA+12AtGI0t6xugAcCwBKqZnAY2lacD1nEqyatUP2cGHXTMmaNzsyz3g9QvuhCPrOx6FeC7JjmC/JdwqyLHN/b/NvVdCZUmvNjsPaq0U7UK7UCbcWYbjxof2u/3QF+EFlNBrpb4DYipOVqtrY57IrfYbUNucd+e5X71Kjpg+iwR+IPyGXS8OGJQQsh1ytYeZLbHpaCpmm2HVU0JMZx7p25QSqwNzP81wjU1VKkw1WEZG4RW4eHS6/aISSBouG4g/IRo8E93nskfj6Ue0+feFv1k50l2L4ROYtEUwMaeaA7zpwr6tTei1fenJ86sa3HAIwgIdiV1qqp2TTWwpr4xFHlVYdYvb+igt7Q4h73FwvYt3kAMTmH5O2iatGZfo36pqTGOqrfBPu5p+agkuA97MSumqHKzqADSPyNz0BmqzV7DPvuKsKxaFYAiEbNjD5bCIyDUwNnQIucMUbHtEfLngN+yD79kZiwBY1xS7sf8QG5yOYi0U5Ra1f/AEKasPUEOsiphrypcTZ3GzVv6aIaF/AJPWZZGDT0S0kXIB6u19Lyl6V5NUEXImnpBI8gyoMflIiFB18qt0nX7CBbNdRcwHGzcCjy2nshkvhSRmW0OiWw3v4UkDu8YAaSZDRFGjKJQ==
+    admin-token: AgDBYTHO2ZgJig+h3wIv1ru7VxEDKIq+SUjOygg39lVaF1bH0ADaWOdr1m6nP37LiBCyQSGtqilUGqXPV91VRiJJqFBXLTnYs0JbmXGekkfeImztAd7LL3yqKHThji/Bo+vD00PC3SAbpder2d6BJhOMez2XqFY2vPSY81earoiR+ajzuvHBC4PuwDjNYwnNq5BkGCF/D6EOenVfVJZdWHG4/oCciJzX+fwYQYw0sY8ur5cRxyY6wyWC2QH9YflDKbwFteiqnh8E1+B4mqSFiTcaM79FAU6rYxknXmw/BArNdbXvAxvYDyGKxQA1k6GwW9TWSg/CpKAmuJW2Xv1nMCqt3ZIJCTO/H1PIi24XouNBGc9n0VOWKNWZTI8CIZLRB+/LzLuT/vjhu4qA/LE6SkDXw1dTkgkkUChUKN4PrWfwTVIEgZwjPdewOZ9D9JT8TmPSZtGvVuDVOJl7+wBYGT4SkI9W2qU91h1VT+vmXO/7QyQ/kj2ny092GjT2aJTFAbtusAjV3dKZnfodXaCX/dQ3JnSuP2mWQGZ/2Gj5AB92FNvqeTkiqovS2hGgXjyOYp4JeXVPvBa1tWEo0Cy4FrqBLaycNIHuhGiWAhLrivXTX2YqyM3NfEmEuyzXu5M3E6eQhaF8uveDjqhxF1z07IUXU8zBCvHtC7vX2aYPfSKGWcpvGKa8NnkjamRY1qJbj1Jr15a9UBSM1TyWNGp3pxFHyy707FlayRDIdJOe0iYqQw/5qZQJBl1u4/1zbOldP3dPFtbGuhR257+wNWwKKfACorTsBg==
-    jwt-key.pem: AgBLwseufpRTqJdLEFeRr4ZN4VihNmua9GMPEEm/iARbWgNqCl64QzvJGy6XWM+RdXkS4z5jrjMg2Z2AJDHvd8qnFpDPBd4peAYw03vaxxpkz/TNz2+9HO4Nultn2wA2bd3CfA43doSs1T49lksCKn33puYEh8q5BB9hMUgU8JFc1sEMKS7auWoPQlwAOnJ4Qi4ISQZZ/C2IPLVW1VUJfPTsAenJ7ZgqE42DFFmghDfaFEQb8BcMNDuQCU8BJSqC3BoSMiuxmtkurzk7aXegVOEBcbdmPEkKa0h63kuTJCHZth5mVz4NatpgO6EDovGahO2EJkuAY1fyDhL0EpUSf+XHyaTpsDa/M+qvPZvd6wjGLjIH2CV1bHkvqx2GjKqv4zPkki3ESlxan/qfh0uFcGG2a2bSezmFbibvXr6uvmKo7KcbZWevc2GYgmODRJRW4bl5MTp0YDKcxF4I2kFboJhnCG5aw8hfw7LLUdk9iCT89u7UV/cHafG9TpoxkpIHyZmKrZLLczAvkLdABFX+6UYbFG3N+kVlFUXe6K7Gt1LrMVievNDIlds0y4b1paXIsj855znXZO7+zLcmpJKEnmjOJ9wa6TLCsI3wdTzEoLQOO9HPgywGRo3lxNu9mbiYnRbjwpO1pXs8RNfQj0ERNwE/EZoE+51SkGAADvqeWG/fT4bHadKaTYWitiVwXOjKJeXjEm3BpQI6hNyLMO4J/JMTAGHdqNttv3yeu5FJWJ4MrYS/tyXUSVBTojU2599/soFPqDUn/1IClkOKrdG15ZJCedMB55qOPf1k51dvIbhUVBEQlDyRDGksqPItVf1tM/+RhuGrasRk58zVuY5qm9JQFReNiNZv
+    jwt-key.pem: AgBYRkRh01LSyyozE46odjgrHsZ6gI3ykVOdV7qMPEFt5lILq44BKFt3vVL+yAUz0brVPQeEjz7dg+xsurAKKMjvuxzkOqBsSFhWwBzy+f+GfTSZPBrBNPAX7jI05dUNbcu2UuxYMlgVq6VWa9lf0Gc8yvuEuD0nS2qmpj1ACL6awLBKnkVXL9c5mvoC97DRyk920rPTnERJGU5q7i+zue4sxufYJwJZAJLOmdpzavHfQ3lCcJr6FfboFmGnvD6SM85rXTtImyDY4tsXf4J1rRriYR1OQe91j4SSbvxDFskXYSQ4bTgjimat21SXLCImj/Pqh6LJz7wMd9aW95ju4jDE1q1og0ToIL0Nybl9ANhqlJgFtOfvQRnaJVQQw/2GitlDVejJHCYWsVsSxQtAhvrGdWDOrZ1eTzvsmBnGcWzDwtC1YN3u+Wd0qJBfoRIJLiinwLaJ7ponm5MSb9Qjkym99gXm6XUO0MlHS52pfVaai+OmyWE6B6nF9tf3YVXfjZcNVB1pFHCZZR6XcnIm+wi1EwxXR8NIeFgqiaIm+BwX9u6IMiQOHCVznHD5nc2wfSXpeeT75IX/HAzRWC2cc6a8vPsr+h4A4hqW+cOoMYb9gQQIa+F5X4LcWb6f/0HJHh1IO4vf+P2hVU/5CkpgGJk+x48KgkrX0CE+bafQQjNp8JTdis1gxSGEX0QUaVGl+x7exGhrKlW81ZZTovequibx1JhdNSXNbWZxQ2fXz7SdN+/AjYyEh1gNPI2Zx6RRJc5BlDSSt7TYwqy1NUcPfbJV7hbqV7oDUH8JrsoSk+xxB0WDE+Uh5P4MsQna6NWkWyFV4tvfK4QyMupQaxOAKOYV27DxBaTr
   template:
     metadata:
       name: garage-ui-secrets

apps/garage/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - httproute-s3.yaml
   - sealed-secret.yaml
   - service-admin.yaml
-  - networkpolicy.yaml

apps/garage/networkpolicy.yaml

@@ -1,44 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: garage
-  namespace: garage
-spec:
-  egress: []
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: monitoring
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: loki
-      ports:
-        - port: 3900
-          protocol: TCP
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-      ports:
-        - port: 3902
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: garage-ui
-      ports:
-        - port: 3903
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: garage
-  policyTypes:
-    - Ingress
-    - Egress

apps/garage/sealed-secret.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: garage
 spec:
   encryptedData:
-    rpcSecret: AgB5qZc+lP+J11wyLaNSG++stokqfiu0KuX+FPIzO9WZIHsdNGoBlcCifn9jsbVxB5z9tbSlteSTS/hVLHvYWEGPK5MNdRZORG5lSGqf428+jmdCp4kXAQp80nBHsqsOpJeHJtuM3IlEEpHMfV18cXnz9Q3fOj7hcSBRb28XzdAdyEIr3ZG7ThPScXR0lQFwYe5/W4GikGQvLUHSn8DwZgsJesP4bJdHlHaifPYZMLFa4JSv0bcwrz5+WjsKWU3xa5wkHrMT05ihaK63n9vUOb4/AwPQHBL2BJfl95DlmoRAIvAqwlfA3d7N7Nekb9G8ZupUTnPRZBQ2+32JsHZ64B+nIR1/WC6+8U+2McTMJtORCidHbf0i0E6Q6ClpMeoGobtVy6z+rOkUF3Z9xW/WwS1hznb5LXRW1My/KPvo0pztyEipdTZFqRkq2teGf1pXvELORlA3yoE3K1JU3RgCmDWOD4sUbuacWhjG1127Zo+W3gnxudVbODJ+s/F7HLC+6IHlWBarTd9QbTHemD/8/iZpkqWmyg1oexowvzWlG6jWFsxBe+hMQ9vzFmPkYDsfzBNMeJohwhOxPG3h/aWkBw1FHqd5/VOY7R1t+BpCI9xanWKL9F/rOa5wH5wfOyLptLv057ZxCBCRZQNDeVsAaU+Z+odBYhGQxnsZIPly9L8vAnS5h68A1bnTHhyob4RuIaLoSTKGDHnNOvzIhclu5DSfr5cSkRxbRRFPD67KSpNhoU7NUnjJJE171yJZADI/f5XZPVfe/1mu7Y3epDExT/oD
+    rpcSecret: AgDWvOoSUADQx+cExTUDmk6/BWR8a7U5HRGf+T38P24FrP4DJiKl3GJ3Ce9a3eF7SqO/1TXiaN80+c4NX0dMEmnaS8III2Zbaa7x/rOHP608Vh1z2Nnxly11X10okVy+Qym9O5/oA3cue2bu6K3eG8W38mn3hCA9kWC6g9OiAwjBTxJXYmsUFYbj69Iloo9moBBLEtztu8T9vYu8rGqcchKzzjnvcS91kiduq9rY9/ZvYC4zx469DgnV/di8cjGdU6JAtsoHwggDtCVf2hvkyOIHTyPM9Y/EVGCsOsIzhJnTdsyRGn4su3ruLmS8VqbKC22Q86pSHjwdlD5RoZJjYtMWr5Q5YAvFbnTH9/+d0r363BfxlNsVkINd5d2OwlPpagEQ9pg4oFnnk48tsVEoYz1RCy9x/bK3U4B0Jin6l0T2NJ3umXPriLxBQbODWVA9vcv6G1tQiiuOsbYCWigoxe3ACpuYQDV+XujfmEZr3pcIw0hwKXtUWHI079aUkICcMEbtE3gLc1dNVQpja1SimZOUlqf6pz3YLv6L1e2X+yR93p2rN6hc8IJh3KA8ZR1Ymbbq2LaOwdyla50uuhsOkE2TGDTGmf9NyXjGcUys5LgNpRruzXEm/KgUX4tP7iMjHu5HbnDe9oiv66qfuIORiR2P3lbOdx3s+XmPd/87afw6YHA896ccCRkGpGnFanbrR+Z7MRqCOZsSLnQd1JpjnWJJU/bzrSl4q+PUV1Bt+hvAf8wXUrDtES6MdpOKUe4XW8s3QbVHvCx1iOSzP+r59T4N
   template:
     metadata:
       name: garage-secrets

apps/holyarrs/deployment.yaml

@@ -1,74 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: holyarrs
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: holyarrs
-    spec:
-      containers:
-        - env:
-            - name: TZ
-              value: Etc/UTC
-            - name: HOLYARRS_ALLOWED_HOSTS
-              value: holyarrs.whyredfire.dev
-            # Traefik's pods
-            - name: HOLYARRS_TRUSTED_PROXIES
-              value: 10.42.0.0/16
-          image: holyarrs/holyarrs:1.0.9@sha256:3d941aa8a78d4474cc016a0d994b2531aa8692015aaad487cbdee136e8dd4226
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          name: holyarrs
-          ports:
-            - containerPort: 6262
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-          resources:
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-            requests:
-              cpu: 50m
-              memory: 192Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            # Same path as Jellyfin; one mount so imports hardlink instead of copy
-            - mountPath: /media
-              name: media
-      # Owner of /srv/media, same as qBittorrent
-      securityContext:
-        fsGroup: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: holyarrs-config
-        - hostPath:
-            path: /srv/media
-          name: media

apps/holyarrs/networkpolicy.yaml

@@ -1,62 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  # Metadata and indexers are on the internet; in the cluster it only talks
-  # to Jellyfin and qBittorrent
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 8096
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: jellyfin
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: jellyfin
-    - ports:
-        - port: 8080
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: qbit
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: qbittorrent
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 6262
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: holyarrs
-  policyTypes:
-    - Ingress
-    - Egress

apps/holyarrs/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  ports:
-    - name: http
-      port: 6262
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: holyarrs

apps/jellyfin/kustomization.yaml

@@ -3,5 +3,3 @@ kind: Kustomization
 resources:
   - httproute-local.yaml
   - httproute.yaml
-  - networkpolicy-holyarrs.yaml
-  - networkpolicy-ldap.yaml

apps/jellyfin/networkpolicy-holyarrs.yaml

@@ -1,25 +0,0 @@
-# Lets HolyArrs ask Jellyfin to rescan after imports and sign people in.
-# Adds to the chart's policy, which only admits traefik.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: jellyfin-from-holyarrs
-  namespace: jellyfin
-spec:
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: holyarrs
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: holyarrs
-      ports:
-        - port: 8096
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: jellyfin
-      app.kubernetes.io/instance: jellyfin
-  policyTypes:
-    - Ingress

apps/jellyfin/networkpolicy-ldap.yaml

@@ -1,25 +0,0 @@
-# Lets Jellyfin's LDAP plugin reach authentik's LDAP outpost (LDAPS).
-# Adds to the chart's policy, which keeps Jellyfin off the cluster network.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: jellyfin-to-ldap
-  namespace: jellyfin
-spec:
-  egress:
-    - ports:
-        - port: 6636
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: authentik
-          podSelector:
-            matchLabels:
-              goauthentik.io/outpost-name: ldap
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: jellyfin
-      app.kubernetes.io/instance: jellyfin
-  policyTypes:
-    - Egress

apps/pgweb/bookmark-grafana.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pgweb-bookmark-grafana
-  namespace: pgweb
-data:
-  grafana.toml: |
-    host = "postgres-rw.postgres.svc.cluster.local"
-    user = "pgweb"
-    passwordvar = "DATABASE_PASSWORD"
-    database = "grafana"
-    sslmode = "require"
-    readonly = true

apps/pgweb/bookmark-redoost.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pgweb-bookmark-redoost
-  namespace: pgweb
-data:
-  redoost.toml: |
-    host = "postgres-rw.postgres.svc.cluster.local"
-    user = "pgweb"
-    passwordvar = "DATABASE_PASSWORD"
-    database = "redoost"
-    sslmode = "require"
-    readonly = true

apps/pgweb/deployment.yaml

@@ -1,73 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pgweb
-  namespace: pgweb
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: pgweb
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: pgweb
-    spec:
-      containers:
-        - args:
-            - --bookmarks-dir=/bookmarks
-            - --bookmarks-only
-            - --no-ssh
-            - --readonly
-            - --skip-open
-          env:
-            - name: DATABASE_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  key: password
-                  name: pgweb
-          image: ghcr.io/whyredfire/pgweb:sha-2c734cc
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          name: pgweb
-          ports:
-            - containerPort: 8081
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          resources:
-            limits:
-              cpu: 500m
-              memory: 128Mi
-            requests:
-              cpu: 10m
-              memory: 32Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - mountPath: /bookmarks
-              name: bookmarks
-              readOnly: true
-      securityContext:
-        runAsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      volumes:
-        - name: bookmarks
-          projected:
-            sources:
-              - configMap:
-                  name: pgweb-bookmark-grafana
-              - configMap:
-                  name: pgweb-bookmark-redoost

apps/pgweb/httproute.yaml

@@ -1,37 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: pgweb
-  namespace: pgweb
-spec:
-  hostnames:
-    - pgweb.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
-    - backendRefs:
-        - name: pgweb
-          port: 8081
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/pgweb/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - bookmark-grafana.yaml
-  - bookmark-redoost.yaml
-  - deployment.yaml
-  - service.yaml
-  - networkpolicy.yaml
-  - middleware.yaml
-  - httproute.yaml

apps/pgweb/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: pgweb
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/pgweb/networkpolicy.yaml

@@ -1,44 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: pgweb
-  namespace: pgweb
-spec:
-  # Only traefik may reach pgweb, so authentik can't be bypassed.
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 5432
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: postgres
-          podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 8081
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: pgweb
-  policyTypes:
-    - Ingress
-    - Egress

apps/pgweb/sealed-secret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: pgweb
-  namespace: pgweb
-spec:
-  encryptedData:
-    password: AgCCLx1xyP6tj0NnqQpB20SXNfb1k+Y2jL2U5JEz1UMR+bx7LXCGkFoWBGdvLBEO0gOtoYwcG2zQf89ukurqVx4V6Z7/22/0ERvOw1HiFrqnHh9B+1KhO/76iC2V+0a+2elCYrPuTUeV8MaBbleY8qPHqTVbx7P5umvtrvmI9YcLaROw/6FKmgwN75JYMWjeeAhrhW4knOgJKgZqXFcGUIqPeC08TBVvRfIfkxyahx1mS3Bi4Wu1GdYaaUOfyrhCUuyhhE9Fo/dAFVkshnJGRPpBvIjM/iFsR8LZYO+WuVE4HbX2Jf/re7jZMELs+PbliX4I4RUNUTo8P6J0GEMlpHXTzkpVvtRsSy6SZynEmr3u3rLFW6y7xvqx+fMNEIO366Vn6wkDMCakHroo7ZCCgMIhwTqtbIkJ1wLm89SzMXaAapR0ZPpF2W2t//XZ6XAPnAXuwW1aynLddHd/4q4H4GFJgH1igMtAU4Rdt69P7F6V2w/SgDR5kAXVzh9VOFdiWQ0cB00E9d19PpAIbEhx6SJ8zgout/RjYGZJyr+jLML97KqiSwaH7k6dH4JfezLeBnlknulbge7NRoL1QiN0h+rs/O66+lD37mlQV63mWDgbkqhzDIV7Q2ORRyj1PZ1mJ9arzNnWOGD3DpjO3IRVW95XEHqj4Q7FGZ5AOMHYG/Jh92LWqLmVjKG74omWf3gsFAdN6SojEf40TICFCaiPUpo7rwPCBialScmMBVDq9RJmlCjdXrIlEbBx5AxI/HR/oT2wrS9Z7slwN42jYq3T9f7A
-  template:
-    metadata:
-      name: pgweb
-      namespace: pgweb

apps/qbit/deployment.yaml

@@ -27,7 +27,7 @@ spec:
               value: "8080"
             - name: TORRENTING_PORT
               value: "6881"
-          image: lscr.io/linuxserver/qbittorrent:5.2.4_v2.0.15-ls480
+          image: lscr.io/linuxserver/qbittorrent:5.2.3_v2.0.15-ls478
           livenessProbe:
             httpGet:
               path: /
@@ -38,13 +38,6 @@ spec:
           ports:
             - containerPort: 8080
               name: http
-          resources:
-            limits:
-              cpu: 1000m
-              memory: 2Gi
-            requests:
-              cpu: 50m
-              memory: 128Mi
           volumeMounts:
             - mountPath: /config
               name: config
@@ -111,13 +104,6 @@ spec:
             periodSeconds: 30
             timeoutSeconds: 10
           name: gluetun
-          resources:
-            limits:
-              cpu: 500m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 96Mi
           restartPolicy: Always
           securityContext:
             capabilities:

apps/qbit/kustomization.yaml

@@ -7,4 +7,3 @@ resources:
   - service.yaml
   - middleware.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/qbit/networkpolicy.yaml

@@ -1,39 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: qbittorrent
-  namespace: qbit
-spec:
-  egress:
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 8080
-          protocol: TCP
-    # HolyArrs sends releases and follows downloads through the Web API
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: holyarrs
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: holyarrs
-      ports:
-        - port: 8080
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: qbittorrent
-  policyTypes:
-    - Ingress
-    - Egress

apps/qbit/sealed-secret.yaml

@@ -5,12 +5,12 @@ metadata:
   namespace: qbit
 spec:
   encryptedData:
-    WIREGUARD_ADDRESSES: AgAgYz7lVospXNvfy7IZOK/fxQe2OWJ6cc7ZzQf7kfXtZgARrffOg2trievpkcimVhi2dL8CTbYwuiJ72M0FirxOq9zTyUGh48AagZk9JygQntCrkJp7O9E3nSpyTJanq2L5QWug3WePvrjK8ShzmSJLQT43l/hAxFPy9u2JbblU5vjpvPpZCHpVU7HuZ/lqfNEI5zRj6mzxZnphmctEGzXW+wilw+WHENvDBL+jqSMgylAycu/5+Uc5X1JGLqEN2DWRyCQBRMDxkiMBnVvE+ImfkxHU+ZcTMUANllnqNwjot/jpFDZb1b916n8eBLMoSUkwKpTP5DfT0slez7hC+bJ9tkUXAAUHDRm18XTtGY1Ouh1uqtIQl8HiuY0hoShfPF3BfC/4wNXMRZjsj1R++z6kP/vQyiSu+z2PuEI8yzDRnNQGEnSnog7bTJBdui/MXHUc7Q+wgVNZ0/c4HfViZbw4zP6GVf+jshdUbOR8HC+KxRlKzU8cNDeUdnydUxplF+By8gyWg1hPY/GlD+8hRWqi1QDLdgl5JXEwDpU++WmKhiBHrm72f1BgZ5jlIiMON3Z2Vo18DzY8j9zUA59uAQsxDhSu7+wiuWQYbZrSVdFY006eBWaI3gVPeu3e3++i2ogKFfc6q5gmmaxhs1CLhhUypddKUzkfXDz7alMuauKq/h4uLesoqIFEXD9eWPs4mP9qirYx8MAZP9txx/YP
+    WIREGUARD_ADDRESSES: AgCUjKDTHlj+cDz5QmTdFrQ2uzgf2h7nHIB22Hiy8dNQoHPmpl42IS8pWMM3cC7/RQ620XX3Gvnjt7w3N+cRHsxZONCtBaocM/B4lBxgkrqoBuMISQ90oeqeL16ZWd6yDPmzgJLG0JfWPEuGkXsCkMHKg2cTQwZeIhoI0jiiUIKtY0q3YA19cSaf9gX0buQyu84hy6oi7Y2l0EXqwcbHJP2NEAWmxXuHF1nKtcSnAUlsHGCfomHLtSPoyoR0Ug3CER60oE18JIYmbt+iFL4Oalx4nKFoJbkD+dPLx/Do7kylySVqX5DAj1ivIQjyqZmcsyaigP01OU+poSM0D94mhMt8Dfi+ZOzDemoVDKtJlOYNfskk0hLdbLdGk6DzlONl7KBjduzbSk7BnFlr5bRNeKYFiDpg5I1y2FKROpmFCvV2pzqlLFl0C2BTwZU1dAj2Qk+ouUdhzzxEKqS2Q/CUUIftepqKIYzMJncFDbEjt5gAB0DJOt6FWiNG9TV3v+oSdzqn9UFPTIP1SO3IhyVoICDGmo829ki104ZnvjVciuPLH85l5rSdQI6qJuabLXylqTU8tmebTXDJZw/kBD+hw4ycCgD1kQssZM3djjy/RbMhY4zrpN345jelr9Z5kQsINcDBPfyCjCm/Eo6PM/fiuCkNP/KrKHI6C+NkyFHWk14ZeYODJI8GYakRO6SCRZ1G/SWJxA5DfZcuojweGD0G
-    WIREGUARD_ENDPOINT_IP: AgDEkEaKaG9zfbuT9Hx3HMWZJzVT8QnMWN7eebCx654Gwn6XNtxD/22d8wxIRfhllrv47HCsCUR855ptHD9HQjeJ08WhMFm7nQl1rYI/5vKfZDyWdSR3grBzGConz0Eue3y5uljXcr0yN+9kqzURPr5MPs6fKRJVfSWaMFbsjb2S1Y3HRPXU3+xdoDxeOeVmMV/pP1enGRnZX890UF5QR2wfZcEXB6WPWWC1XnPxc7CFmLNRi4RRhLjh+A9WDIqEny5gviBTFXQsOEnFqAEFSmey/zMF+Rk2lGEWl6ROFzdH7ypr9KNA0dtMmfCLJ9AQF9P6MMD/uh2CyB5K9Jk5xNGoy3EgpQyjHp7q6FGiUG/jT2RXBdfoiJoq/NPsgQB3leIzEBBQk/DRau+xcob6H75nVtS+fVWOJFt6tsWKVAQhDc7YO7WvwRyTups+3s0iHxS8SXbshiC+ndZPZClPO4UXVY9OhMAUZ3sKwS2c0Ffj3xzJZWTnO7JBcONYmjo9qASd6FJQKPvIy6T4t9EEe6iL05t0/mIsnOIEdoN2le5Lv4DK5mmlboCW3FzSK/e/QD1iZLJVwrTF7gvBKvsGk+hCng6GZMsr/3++t2bZYMUjMZPTpDaTk2z3N2An8Qg0X2HM57D/pTZiaiKTy83cjQsnFhkLBHzsqGhtJbScJHtasAMt07+kW9t/8T5LTGSv8h6w0e2Iyj/TsShc1ZuA
+    WIREGUARD_ENDPOINT_IP: AgBKPD8cgNPVl7YTUsKkDRioPFCLNg+q+PGYiN5Qvw5nAvhh8tmUiV3JlkdtUHp/ggC8Fn+bLsNPRjjQoa02F8wZv1oxO1XeThNtxX49xlcLiFsw83wtL/pKQcNShml+HClsiCXN569g9NkcCY4R13tcSZPRbVs+oV95sGeUtfx/Ukh4g/URX1Z0aKzI2RE1ENMLQMXkVrrk7GJdqKBBsW76wHcTHw3DgcshMhlgcDwLiX4b+e5nAOzjlcwEKm6EBxXz2NuHP9PTkzfvK9QSSZJ7GLlac7eqFWj+xir8k1s1bIzB/suNMIzpo0bvOUjpxmoI54Xd4/hZ6fXkEF7lD1DwK7G/RV9+XNePPX+lGSJ9gQMIadmK3P6jHNnl/+RtqUk3mQ35r3Tl1Tmz3mhhK3/YalL6/8zWesNVYt6D4yQkFi3GFnc02Htl7/CyU+r5a3TwE3xUl/VNtkhHklrL8obF/cCORbFlYcwT2tbYl1av/3slJ8UsG+DXEX62+o6Tpt70Mzhcj61mQ2H/Emb5d7FPYlohogM1e37YY6lJhbjZeNHxxKvki8kusPa/eY8ZAdJcpd41/0rrL3uSOOZqqELNuTzqQKRhb6CDUGaoYFqSw9umDqwjdvfFQcYLQepn84HFILAlUfNF/InO6WrNh8jWGKx9SNsDfrJpY/RRyEJK8EoNIuelLdNP3phZhxUcQn/UBZ/M/UOzJZZ2xJPl
-    WIREGUARD_ENDPOINT_PORT: AgCANmOaOgGnXywiDn755qCxBADq995QPGwBQYiApioSaYC32UP64SVP6RRDBGvC+jjFqhmXZlSDTN0LdrKG0x9d7klVIlF2awTIdRKAzN9wki0lLZQZ9Xx0wQl/YVXTKgcVtiuWeOmSJOEPm8Zxw8/1Rj21bg1PV05VZc4jxqsq+s0AdDy8DDIphD0Pobp0/U8MpowFRFEGnjmfE+Ap0wV/L7CR1opFr0PJHuEbgjp2+WfgnnG2Hwqj8nEUXiZzZzd0YIQ53sE7rlpBfTgWIBpeisOD1NAmAr5UxdTSlYhKn11pdMgIdybYGS22RTYMdKh9S6I+S0AjA0Gnci2O62c7y1aFIMxLrq2G8LhTlCEiRrYirGzNQZiVooGAnJE2evcTVnjZTGS2eHH5d+86Fq2anD+YzYhW9QLyp8goEyqHjuf7EoGF5H78Ij0lJ+rPreA0dSU0uOEC4dKZQpvdjkMZFu++uusNWLh1x8tvQBdRBDqExc2qbulBnn8VxRk1jwMKjwRarGrt0K4f2Dn3pWGc8d7JuLxnJ5QDljp/BaNlrOhnp95h1Uh4vQoj6fvn78aMkAQDbIIVaCx2IFVPEJBXCfbYIbV7mY1M7roRTZPUQ4+mGDe3IEPeXLvI96QK5en+0VsksB37+eFp7BIsNibzViJI5KgBYp+Hd9PECPYKivPjhP15vqLEcqGuskahvxp7xblS
+    WIREGUARD_ENDPOINT_PORT: AgCOTc0MMWugdnF6Ou8mGgBGu5VD7zP6O3hGr+4YzW/UvCEARqwuoRXTKggUpFcZC0mNf1CdGCB1iRGCVWjnFJsw6zSudcJiWEVOtqLMfxxwZHhApiMtaHq4ERP4Hhu3jn/QwdwbYgk7rUoqsCRU2JelgPoYIhJh/2BtOz0z8PO+ktMIi5Qaj7m6O0zkxbzvqZaEbgkYsFCtQlaWqvghNk7GZB12KOOr0kU+Uu4vyi2ak7quoMjaQkMrRHOhhw0hk++FCXN9SNpDGyGBcqPtl/8ZRUyomLi76O3nsHX8QtXXj3yzDEwrdfwNzCwJXqI6HI4X2+/xSvnxI09wf5ei6D8gyJX8gkPQiqsXA4dsYvTUstf26Qlh/L6iQjB8RkXixBR1YwrIu/lLNO0FpFPqtLJu5jf1jMjZIn+oPl3GxAXcM+kRsX9YS5oJdD3rFFTz8HGthfOTSpaEgSnN2rF440vfIH8DKvTDH4cyR78C2Z8TWQ2hbDxXOX/NwxvPfidttyC3euLBc4Nkb/VX/DEU9W3QCB9yKuXw2KKSqnWHvIAReYLn5ex9czU+B+8IP2fJzTMDH7gOYqwtxuRMPu5bto0dn/120ZaLDBzGUHL38pBnMsYhssOGQlerpG32nT66IYdaZXTMD2UHsTwnNqu4/J98IY47n60wg3SVOVyZQ/dmS7Dfp8lPr/kE3+xNM8HWayCEKYxW
-    WIREGUARD_PRIVATE_KEY: AgB1iJHqHhWudTU26hAXvWpp8OsCccV7ASH1BG+hmo5nXTEyBpjCQ58yuYMIYHIJq+iLlrHTr3cn4s2Q9CO+BEnca1O6sfOYzewoIqvVVjF4ol2TurPz+Q+FhqO1W+IAE4qrg/2/qTwyg7HcvBHEsKvIH0M9huAk6hgzGrh0Hx1NK2AyvtEkW11Bxubux4LVNxjqS9RuNNzIvVURU4aN6sDX1Jhkvv6cr/DU8QwopojHJnrxVOA++rWgF4IFvkz0K487WKkE7Pn+aTW0t+vN0JgxIobznoyMVRkUqeEDbE1nBaf+/JSQ1FREcv4CSIzT+Zcb1XslkGB4vOjEC0ZBkiQaAxHQdl0Fdthmt/5NnXonl+5mFDVepDmoGPmsk272uMGxl0vvTXWZXQfasspf0MBGBjR/NF6MPVkEf2n6Gkk3INvtQUbtwjKpmbQj1INBKVhOgEH5RDwyYsHz6FkrtPQmv8odwcTpQzL4gC7bZ5aRY/MGJDnWRNHZsU2j4Juqpc7q8t15xT26gvhedGwcD07uYM97gGvMtVhiCFAYj8XOKJAfhqeROgbGjWSpUC/9D5ERNg9BYhYyYjcOmrmdL3x2LZEiWCwKI6jR0YssmuGsAgX0z01h4OvLTN+kjc9hurdPdat2zqNr7w48CdE117ahLd3li//iYWlEC5mVCnHQ6iRrh65LstfCDwWBdFHTLfdpAhe0Ugd6rcVJt1sHPGL/5E6tLECU8zwOThU6WygHmvWpjLzWIX1bO2eF6g==
+    WIREGUARD_PRIVATE_KEY: AgAwJo1zxNRWXAinDWXvLajPWwHeWwAD8zOopE8Z8M5xAUDKWkTwZecR/ODI37bYQ22bb1+qjErBsqUHyT79adOmypY9DLW6YdY2YPkQwef33iXdgC1T7nV4pjI2TahiVab0z+5ot18A/FM9S7VHmRX4L+3ccO/oqcInNz5PFbsXp6U0dZZtiKWg7N5IzdT9dwDCknNFTv10URlHKE0Awff8jA34XGC8Ra/SvF3gSiaYjwd74HEBpnBMM5CsiveOyU1vCNxg93S12yrauC5jmD/ex5oEnJ4J1SziTUlB6e6ALpluA3AD91wuZ+wXeaJ0huNSz4g4sL6jm3OQykyiRx7jx/8FL3no0u3ydGPgYZ5MaEYXBtTk6ODFEhUZ7EGs9w8vip1SY/FijZYC3QT78R5WMim8gi1wf+TwmA8YRIDZW0CMhbtI32Ef2oDmb1Jzl58Igba8zQGTIqT7Htj6f4mpJk8gKSRIzkvLK6o+cynOpQzZBOZb+G7lZst4g+lILLjmfpFGJTVgogfEkuYV6ntuE3dGB2OmRGUW0vpDM4ZCkxYsjh/1kzSyOGVYtL0EHS689ehzUDUJLuJuvuwZIFUjOFCFofGP37rKCcSGouLNj+xWmcbCgx7si05rw8JMeAWE5YETaBbi55DDaUB98G97KM28OlPBDm8PtqdcBD4W2up34nowXdG0tZ38VsTV7xNyp+2A5saPQZ72wM1fQiUwGwoHRKdHB1ptF6u+0zr6tlQoiVE07BMQ8/ykAQ==
-    WIREGUARD_PUBLIC_KEY: AgASGQ2/lkGyl0HYWYlwuJZ1EtxoHrCIf/Zgzk7hCe3he1kHZHrcDpdoMPVEd5ys72wHW1crygowq1h1ySHPRb/gU6OgxBQHvZkGXBxmXon8u3KIuahuAnXwHsftO7qIepAGTka9S8/7GTeXEutXGMOWgfdRO3RzBUzkmoFH6lyFwco1U6SBfyfN0MVfPTTlMk4fV6DBZk4ygOf6Slow3/CR5+2otNRFx3fnzPTU2bEg0QvuMXg2RPmse9YnjIiSKl5gVmt5FwIyo7IDpgJy67rwfGu17Hv3cIhOdLLskPkakd97MVxpBp8xeGLSOL+5ogeoi2rvKvF3AbRyuMhi1eUlTuYuFp672tPQqkrTr512LsL44+WZdivhEAAl/bkMSJDHejAyta0n/3BJTIBaF9T7/ZPagfMSE6rBwpI9qpiNHNaCD+qeo9f4+f9VvVj0TTvhGku3ERh3cWiaJ3RElcpzhlWNlBb1Rnnmz5d++ES85W78vq58HjfYv9Y0JzOWmjdk0PhOxd7us4qNGOUaEs9CnkdDKU2AAnbbPkIw7CIGR8fTeNsyQw4L0VtP9X5X9NvjAsBsCgzPKQg8dcGFL07G/JLWVOCFQidn9L0SxQXH5O6bH4lic2jFQjCdwmOD9CkT/49Gb6ZzxwUnlYTO6mlNtIiFKhH/b+WAjDc9LMfwvSxNft1fkjgFjrSvk8No9NyU8QVvIPxQLJnKdVxSWWAaI8pePPeKaTD3a/qeANkb8HWIh6Z17zNx1ggC9A==
+    WIREGUARD_PUBLIC_KEY: AgBAElHBgsQNQ3l8CGLlKMmi9dMTLmgp4gseMgbEMW4sjOvhsAIeLGsuv+HuStvH+bfAp7U9Fh6pAlEZKPOdN5pbpoFjkTDC5VU8aKJcdO/+iZWURbULYBDyGK32Ss/0eCwIsdO7lFcSFy2T7XJFPn656lBx8gocBp9PMHRSoL2dELP9q8JyNr3nb84vZ8hwiBP3Gy8BITeeE4J7+DnF2SUg+4pc92gMOgmWL4LO25pI39Q1yKBw4tCOf4f4ETgmjRHv17WsFw2JZTgb1rmXFvvKWGzTPZbA1gajcRgTKY7DrzWFjFi/o84qjGC4feQ9vb5ZwnLN1MzU1yByQmxQiAOSCK+1SMrvUJ9dF2kE3zJw0fSGjU83iXcorpbe4YYFr4Y8k6mKSSthchYyQZp5FuB9N9J7vm4vv4kUbTGOtwHQFrKRNiB5PVVFqzUVYWs9CfFcodAu7JaCBHKzLj1X7xBLiQoWYpx7/LVTjoR/R9j/+bfblKlid+H322Oh4ReSuxVKfMmNiOGeueMOrGX+DhHtYFbGHmdc3aprjBkYanq71MV9kFRVAZd834IX4wWykQWWgmYtx+eZJs6DZRWhAaVbBQ9IY0vS4IjAInTpMN9yqNxJkZ+w1MJIeTG5S9NnB3xUjnOgSCow9r/IEVNFbT4CbsEXbMECQ3S0OIby8r3Zwt8J7NEphFYkLtsR+brtMLsWRHIw23mtSTZajLMaSHOG6fooZyNKYgYJGr0Spura2M6TjhW+f1csYKrkxA==
-    wgcf-account.toml: AgCmivAwuSXzJouUpC2FRB5vzLQ6Zj4LYzTbpwo6S6FuB0npes/61jtvdBuT+zdw+GuXhANRW0g4IBo8B/m/rtOzauZ0Sao6hqvlwTBbTPd6B/lnwQMMF/u4SrdsmRjFrlPxRWWs4rVZfDVcoeQqy7GCpRRHx36z/uwTGoFbz1yvTWO9RLJWCTMI8es8zoHzudpe9fS6PcAo4Cxv4ezA7kPMqQ88JkT5C0HdTNj5xEm/lhkrA/5mdF2ScDC8JOVJnJkURirr0glPRRoYlKB9wlSXcLtXMjlVWu72cND29QcOmJHaSyVZLzWtu83rA8axZBjX9c2Dgtw7zwtf06Lapcj91Qo2ul4vKXMfH9CoCzEpMwllSWKZZndV+OgkG53qKWzvrDj/bagK4qX4TLibCAdGd0hQ+/IX9ATJdmdRgHMu2AW3dudsLMXJJF8/5NdKS9ULeWXA/Fi1P+Ahebi1mS3NyRIQpAB0Fa9+FoaHUIp4itNOaOVQEQP/xKUCBeB4yFTqcCqnOwogPbzpsvPJWnoUTKCKDB9PCActjAiRPkGsxj+rh8FGfm/xjSbuzdLg42fHiFSO17zMr1xWbuhhUv4/LM0JXJki61e7/ZOPTjzJACykH2L9KYoC+jHv1+Tfr+tXnhO5yX9G7BUKF4r0CCciVufnH1N0j8ZsSDoqxT9avimH0hJJiJ596pW/UbM9KXbf8omqShd88rGHF++eX51Kp3eU2+JVFhpYsrWjtYOSUHobU6NqJZDYMc1TE3hAa8GeiGtuKweovD/mcbhEXvNksIOQqB2JZ8dODgFtN8WAcRQqRALoag5OyokcpZcnpd9NUgvPVUpCyddnKnF3oF9hR1uhhG71U7rf7OTtNO9KZwy0tg20cPQ+fz88vXLRejezCqf7yfVgd6pqxXtw7XgPHMR0j0RhKMrahee3Q/TWBou/XB1kVYkJHLfg6QLmRiaWVT4I/xd7zEZF7Li0VNc49g==
+    wgcf-account.toml: AgAaSo7eZz/CvAN1reUDhHzFWIcmQMopYloYitAYq5Zu6gXE+65ogq0Jr/S7WLTqdgL3KWWhSmlG+jpepC8cpomVrnPfydlw6or227dm0ND5XNEO1MwNOtzeGNS3q7ayB8NoC7qZVR33KqutGOZLbFawyTZUi4ItjW74SdvL/Ftd4VvqrG7hQtAd/2PP37mL0unw2DesL8hFUXTkvlzAdKHZGQMaYNcH73JWJwvlf95L6ncKdZXWEM0uJnjhAVE+sCpUEQK67mQcX4RrYairr1wwux2YYjwweAriXw7wzBDvOXnHqg3Ldmat0V7FMK0MeIzHhezy15AGLtYRonFcYzEznIl7P2FjjG4Yz0EAk0t1rJpQgV35NAybseQ8t/92+vPa7LaPcjUUKZ5Kx1a2SdihljtLEjzuIdvYN/tKPcselzehWWrbDl/qeQuwZABxj8z24moJmBqJcXpAigvX4XlDcWp0jHWQxbLDozKtYHKUEPmhAklVaDuVr+bY2jOxU4Nki3ybLYpi834CsifcSc7RAaruJIlnITZUR2VG7PMIoTObqfeYnSyZKabHadWHHdkoyYsJmSiWjadvlvBXtW+RTHVU8UsD8GdVS9wBpA6ZcRsegFiEAoMzdyZQNRabYjUeAxpA/lOtt/PH1FnIV588Of/lhypBdUF4rRYcCvVT0gFQjoe7ITsvEf/P+fLb3TO47fQtBqOmKqoD21yhtb8Y4GQ21XVmB1gJT+/oYjny9/YL5CuhJif0XoarJZHtvTb5Ubs716PRSmSvAoXI6jBMKVSssWtfMIedL03X+RAxyT3jvL/W/SEuN5D5a2RpjIswAIN5LQ3b9f7F/JgDIQKdIHUEm+Z430lS83RDsMpJ13SmRVoXzbAededT7r08DHu++sOvDfHeMy+lTD0aTaskbPWY5PLve7g7PWat9q+NMepgRC3z26JCw/08O4SGX/fUhxg709F5A8hf/LUSTNGRlQ==
   template:
     metadata:
       name: wireguard

apps/redoost/auth-sealedsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: redoost-auth
-  namespace: redoost
-spec:
-  encryptedData:
-    REDOOST_JWT_SECRET: AgBlwaY7ZaZZSSpLoS4XOF5+dghrmIXZu4YN7kQxlm2WunpxMjw4VjCz5Iz6OxvsJrh0R4rf4YfIotHTlbs1Ylc9JtjrjcO0joi3+VwenIGLbGKi3tq0JJCJohrAkFF08Ro9d2UEFx39vhEXJ6EFDoNqhZp8v51OXdLRe5gAU7kwEHyWIxZMzxC9LeVLCPN3Ss+LJCALa+ePoYOENYADy9PK0BgsvXddnUmRIaxRVv81qc74c1tHnzCL79nazVtFw4gdqV9m9QuPzRem2pHXRvIC8O8J08LeCSrp1XXJnRB7SDWEdKYS6iSL+/ohOhxYGRUSDq+bG68b7pWTQu8Gp/jHyPiZWcjtL5V6fzs4otE8Ur7prAbflXZHLuxzUjPHsUJ6JMoP/Eousb5ui/rcA2jtjVOlPmxaIncj2Q5JK4jABMt8s19oyFedlEHD2Er7WXF7ZoYY2LFu5c645ltju3HlUflxac66NDhVDqy5BGpFyjwkC/XJ6mrl3gqp756UaFrFW8ViuJllhYty08KBU5eA9AOvi9JRl0AVHGQPAE0kV+4SC97Q0zXcqNb0FR9PloOUNvoqyFyjU/n8LUO8ObWw8zrCPljigexHRKEawwgxEVCrqMNHaAtzEhD5uXrDvsTZ4ONFOAooR+dSKM13HSMyvwFyPY+vzZr6D1Mef4dxYfHwJeV6WtZuAFFsfQFS7QhFpCIDsDXV3FDxY4PJnREG9jFr/lkgShlLFD7IcdDBYC1BxwjNUNdMUW5oA1AiKyByd5aCQgetHy1UbJKGy7yO
-    REDOOST_OIDC_CLIENT_SECRET: AgDS2dN+lFtGk/DHb7TNj3+trQLgxNIQZBth1nHLH90gXh1Etz04wKwWmI+/OJWGqxaa4xbxrcJWJDaAQeAK34qOQ6nu3uVV10lK0PBHqaGVA9s7uu9LsMy08dGC3IcHGI7dSyNaBoWAgO/CbRJYRBIEl9ePibm5bvhMo0VQZk8LtiBxrsySLyYqBSEDLOxbrGGtEO6jAlAe21jKTFOdaSdwZ+oGPWAuKICciA8bl4A5iqkJR8P0AD0azZ/HjYtygOL9Lextlf2IcRyzFC6lmyYEyn/O02rTGgFuCZHHDcF1fS9VOXDXlJVpvFSd7fsbvLa1BOqZ4y0UlJ7BVP03IzmieJIbl3Ey57Pr/mWlpQ9j6a7Fo90zF1Z8eribSZvJIuRdLPWIBfHJTqBVB6S0YiUNcn2KArwx5hKbRqEfb1NDFyDV0cfT7dXTN69xcc4YByBdaUmFjZZKfz0gYIOYKZo8bkA/vHiIjYYOdamSJpdThNFMLuqD6mJdsNx3EZLoXjkezmbWig764AudHfkzU9OOqi095rW1tP2mSK9T1qAxjs/lr/PGNjTQU5CNQ/XOi0qZgnjUmRZEyuDz79lvL8LeE9XWLVQ3eQ+z2Mm//YNcx1soaHdDnhUKtFXEqcl3tj9InWmCloHtB8xtxyBoB2yEUR5eEls3qHCfdiebt7mINDMdO0QqmNdleFKz3TTs7/2NgJ3xfzK/cSkkfXxvUHmRgYpGWG8887KifIEONZvn6ZLDfg==
-  template:
-    metadata:
-      name: redoost-auth
-      namespace: redoost
-    type: Opaque

apps/redoost/database-sealedsecret.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: redoost-db
-  namespace: redoost
-spec:
-  encryptedData:
-    REDOOST_DATABASE_URL: AgBqe7ze4oAAyWrbSdLWaaQ3laVs7WxBobr0/H/YFpXIyALuVZP2O5rtB/0BGauc1xPEQl9aeYkmSzAvaK0ECtEvU/Wj9QLfSJ0WCcGXrK+Cou7ykW6lSwFfbTOzDylCDpZtSEKanFFj8KCmeu/7PS/gwi9zsJXKR4xgfaWEPztCr6ND8iHY6RkBAxljl3NLeR0y6auC/eq/Tj08IkTGlXHeF9nQN7SaCl4t+kxtjY+k1CLbXUmbmNY16c0H2DFwbLQ9RgsyvL6aXnJ2LeqRvNsg3QdZDPDJwvs1wqR/4U+hTRh8tAGrmIoqQKuxcasEL5bmBX6Bo1JVlS9xgULf9bPbHP4mncClHFJrXTHmNv10cLLuyd/o0YdBStWoaeIv2YSchnaoRH0Qu26GbF1CF2KrgE9Dwu6iCJn9Ux5LPhWBvjsNfJ6r7unw97IwEHSsrWT93osddiPi4rGLXS4rP89CouvUbN3LYsyJuI832Jj163lk/+EERxXR+ctVQJsgH1gZuHlswLXEkn0BvCT44w5+Sc0NgPkGeKyld4Fnn5FmHlba8qkyks9+J+mZBJC26fh9wZJN0JFbTkLov6sk6nGEMEvrIJyVBrAJi1FmEG0Uec8Fr/NyLv+1TZm0eeRZ1mk8J5h6QydsBu5Cq2wabfysnMsIJmS4YpL6kYSIcF0j8zr/ISfjEFchfnI9AcGQ8rhqYcytjkud+I+kpaq6R9wDMpUB7FV0S2J48A7seXmvJw7wA1ojdXFuQ7Ix0HCUIcFrvTPs6KqXe75DfXEtQ8Lm2xc+OWz7xm9DfbPkeo2s1CSmHpUg7WeRjNp7aoiJgFvy6+xZi8xe7nt8B7P87SHf5IbtLLpY9v2bcPjXJ8R/lzyXE/kOK+H/Dr9YDrGDZvZm
-  template:
-    metadata:
-      name: redoost-db
-      namespace: redoost
-    type: Opaque

apps/redoost/kustomization.yaml

@@ -2,6 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - database-sealedsecret.yaml
-  - auth-sealedsecret.yaml
-  - middleware.yaml

apps/redoost/middleware.yaml

@@ -1,9 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: compress
-  namespace: redoost
-spec:
-  compress: {}

apps/redoost/sealed-secret.yaml

@@ -5,8 +5,8 @@ metadata:
   namespace: redoost
 spec:
   encryptedData:
-    REDOOST_S3_ACCESS_KEY_ID: AgAsARN/0zM6asSlm+13UwKz2YvviQDwuvzPiP+Xy+kCi8VUdaQohzG0f7FfDhmG/0zvgc2EawNenf8QfUuEVYUMw/xa3orbvardL0RkOZN7dnm9bLm0LiuzRs6i5VgWSOBhCVZd3oMhlVyI2Pzbu09VtcTIqbIPrrrcrQzA5a9rIes8MKGEQbU3pdZILSKLFXgFWCqDGiex9ugkweI6jp9gk71hRzqpYOP9AA2df5kB0n+7HcIB4rDq7WlA/iXkCMH1NGhjDBMpRE/HyxhP0Td2WXqNsYKDM8Licq1qBnuSGT2FaTsCKXZ0X3ClFpbaXipzAwimqK4eg65tneT5NKbLnWjNZKx08scw98PcQzS4g+9l8nH8IIKOVq2+MuC+85e6yEgfkEjwknltEGSJl4VwdFUm5Ec2GVi1X9zWW4BzHuGWJYE/tj3atoCHfUnht3O8WVo1s4pSOMyInsetSlhV2YVMncOKVDHciY67+ih71jqiHqABGclbDzaQKFeXFY/e2J6o1tTRQ2ej5jxdjU+hdqig5/jsGqRc67t4oiOPEgEq4FmDTp27FGUIM20w3l74PC8vhX7GWOJfpl8DqvYgAJyYLO0hzSeE/Gl07/UZalq2Cinl0BwvROJ7kPVB4H+NqfbGl77AxMXWu49AUV3BBKG3xFI5eEVY9CRTL5lAY+WKW31543pgvB9lvYbq7LuTnvlOcKSwlXD0EeAWo4eyLuwtPOk0n8c26w==
+    REDOOST_S3_ACCESS_KEY_ID: AgC0A+pQKuYKMLfMPRAtL6a3PBEkwgghd7IbH8ZGhgU086s23NvbOBM5sHHkApqOiQ9z2LarAfvvKpBdxlQTjInxhqdJ1lW/zkWHokHhSn/L4ule/efU18a5gXsxNXN0Mon9PZrS9wKAFR9ZNiEDFa2/L4iUtCesUR/MneUFqqqibxiUgt2R8sMmRIzP9O0b8T7vnw1EkgyO4HWpWlLrGPnBryWA4OEj9CGLrTT7Z8u3Z2J5m43dELfmzdAH4gM3RQPXAzAMY+QyxnhtGA6x52OTcD8XxqB1lW/dWzTq+zCjnmRR5HbpWjeuM6ojlFJZoBLxYRRMZowMEKFX4egKUvGEDmSKOX5Z+Hn5n11dyRFhpKrMU9vy+utLvVtDM/rr5NqK1Bna0u40VdUUwpdoqAWUevw9yLld2QzOg06hjqQwpqVER7E1VTDKjVXveacaN7si+63abaw649eAaFhTitMEE9ORHZ7Fz3YZB5zdqnEQWZwzczJhhvqzNxP0pg1/JCEVrKYVfHCtuDoJ0BCeiuFPWU8lKYhYoxRzm6biWhdevM4o5CobnCedH/O+TDq6iPDDgC9iBNHIQjwfUAjjq44OXfl7X9+J3Q7xm7BYMD+/8LvycbBauFtOnkj32fyuUKF/EvoQF/AIQ3TX6rC/CkbIMT+m+mcAx75CB6hfpBFOMRKgpTT7WNR1zs6YrSEzNNQq95KvTIMVYEEKm+gjrnpv9mkCkCmSJPCWsw==
-    REDOOST_S3_SECRET_ACCESS_KEY: AgDEE69d7G2xfvL/SyMz4HbsYO6bilvv0lh7gtSgfGLSBK1K3Bzn4tf3h6xRFLlO/mhlQCiozWSB9TQdltZyDvYswYH23kEaPR5m27yudHK7nxN1G8I/uyKFzm6o48keU+SGCakutYJ3Mqrbicj/Ogi+5VPG8M6Yxh/hKYcMO9i3cJDoqn93Ldyv9jRty8q9nNhaZDs52di1p+1S4FOZ0+ryrIPVtdPGfM2KViFnLG3DEBqMkxHNegWGRjie+AVKY/MOqVE64I7t+XBYnjLfy4aRpGFHhEXhihkfGklQMMKFwlIc8OChs0RfPHTWHlbTg73Xmr9uDyUDWgAG7VPfjuQU6RfgkWCGe3WjLF/7hPZmfzR/S2nhPZzNugFRBeWG6Q2FJ+ACPoJQFCmht2JackU9X7HivJee3UgfG0q63Ja2OK35oiwmHcPj2Wfv7YGarmnMw6QRiKY6ZpQN3/mlUyWNPMnwoRrb+JWQJTkVrRL1lZloydgtFX1y25v3XYjR6jU0s0aN1jacxIVto1C5UgNhLBIjhebXBnqVlWn4nJzYTLZvKnY0mHv8sF2cEXZNi4wqa8VdifZjSriqJKDCnQSPX0Gvr9XTRiqRWFNzoTRr0U6AnV3/zlxJaBb21zXAY7QbpbzExEbazJjhaaSCGoCGhVsVFOdn2KydbZd0mFR/o5KUDR7GXMJj/6wvNsjduyvlNFxJgCwElhApHTWxtsXWYR0yFeuIuTfyn6hbTo8TMQqPqAGKowSst+q0DvOKz7E7P5HZrvFBGkucSr5JdIxY
+    REDOOST_S3_SECRET_ACCESS_KEY: AgCp8zFoy+Clr5qY/57jfSwYT44a2jwTFzHgOPoYfE6LXXtis40QjrteEjyc9oE4dE2IlR3wY85twCcqMEbJW24mkTbQf5E4B4V5XaUTi2XhMkrms1tfwaKJzYJiPfoS5u/WyrMN7LK/pqryEVGODKh/57PNoEDK/N/ab7w1iKfxGQQVuwDSCdsT3RtrinzKXKHUFsR4f3wpOAO9nh/53atgZ9MMs+6DFLmkdXvIfjgJ/PqCrtxKx3hTXFNhrwbDIUJFF/wF9SUy6C2CyHCycdeU5HJFSahCIRMZvFAhDrl0Ubsi/MFgWsQouj2q6VEK8VAWDttCJaiSf9g/KhELneKCYC7qo7e4PzhHhAHUGO5fILWxd7HySj4CxSiCDiF3kIqVUXo/sqlbgBNMvPb+NNqo19g27jcFZPh/AZZkuBSxsdmEYfgg1RAcYmwPGUxksRcj36yknYjX4pMxJNqVGDH1nLsplOa5b8h+evxMnjK6oNduRP96zHd+Qo4sC2ThBF3Ar8STJpbbJ+KgdW1HnHo38JYd0J8q/pcVq5xY3+VX8Gy8JSrb9wdFMZnb+iWmyL/GNwLIqqbZw1zcKF7Rru78fl8Y5VWDnrpbjn1buqDxwyFkDhcxX9WISoAPKXP9K2Cs5UOIKwu50cOAyA+cMOMsYbTnkvAuDMZ5aBPp80j0TQLu4luPPvKG1RumhYxGthmEpwQaPyXuJfhOBbuVrsiNlaCKe+d3Jv9l3Y4PVlTBJg7ZD7YpfLoyvt1Y9ELAI5qiUjZ4Ru5TxX2lIqZOoZ/G
   template:
     metadata:
       name: redoost-s3

apps/rustbin/kustomization.yaml

@@ -5,4 +5,3 @@ resources:
   - deployment.yaml
   - service.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/rustbin/networkpolicy.yaml

@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: rustbin
-  namespace: rustbin
-spec:
-  egress: []
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 3000
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: rustbin
-  policyTypes:
-    - Ingress
-    - Egress

apps/splitpro/cluster.yaml

@@ -0,0 +1,33 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: splitpro-db
+  namespace: splitpro
+spec:
+  bootstrap:
+    initdb:
+      database: splitpro
+      owner: splitpro
+      postInitApplicationSQL:
+        - CREATE EXTENSION IF NOT EXISTS pg_cron;
+        - GRANT USAGE ON SCHEMA cron TO splitpro;
+        - GRANT REFERENCES ON cron.job TO splitpro;
+        - GRANT EXECUTE ON FUNCTION cron.alter_job(bigint, text, text, text, text, boolean) TO splitpro;
+  enablePDB: false
+  imageName: ghcr.io/whyredfire/postgres-cnpg:18-sha-62e724e
+  instances: 1
+  postgresql:
+    parameters:
+      cron.database_name: splitpro
+      cron.timezone: UTC
+      cron.use_background_workers: "on"
+    shared_preload_libraries:
+      - pg_cron
+  resources:
+    limits:
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  storage:
+    size: 1Gi

apps/splitpro/deployment.yaml

@@ -0,0 +1,108 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: splitpro
+  namespace: splitpro
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: splitpro
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: splitpro
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  key: uri
+                  name: splitpro-db-app
+            - name: DEFAULT_HOMEPAGE
+              value: /balances
+            - name: HOSTNAME
+              value: 0.0.0.0
+            - name: INVITE_ONLY
+              value: "false"
+            - name: NEXTAUTH_URL
+              value: https://split.whyredfire.dev
+            - name: NEXTAUTH_URL_INTERNAL
+              value: http://localhost:3000
+          envFrom:
+            - secretRef:
+                name: splitpro
+          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
+          livenessProbe:
+            httpGet:
+              path: /api/auth/providers
+              port: http
+          name: splitpro
+          ports:
+            - containerPort: 3000
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /api/auth/providers
+              port: http
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          startupProbe:
+            failureThreshold: 60
+            httpGet:
+              path: /api/auth/providers
+              port: http
+            periodSeconds: 5
+          volumeMounts:
+            - mountPath: /app/uploads
+              name: uploads
+            - mountPath: /app/.next/cache
+              name: cache
+            - mountPath: /tmp
+              name: tmp
+      initContainers:
+        - command:
+            - sh
+            - -c
+            - until nc -z -w 2 splitpro-db-rw 5432; do echo waiting for database; sleep 2; done
+          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
+          name: wait-for-db
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+      securityContext:
+        fsGroup: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - emptyDir:
+            sizeLimit: 256Mi
+          name: cache
+        - emptyDir:
+            sizeLimit: 256Mi
+          name: tmp
+        - name: uploads
+          persistentVolumeClaim:
+            claimName: splitpro-uploads

apps/splitpro/httproute.yaml

@@ -3,11 +3,11 @@ kind: HTTPRoute
 metadata:
   annotations:
     argocd.argoproj.io/sync-wave: "2"
-  name: holyarrs
+  name: splitpro
-  namespace: holyarrs
+  namespace: splitpro
 spec:
   hostnames:
-    - holyarrs.whyredfire.dev
+    - split.whyredfire.dev
   parentRefs:
     - kind: Gateway
       name: traefik-gateway
@@ -15,8 +15,8 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: holyarrs
+        - name: splitpro
-          port: 6262
+          port: 3000
       matches:
         - path:
             type: PathPrefix

apps/splitpro/kustomization.yaml

@@ -1,8 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - sealed-secret.yaml
+  - cluster.yaml
   - pvc.yaml
   - deployment.yaml
   - service.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/splitpro/pvc.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: holyarrs-config
+  name: splitpro-uploads
-  namespace: holyarrs
+  namespace: splitpro
 spec:
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 1Gi
+      storage: 2Gi

apps/splitpro/sealed-secret.yaml

@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: splitpro
+  namespace: splitpro
+spec:
+  encryptedData:
+    GOOGLE_CLIENT_ID: AgDRctXaM2WUp9CYS1HQaxq1F6qJ6wyuV5PRK1hhSYCGCpZwId6mT/M+YCGiPnvAqR2W0L0cJ199ytZ5aV7UBrgbLG6XK7jN1txxpdWTSq0pONPj2jOrUvqdToA/6hUCsQBW6oqshbhjV/H53PxmKzR/t2zTQ0xoI64FK81INBsyaCY1gzdZQWYZCkmDhBUrvzfprcI6ayTvOtMhJkXMFU/TNielxjQtmRKnjz1wqyKZkvie7ZS2oEzU7R+VuuoMQVyL/N1pcu8rd5/WaJxJNgtG0oTFtJMQMCKvV80nXRWTXaTCGtpd4Ior+COgUW1ruzxU7HvrOMeQk/pwRPtVuANA5XUgwABWJH+RMmSDTsmqFlqaIYluE4swYGeR2dvEVWv4PN7YjBuJzYrWOCntp571JLw9jJ8ffCCEETQiEYc65ZMochp1rayZaHFJXAoorS/AbOK5fBYpdwM7R9KYl9tGxYzNcqzihezqb2hZuIIyEQnCtKPJl68TywiDXcUiftwlIhf56v2Us9nYaHRsIVstot1FhkrO2DqYrRxJ9/k8wPeJjPFCqrpx56y9bqRiyq4R4tfAKv/iHTZ2d8hVUZ1Pr/bc2pqwjxtjzBlGBXrAC4xSQWf463wk5IvY2dthRq0LZsXd7c8zV8QN9ZGwtWgWulNB/VXIsv0LoI7lmujWbCAGcis8helOo1wRgYE/NVeD/SEpJGEPkzx9XRuplj+00WsjOYmsbfvtQIcOOJbEtM3d6vqLd+SeFswSg1z01YFX6gagPhHCbDqfy0+DFkkM3QVsAPxKrBwT
+    GOOGLE_CLIENT_SECRET: AgAkBnqzqC9srhWzQA/q7ZfMpgfTy+J0on856vHPrIS8oe5P30vciaGlgkQdf1oMLA5ovHaSq6x9AEqv7HRzoeSrdUSjswZce1akAcXU+wA0mQGzVsmaTpCERAJ7GXWmSgsvIQNQXF5N6BLiZliueDiMIy3sZYAcoffrZ5l22mWOSBlHCXXZqZoP+F4Y4tQrlO28NjlWGo1UBf83JZ6TZMtK7IOuYoMDsZo/NlE1x0zj3beMm1VLvHJXRn1plU06IwlIKH0xEed2izff4FQ7f4Q3Dqmtbz6PhTdVqy4HQvhIrkAl/6IwQCZdTWHRdgv6fXQWs+ZftoeRMHFXI0xB3YfbLoqO8Q2kDqgxSOM8Xixdbabq1v8u0EVZCNRryb+XuWwG46xWNPVF2Nl1SIaeLxWQhFGEXTUf9IqYH9fQ1kpqIlj5IgEa1MUWsx1eE+vik1shT20woU7Lj21Zcu3RZob92qMVNZHheB2Lzkcw+dP1BwRIwXTiLXfdyDDHXlajnkvkkrrcwO62K4zEIIS/LyoLt2vdk63mfXKSz343pnpOsN2hEqJSTkCx3CFhB4JBSybSFrBtljcCDjK95dvsTQq8qZKEqLFZEQjRWXxsiR9aoNo2MCmPA+dDfvsJ7/GZ8mnjyNdLw+UCxrTiyXMI0pAgezZZZf96KPGUL+LnRbJiTHxxsfk+q2/nMZeU+ftZdV0F7zrCUQhkyJZwhYk2XsblyHiKsPCvLHtKbhIXVpwnLdXPgw==
+    NEXTAUTH_SECRET: AgCdNnXbHEuOlg1UnJii5eGJVfBZh5nWaybBODJJK3FbyhYPuj2KhGfNB/ld529FpddAEDv1IGWwKAOaSCkhSv1Nh1P2NZj37jpgbsHx8vw1omLLSkWqtRf1m4AhHhEwQoY49dlAk4AxSkjk5IckH8PbbRWFXx8Ns8kAGrJLrp6i7EbxrkI3U+hbEz93sQwRJo8XOeYCEodr7JPKoYHwy5roAwB0PmFL56bZFfuCa9yEje4BFxdQMrm0grSDMotTDH3nTF6irq5HSOEgqnL7Tt3kHW+Uaz5mvUZcCxAMUoB9q2mjTjm8fiprybVfMmCsib3epcZGrn0DiPZhihePkrfL6vTaz0pm1Nr7qkbtXFVY3RWgZjFpmDyAl/of7ddh9VYQVmqVAhfI610Czqqyou0zFuvlOXGlp1ljp7FNiwo+r02WxYoJ1leikB+CCnVxd/ErELA0AVneGUcWzoKG6r+OlDzsfV/gp2LXanAq2jKyeZ09ARhkLs3PHzkoGDaOF1Dr+3ZCidrfV+GRcnr73P7QEQNO6R+tEmL+idKiLr4uI56zrFg/Vb5Yxk/jMr2Hrfw7ai/nV2A+eqgXFQammCEZlDyCS8GPX8ULervbG/n4JmXXMUtGB9esM40cfTlsNhhv7sBC2P8QkOI00wvgdiwcPkOE+1i33Sxd1Vt20d8EP6TMfwhofQz2zYdYQEWYmBgiG+zX7mwwh3awuA5uH+ooA5vFe/aHPvMYM2rbTYDihEISJt1b6cbCiE8+Iw==
+  template:
+    metadata:
+      name: splitpro
+      namespace: splitpro

apps/splitpro/service.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: pgweb
+  name: splitpro
-  namespace: pgweb
+  namespace: splitpro
 spec:
   ports:
     - name: http
-      port: 8081
+      port: 3000
       targetPort: http
   selector:
-    app.kubernetes.io/name: pgweb
+    app.kubernetes.io/name: splitpro

apps/wireguard/configmap.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+data:
+  wg0.conf: |
+    # Based on the image's /defaults/server.conf. The init container adds
+    # PrivateKey from the SealedSecret. After editing peers, bump
+    # wireguard.whyredfire.dev/config-revision on the Deployment to restart it.
+    [Interface]
+    Address = 10.13.13.1
+    ListenPort = 51820
+    MTU = 1280
+    PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
+    PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth+ -j MASQUERADE
+
+    [Peer]
+    # macbook
+    PublicKey = xuWFr3AHPeh/gRO5NiCGnwHcr0e/8InaroXcY8S5eC0=
+    AllowedIPs = 10.13.13.2/32
+
+    [Peer]
+    # phone
+    PublicKey = 8VBoG0Bpwv1UhAOethIgRJXmaNWPErSWkqcfdjGmhHs=
+    AllowedIPs = 10.13.13.3/32
+kind: ConfigMap
+metadata:
+  name: wireguard
+  namespace: wireguard

apps/wireguard/deployment.yaml

@@ -12,97 +12,72 @@ spec:
     type: Recreate
   template:
     metadata:
+      annotations:
+        wireguard.whyredfire.dev/config-revision: "1"
       labels:
         app.kubernetes.io/name: wireguard
     spec:
       containers:
-        - args:
+        - env:
-            - |
+            - name: PUID
-              # The node's kernel only has nftables, the image defaults to legacy iptables.
+              value: "1000"
-              for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
+            - name: PGID
-                ln -sf xtables-nft-multi "/usr/sbin/$b"
+              value: "1000"
-              done
+            - name: TZ
-              # Only skips the setup wizard; password login is disabled.
+              value: Etc/UTC
-              INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+          image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123
-              export INIT_PASSWORD
+          livenessProbe:
-              exec /usr/bin/dumb-init node server/index.mjs
+            exec:
-          command:
+              command:
-            - /bin/sh
+                - wg
-            - -c
+                - show
-          env:
+                - wg0
-            - name: DISABLE_IPV6
+            initialDelaySeconds: 30
-              value: "true"
+            periodSeconds: 30
-            - name: DISABLE_PASSWORD_AUTH
+          name: wireguard
-              value: "true"
-            - name: INIT_ALLOWED_IPS
-              value: 192.168.2.0/24
-            - name: INIT_DNS
-              value: 192.168.2.1
-            - name: INIT_ENABLED
-              value: "true"
-            - name: INIT_HOST
-              value: wg.whyredfire.dev
-            - name: INIT_PORT
-              value: "27299"
-            - name: INIT_USERNAME
-              value: admin
-            - name: OAUTH_AUTO_LAUNCH
-              value: oidc
-            - name: OAUTH_AUTO_REGISTER
-              value: "true"
-            - name: OAUTH_OIDC_CLIENT_ID
-              value: wireguard-admin
-            - name: OAUTH_OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  key: oidc-client-secret
-                  name: wireguard
-            - name: OAUTH_OIDC_NAME
-              value: authentik
-            - name: OAUTH_OIDC_SERVER
-              value: https://auth.whyredfire.dev/application/o/wireguard-admin/
-            - name: OAUTH_PROVIDERS
-              value: oidc
-          image: ghcr.io/wg-easy/wg-easy:15.5.0
-          name: wg-easy
           ports:
-            - containerPort: 27299
+            - containerPort: 51820
               name: wireguard
               protocol: UDP
-            - containerPort: 51821
-              name: http
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 10m
-              memory: 192Mi
           securityContext:
             capabilities:
               add:
                 - NET_ADMIN
           volumeMounts:
-            - mountPath: /etc/wireguard
+            - mountPath: /config
-              name: data
+              name: config
       initContainers:
         - args:
             - |
-              # VPN clients may reach the LAN, not this pod or the cluster networks.
+              set -euo pipefail
-              set -eu
+              umask 077
-              iptables-nft -t mangle -A PREROUTING -i wg0 -m addrtype --dst-type LOCAL -j DROP
+              mkdir -p /config/wg_confs
-              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.42.0.0/16 -j DROP
+              awk -v keyfile=/secret/private-key '
-              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.43.0.0/16 -j DROP
+                { print }
+                /^\[Interface\]/ { getline key < keyfile; print "PrivateKey = " key }
+              ' /template/wg0.conf > /config/wg_confs/wg0.conf
           command:
-            - /bin/sh
+            - /bin/bash
             - -c
-          image: ghcr.io/wg-easy/wg-easy:15.5.0
+          image: lscr.io/linuxserver/wireguard:1.0.20260223-r0-ls123
-          name: firewall
+          name: render-config
-          securityContext:
+          volumeMounts:
-            capabilities:
+            - mountPath: /config
-              add:
+              name: config
-                - NET_ADMIN
+            - mountPath: /template
+              name: template
+              readOnly: true
+            - mountPath: /secret
+              name: secret
+              readOnly: true
       volumes:
-        - name: data
+        - emptyDir:
-          persistentVolumeClaim:
+            medium: Memory
-            claimName: wireguard-data
+          name: config
+        - configMap:
+            name: wireguard
+          name: template
+        - name: secret
+          secret:
+            defaultMode: 256
+            secretName: wireguard

apps/wireguard/httproute.yaml

@@ -1,23 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: wireguard-admin
-  namespace: wireguard
-spec:
-  hostnames:
-    - wg-admin.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: wireguard-admin
-          port: 51821
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/wireguard/kustomization.yaml

@@ -2,9 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - pvc.yaml
+  - configmap.yaml
   - deployment.yaml
   - service.yaml
-  - service-admin.yaml
-  - httproute.yaml
-  - networkpolicy.yaml

apps/wireguard/networkpolicy.yaml

@@ -1,60 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: wireguard
-  namespace: wireguard
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 8000
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik
-    - to:
-        - ipBlock:
-            cidr: 192.168.2.0/24
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-      ports:
-        - port: 27299
-          protocol: UDP
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 51821
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: wireguard
-  policyTypes:
-    - Ingress
-    - Egress

apps/wireguard/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wireguard-data
-  namespace: wireguard
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

apps/wireguard/sealed-secret.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: wireguard
 spec:
   encryptedData:
-    oidc-client-secret: AgDML2QiPv8lLkyYYOXVI7IY+F3F6x4AoJP7OwNWcFzN699HTvud78sYW1zs9P3BX8FfUArkXHZhjG07OyP5HYxtbUvv4t1IyJaMqg1NsBSB9F3QPEVoanrEIwfUbrzbIcCjD9J0RRrf7aBeAL+zTI1odEOFQhdXwrwEliombjLTcjMMBZGW8IVAQ8/2Ip+Vl8fIGpoS0kP6PGW7NZMTehxBMImyLipzJeYrg2gHN8dlHgE+TWKIuAxV0TSmWV+QvjW6ivSWEwDOabGvQ9GxH3DCwSvPM4kEm5SfFXodzyEvFVsK0MFyY/TvsIU8kursZrSWNlhu437ncjPp4H9X/AYikYHqUnx0hbLRqspIP8OmdNu4A3VdQjGVJcqwsSWmKBIpXrKaoO2GmQQWKKhmbFfgJaCXDmnPBG1A4ngLnNzFdG4JuT5zZwfQRLe0BHxkVbTaN2MtsU47G2dS55TXoJk8q54Gi/buarf0eNj515DsgiI/CqaUchp3I9U+SWC4cHtAF8EncC1qbfqtMTpI/mEsK+L3RxKZFq0EPXmrOLYbrqjA4H44l7cdg8/3aVxmILCh0wleytUuYnQG0u1+vNk/5H73F+RZQT2UbOzQZ5VVIvzT1vNgu8EAfX8+HWvbRANuGB+4hAdOLv73myL2qnxyz3N5btXFOGbjDjAkxeLKf/qEsAXUBPiBGPh5NEdCEgMSzrgvdtfzQ/BzT8i0xUPBzjVvXAQQckOprZAuz9IOq5N4Ug7VRFgktyDpzQ2acpcWuxeq4opfrj5PGM5rUPkv
+    private-key: AgCyimGRHeoQAc4xVkr09bpRHYtZBG2Gjc1IkOM9D/p+f7n7/Va2hJixDL1ieVBXufEm485MYcLV74j1dG6q/Xyad+Y2VsAlWGIFlC+1rCO0V/dEKGOav8bxxhcMV56YUDgNR4ZtBOnN5aLgq2P/72CIbRpa9I4ofNUmoMV+Eh50hY9oVJgdmeb6Dx+03q5Zkf1LTJZMxnYi5r6bbzznT1bqQM9gZml4N2b3cBBVrtLIBlPFkHeyxhmS+0ZnQgXiu+oFEkAvXLKB44AmerJ6UFYjX5ly933UzOm2KsTR4pIGHRsj6vZvjCb6cJUxCAhFOn9Nq+B984TeNTomCglYVc3p5XRVAsSVL+MBT1EfNoz9qSec8sHiufnsgHG6cre6DDriv0HD+yfg8tCK7IX0HbETb2aQXgNNFvdnSL5S6rqbffctl/ivfj3RsZmJCcaxwrWR6khmn6nzOkqNeKSMjmpAxSTdAlve6EFFWqvFz4D0LpYpk/73kyaWvczuzV//cGlYBwVOBA9CPCyAexdrQ78wbzn0zaCdo7yKqTQtgZestXnyCICUyrXm+1WQzd8W/lGHtr/hV7D3H//RQAGxnlWERvWCZlYIF6xkz9eApvWl72gE4cwzcgme+1+EkyPgSmLgtyh78B/kucEZC2Qy2chGJEAlwJln02HxbJ0RX8Bo1ko+kxCHzZl12zA02A1yzQGzEt7Oya9K/wrhWX8plYFK4Zq811yHmVqJEeu5bseCSi+O0tHmnl5vafRFyjw=
   template:
     metadata:
       name: wireguard

apps/wireguard/service-admin.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: wireguard-admin
-  namespace: wireguard
-spec:
-  ports:
-    - name: http
-      port: 51821
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: wireguard

argocd-apps/add-ons/alloy.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "4"
   name: alloy
   namespace: argocd
@@ -15,41 +14,12 @@ spec:
     chart: alloy
     helm:
       values: |
-        # Discovers pods through the API and pushes their logs to Loki
-        networkPolicy:
-          enabled: true
-          ingress: []
-          egress:
-            - ports:
-                - port: 53
-                  protocol: UDP
-                - port: 53
-                  protocol: TCP
-              to:
-                - namespaceSelector:
-                    matchLabels:
-                      kubernetes.io/metadata.name: kube-system
-                  podSelector:
-                    matchLabels:
-                      k8s-app: kube-dns
-            - ports:
-                - port: 6443
-                  protocol: TCP
-            - ports:
-                - port: 3100
-                  protocol: TCP
-              to:
-                - podSelector:
-                    matchLabels:
-                      app.kubernetes.io/name: loki
         alloy:
           configMap:
             content: |
+              // Container logs of pods on this node, tailed from /var/log/pods
               discovery.kubernetes "pods" {
                 role = "pod"
-                namespaces {
-                  names = ["garage", "postgres", "redoost", "traefik"]
-                }
                 selectors {
                   role  = "pod"
                   field = "spec.nodeName=" + sys.env("HOSTNAME")
@@ -67,22 +37,6 @@ spec:
                   source_labels = ["__meta_kubernetes_pod_name"]
                   target_label  = "pod"
                 }
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_controller_name"]
-                  target_label  = "workload"
-                }
-                // A deployment owns its pods through a ReplicaSet named <deployment>-<hash>.
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_controller_kind", "__meta_kubernetes_pod_controller_name"]
-                  regex         = "ReplicaSet;(.+)-[a-z0-9]+"
-                  target_label  = "workload"
-                }
-                // A cronjob's runs are Jobs named <cronjob>-<timestamp>.
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_controller_kind", "__meta_kubernetes_pod_controller_name"]
-                  regex         = "Job;(.+)-[0-9]+"
-                  target_label  = "workload"
-                }
                 rule {
                   source_labels = ["__meta_kubernetes_pod_container_name"]
                   target_label  = "container"
@@ -115,13 +69,35 @@ spec:
 
               loki.process "pods" {
                 stage.cri {}
-                // Changes on every rotation and would start a new stream.
-                stage.label_drop {
-                  values = ["filename"]
-                }
                 forward_to = [loki.write.default.receiver]
               }
 
+              // Host logs: k3s, containerd, kernel and the rest of systemd
+              loki.relabel "journal" {
+                forward_to = []
+
+                rule {
+                  source_labels = ["__journal__systemd_unit"]
+                  target_label  = "unit"
+                }
+                rule {
+                  source_labels = ["__journal__hostname"]
+                  target_label  = "node"
+                }
+                rule {
+                  source_labels = ["__journal_priority_keyword"]
+                  target_label  = "level"
+                }
+              }
+
+              loki.source.journal "node" {
+                path          = "/var/log/journal"
+                max_age       = "12h"
+                labels        = {job = "node/journal"}
+                relabel_rules = loki.relabel.journal.rules
+                forward_to    = [loki.write.default.receiver]
+              }
+
               loki.write "default" {
                 endpoint {
                   url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
@@ -130,6 +106,9 @@ spec:
           mounts:
             varlog: true
             extra:
+              - name: machine-id
+                mountPath: /etc/machine-id
+                readOnly: true
               - name: storage
                 mountPath: /var/lib/alloy
           # Tail positions survive pod restarts, so logs are not shipped twice.
@@ -146,15 +125,22 @@ spec:
             limits:
               cpu: 50m
               memory: 100Mi
+            requests:
+              cpu: 10m
+              memory: 50Mi
         controller:
           volumes:
             extra:
+              - name: machine-id
+                hostPath:
+                  path: /etc/machine-id
+                  type: File
               - name: storage
                 hostPath:
                   path: /var/lib/alloy
                   type: DirectoryOrCreate
     repoURL: https://grafana.github.io/helm-charts
-    targetRevision: 1.13.1
+    targetRevision: 1.13.0
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/anubis-operator.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  name: anubis-operator
+  namespace: argocd
+spec:
+  destination:
+    namespace: anubis-operator-system
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    kustomize:
+      images:
+        - public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
+    path: config/default
+    repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
+    targetRevision: v0.4.4
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

argocd-apps/add-ons/argocd-dashboard.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "3"
   name: argocd-dashboard
   namespace: argocd
@@ -21,4 +20,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/argocd-image-updater.yaml

@@ -1,35 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
-    argocd.argoproj.io/sync-wave: "1"
-  name: argocd-image-updater
-  namespace: argocd
-spec:
-  destination:
-    namespace: argocd
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: argocd-image-updater
-      repoURL: https://argoproj.github.io/argo-helm
-      targetRevision: 1.4.0
-      helm:
-        values: |
-          resources:
-            limits:
-              cpu: 200m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 64Mi
-    - path: add-ons/argocd-image-updater
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - ServerSideApply=true

argocd-apps/add-ons/authentik.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "2"
   name: authentik
   namespace: argocd
@@ -28,19 +27,10 @@ spec:
                   name: authentik-secrets
           blueprints:
             configMaps:
-              - blueprint-argocd
+              - authentik-blueprints
-              - blueprint-garage-ui
-              - blueprint-google-login
-              - blueprint-grafana
-              - blueprint-jellyfin-ldap
-              - blueprint-outpost
-              - blueprint-pgweb
-              - blueprint-qbittorrent
-              - blueprint-wireguard-admin
           server:
             resources:
               limits:
-                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 100m
@@ -48,7 +38,6 @@ spec:
           worker:
             resources:
               limits:
-                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 50m
@@ -64,4 +53,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/cert-manager.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "1"
   name: cert-manager
   namespace: argocd
@@ -22,49 +21,8 @@ spec:
             kind: ControllerConfiguration
             featureGates:
               ExperimentalGatewayAPISupport: true
-          resources:
-            limits:
-              cpu: 200m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 64Mi
-          # The chart's egress fits the controller: ACME and Cloudflare on 443,
-          # DNS-01 propagation checks on 53, and the API on 6443
-          networkPolicy:
-            enabled: true
-          cainjector:
-            # Only talks to the API
-            networkPolicy:
-              enabled: true
-              egress:
-                - ports:
-                    - port: 6443
-                      protocol: TCP
-            resources:
-              limits:
-                cpu: 200m
-                memory: 256Mi
-              requests:
-                cpu: 10m
-                memory: 64Mi
-          webhook:
-            # Only talks to the API
-            networkPolicy:
-              enabled: true
-              egress:
-                - ports:
-                    - port: 6443
-                      protocol: TCP
-            resources:
-              limits:
-                cpu: 200m
-                memory: 128Mi
-              requests:
-                cpu: 10m
-                memory: 32Mi
       repoURL: https://charts.jetstack.io
-      targetRevision: v1.21.2
+      targetRevision: v1.21.1
     - path: add-ons/cert-manager
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main

argocd-apps/add-ons/cnpg.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "0"
   name: cnpg
   namespace: argocd
@@ -11,25 +10,15 @@ spec:
     namespace: cnpg-system
     server: https://kubernetes.default.svc
   project: default
-  sources:
+  source:
-    - chart: cloudnative-pg
+    chart: cloudnative-pg
-      helm:
+    helm:
-        values: |
+      values: |
-          replicaCount: 1
+        replicaCount: 1
-          config:
+        config:
-            clusterWide: true
+          clusterWide: true
-          resources:
+    repoURL: https://cloudnative-pg.github.io/charts
-            limits:
+    targetRevision: 0.29.0
-              cpu: 500m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 64Mi
-      repoURL: https://cloudnative-pg.github.io/charts
-      targetRevision: 0.29.1
-    - path: add-ons/cnpg
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/kube-prometheus-stack.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "3"
   name: kube-prometheus-stack
   namespace: argocd
@@ -17,39 +16,47 @@ spec:
         values: |
           alertmanager:
             enabled: false
-          # Only node-exporter and cAdvisor are scraped.
+          # k3s embeds every control-plane component in one process with a shared
-          defaultRules:
+          # metrics registry, so each endpoint also serves the apiserver's series.
-            create: false
+          # Keep those on the apiserver job only.
           kubelet:
             serviceMonitor:
-              interval: 60s
+              metricRelabelings:
-              kubelet: false
-              probes: false
-              cAdvisorMetricRelabelings:
-                - action: keep
-                  sourceLabels: [__name__]
-                  regex: container_(cpu_usage_seconds_total|memory_working_set_bytes)
                 - action: drop
-                  sourceLabels: [id, pod]
+                  sourceLabels: [__name__, le]
-                  regex: .+;
+                  regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
-          kubeApiServer:
+                - action: drop
-            enabled: false
+                  sourceLabels: [__name__]
+                  regex: (apiserver|etcd|kine)_.*
+          # Bound to 0.0.0.0 through /etc/rancher/k3s/config.yaml on the node.
           kubeControllerManager:
-            enabled: false
+            endpoints:
+              - 192.168.2.5
+            serviceMonitor:
+              metricRelabelings:
+                - action: drop
+                  sourceLabels: [__name__]
+                  regex: (apiserver|etcd|kine)_.*
           kubeScheduler:
-            enabled: false
+            endpoints:
+              - 192.168.2.5
+            serviceMonitor:
+              metricRelabelings:
+                - action: drop
+                  sourceLabels: [__name__]
+                  regex: (apiserver|etcd|kine)_.*
           kubeProxy:
-            enabled: false
+            endpoints:
+              - 192.168.2.5
+            serviceMonitor:
+              metricRelabelings:
+                - action: drop
+                  sourceLabels: [__name__]
+                  regex: (apiserver|etcd|kine)_.*
+          # k3s runs on SQLite (kine), there is no etcd to scrape.
           kubeEtcd:
             enabled: false
-          coreDns:
-            enabled: false
-          kubeStateMetrics:
-            enabled: false
           prometheusOperator:
-            # The chart's policy only limits ingress to the webhook; egress stays open
-            networkPolicy:
-              enabled: true
             admissionWebhooks:
               certManager:
                 enabled: true
@@ -68,29 +75,15 @@ spec:
                 requests:
                   cpu: 10m
                   memory: 32Mi
-            serviceMonitor:
+          kube-state-metrics:
-              selfMonitor: false
+            resources:
+              limits:
+                cpu: 200m
+                memory: 256Mi
+              requests:
+                cpu: 20m
+                memory: 64Mi
           prometheus-node-exporter:
-            # CPU, memory, disks, network and temperature.
-            extraArgs:
-              - --collector.disable-defaults
-              - --collector.cpu
-              - --collector.meminfo
-              - --collector.filesystem
-              - --collector.netdev
-              - --collector.hwmon
-              - --web.disable-exporter-metrics
-              # The chart's defaults, as lists are replaced.
-              - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)
-              - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$
-              - --collector.netdev.device-exclude=^(veth.*|br-.*|docker0|cni0|lo)$
-            prometheus:
-              monitor:
-                # Collectors report more than these, like per-chip sensor labels.
-                metricRelabelings:
-                  - action: keep
-                    sourceLabels: [__name__]
-                    regex: node_(cpu_seconds_total|memory_(MemAvailable|MemTotal)_bytes|filesystem_(avail|size)_bytes|network_(receive|transmit)_bytes_total|hwmon_temp_celsius)
             resources:
               limits:
                 cpu: 200m
@@ -99,42 +92,7 @@ spec:
                 cpu: 20m
                 memory: 32Mi
           prometheus:
-            # Only Grafana queries it; it scrapes the kubelet and node-exporter on the
-            # node, matched by port so no node IP is needed
-            networkPolicy:
-              enabled: true
-              ingress:
-                - from:
-                    - podSelector:
-                        matchLabels:
-                          app.kubernetes.io/name: grafana
-                  ports:
-                    - port: 9090
-                      protocol: TCP
-              egress:
-                - ports:
-                    - port: 53
-                      protocol: UDP
-                    - port: 53
-                      protocol: TCP
-                  to:
-                    - namespaceSelector:
-                        matchLabels:
-                          kubernetes.io/metadata.name: kube-system
-                      podSelector:
-                        matchLabels:
-                          k8s-app: kube-dns
-                - ports:
-                    - port: 6443
-                      protocol: TCP
-                    - port: 9100
-                      protocol: TCP
-                    - port: 10250
-                      protocol: TCP
-            serviceMonitor:
-              selfMonitor: false
             prometheusSpec:
-              scrapeInterval: 60s
               retention: 90d
               retentionSize: 45GB
               # Pick up monitors and rules from every namespace, not just this release.
@@ -143,6 +101,7 @@ spec:
               ruleSelectorNilUsesHelmValues: false
               scrapeConfigSelectorNilUsesHelmValues: false
               serviceMonitorSelectorNilUsesHelmValues: false
+              # Generous CPU ceiling: WAL replay and compaction burst well above steady state.
               resources:
                 limits:
                   cpu: "1"
@@ -159,27 +118,6 @@ spec:
                       requests:
                         storage: 50Gi
           grafana:
-            # The chart takes one list of egress ports for every destination: OIDC
-            # on 443, Loki, Postgres, the API for the sidecars, and Prometheus
-            networkPolicy:
-              enabled: true
-              allowExternal: false
-              explicitNamespacesSelector:
-                matchLabels:
-                  kubernetes.io/metadata.name: traefik
-              egress:
-                enabled: true
-                ports:
-                  - port: 443
-                    protocol: TCP
-                  - port: 3100
-                    protocol: TCP
-                  - port: 5432
-                    protocol: TCP
-                  - port: 6443
-                    protocol: TCP
-                  - port: 9090
-                    protocol: TCP
             admin:
               existingSecret: grafana-admin
             additionalDataSources:
@@ -187,8 +125,6 @@ spec:
                 type: loki
                 uid: loki
                 url: http://loki.monitoring.svc.cluster.local:3100
-                isDefault: true
-            defaultDashboardsEnabled: false
             envValueFrom:
               GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
                 secretKeyRef:
@@ -223,20 +159,17 @@ spec:
                 login_attribute_path: preferred_username
                 role_attribute_path: contains(groups, 'admins') && 'Admin'
                 role_attribute_strict: true
+            # State lives in Postgres; the pod itself is disposable.
+            persistence:
+              enabled: false
             resources:
               limits:
                 cpu: 500m
-                memory: 768Mi
+                memory: 512Mi
               requests:
                 cpu: 50m
                 memory: 256Mi
-            serviceMonitor:
-              enabled: false
             sidecar:
-              datasources:
-                alertmanager:
-                  enabled: false
-                isDefaultDatasource: false
               dashboards:
                 searchNamespace: ALL
               resources:
@@ -249,7 +182,7 @@ spec:
             testFramework:
               enabled: false
       repoURL: https://prometheus-community.github.io/helm-charts
-      targetRevision: 92.3.0
+      targetRevision: 91.8.2
     - path: add-ons/kube-prometheus-stack
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main

argocd-apps/add-ons/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 resources:
   - alloy.yaml
   - argocd-dashboard.yaml
-  - argocd-image-updater.yaml
   - authentik.yaml
   - cert-manager.yaml
   - cnpg.yaml

argocd-apps/add-ons/loki.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "4"
   name: loki
   namespace: argocd
@@ -15,22 +14,14 @@ spec:
     - chart: loki
       helm:
         values: |
-          # Garage on 3900; the rules sidecar watches the API, which only the
+          deploymentMode: Monolithic
-          # discovery port can allow
-          networkPolicy:
-            enabled: true
-            externalStorage:
-              ports:
-                - 3900
-            discovery:
-              port: 6443
           loki:
             auth_enabled: false
             commonConfig:
               replication_factor: 1
             schemaConfig:
               configs:
-                - from: "2026-09-01"
+                - from: "2026-09-30"
                   store: tsdb
                   object_store: s3
                   schema: v13
@@ -38,6 +29,7 @@ spec:
                     prefix: loki_index_
                     period: 24h
             storage:
+              type: s3
               bucketNames:
                 chunks: loki
                 ruler: loki
@@ -60,6 +52,8 @@ spec:
             extraEnvFrom:
               - secretRef:
                   name: loki-s3
+            persistence:
+              size: 10Gi
             resources:
               limits:
                 cpu: "1"
@@ -67,7 +61,7 @@ spec:
               requests:
                 cpu: 100m
                 memory: 512Mi
-          # Memory limits sit ~20% above memcached's allocation.
+          # Memory limits sit ~20% above memcached's allocation for connection overhead.
           chunksCache:
             allocatedMemory: 512
             resources:
@@ -94,6 +88,7 @@ spec:
               requests:
                 cpu: 10m
                 memory: 16Mi
+          # Loki's rules sidecar
           sidecar:
             resources:
               limits:
@@ -116,7 +111,7 @@ spec:
           write:
             replicas: 0
       repoURL: https://grafana-community.github.io/helm-charts
-      targetRevision: 18.15.1
+      targetRevision: 18.13.7
     - path: add-ons/loki
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main

argocd-apps/add-ons/postgres.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "1"
   name: postgres
   namespace: argocd
@@ -21,4 +20,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/sealed-secrets.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "0"
   name: sealed-secrets
   namespace: argocd
@@ -13,25 +12,8 @@ spec:
   project: default
   source:
     chart: sealed-secrets
-    helm:
-      values: |
-        keyrenewperiod: "0"
-        # The API is reached by port alone, so the policy doesn't depend on the node's IP
-        networkPolicy:
-          enabled: true
-          egress:
-            enabled: true
-            kubeapiCidr: 0.0.0.0/0
-            kubeapiPort: 6443
-        resources:
-          limits:
-            cpu: 200m
-            memory: 128Mi
-          requests:
-            cpu: 10m
-            memory: 32Mi
     repoURL: https://bitnami.github.io/sealed-secrets
-    targetRevision: 2.20.0
+    targetRevision: 2.19.1
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/traefik.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "2"
   name: traefik
   namespace: argocd
@@ -15,16 +14,6 @@ spec:
     - chart: traefik
       helm:
         values: |
-          # The network policy allows no internet egress
-          global:
-            checkNewVersion: false
-          # Query strings are dropped, as OAuth callbacks carry codes.
-          accessLog:
-            enabled: true
-            format: json
-            fields:
-              queryParameters:
-                defaultMode: drop
           ingressClass:
             enabled: false
           providers:
@@ -64,26 +53,8 @@ spec:
                   - kind: Secret
                     name: wildcard-whyredfire-dpdns-org
                     group: ""
-              websecure-pixelos:
-                port: 8443
-                protocol: HTTPS
-                mode: Terminate
-                hostname: "*.pixelos.net"
-                namespacePolicy:
-                  from: All
-                certificateRefs:
-                  - kind: Secret
-                    name: wildcard-pixelos-net
-                    group: ""
-          resources:
-            limits:
-              cpu: 1000m
-              memory: 256Mi
-            requests:
-              cpu: 50m
-              memory: 64Mi
       repoURL: https://traefik.github.io/charts
-      targetRevision: 41.7.1
+      targetRevision: 41.6.0
     - path: add-ons/traefik
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main

argocd-apps/apps/applications-repo-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: applications-repo
-  namespace: argocd
-spec:
-  encryptedData:
-    sshPrivateKey: AgDIXYZfl1u4KR4YgGx8XHpiM1MXnvv39MJV07StKwk2LCsCamL31HDzaA34L5VV5wsnLEgx1CR7i9WMEd6lUyuQWG4YGI4JUgcYV8clMpu/Ih64io2rWs7TTLs1FUqrkLvGwx6aCVFYNQMOnDpY5+RJ63WC8JTM/z0rr16F/47d1BKrW0WVaEZcyy+AT1wG8Y+R7qNDxqND9W7X3+sQfBP+nI2WiTplDe3vbk6WTolKpofME+x6u70j2JpP2rfIhnttNv88qiM9CNssHqxQ4TlH1BNrI2SdnLwX6bWLvCqVKrj8TAh18yZzrkYy1wwI+4ZKCcTSUNsKgtwrrj/BmPEmQsxJ241e/uZzRyuT+VdOls2gtdpc1gz/sxlgRNALZd/BQcYq/XV3pe07STujqXoZgNjC92vRrVY6wPdycCmKHrGSyhN34KdqTi9lfrYc0MtI0c0T0BgXt+ButNKfSHt/2m4SZ8HGne22b3pIltsJP58R8XtomTbHa9VFfTWfiEhuKpwWzM/UsDo7PYhd+TdZFkTj9zfUrR1JluJLuFknUp3hpsU1F1HSyXLGtVmdKb+nD/7n4RTP3zGWNZfCRG3PqsAgR2TBwPKo+7RTq5B1BPqNXjoEWaI3P+divrkZT1PooqHuLEWJOr+68azSy04AnlhBzI06w/FZIgMSjV4adqizFlVBR5BTQgQULDSISYlMRoQz2Z1HUXr9JbqEZBHTwmcSgNilagKYM7dE5mLNXswys4IvlG+SxzDHgTCQH+7ZRS3n2prIZRWqHHhh1EcE7FChvN13HnzwY5PtHi8AQje6dRxCxliQ/nRrjhRQRM+4XQj4bI6wT+kSCjM71hTe/Zg7WguNoyc8Jt105X2YApFTCu6AIBNi5vGIqWXfAofoDvrBM2Flu0kVnbwOCrShh3SXuO/wr8mAdZC1DfbRNFnPNog0Iav4t2iju25YEk1a0SczpyjqVyJRU0IaZx21Ean0B/EweNCC3qt5++mVveuxSfOLJOnX/0mOkwNeJS/6jxiCU4IijDwUEW4FLMiz5yOXM3ktnNdPkauD9IP7py/kmdjgXSjwBr0mSRmzyQe8QaYUIsX15pZoiIdDcrCX8pf5ftzzxxB145SBajQW9YmAIh4DrtrGCpGYTWjd9AVEUYEIh3P0lxN/KtXQdsZvYK5/Gjb2MAeoFXlaussHTWNlULHEo7PDgIyE0oeeXN9qcbU/EJ4H47z9JOTFhVqLWdYECv1ueamHVAZ5CVQDQdQWBqVlOwX2ltM2g84GCiLMIng7WopZtDujMp1bwT3zzTblYXfx0gk6Gp1nNlGOHw==
-    type: AgA4zCPMAfGwpRf7SNkANByWaxs64jB7YKBTbb5Q1y+UF1u+/tEuYYAFySGRRffLPxjXWutwkcCJvzCaJn4v0KaUCT05HAyRPILgE9aNxa3NIAz80hkTBPDInakvrUq6AysKKHl5TvMsd6YCI40EM2aVrUYcEAwaNycFMaYQNXrfJeJdrSBjgLPqWLudos2e9U1yC8vqrfaCDnTCQitgxfVkD7YNhtfpKWUnMOdO2GDx+yOfom4KxUWSwnfvbXOgA+xmCYqpJ96TCEg6Jar5xcGsZuEluS8cMrbw+tSUqfsGYpmA4Q9KllloFTmNZrUi49R5MgE9dU5i7+WmOX6RbbSfI2scVACvnzYA7yKQMXI58ngwtTB/yYM24/ylV+6ltl2n8XDXSMJ7qZ8h4QJ0IOPAuehQTYy+SQLaVKYdfKzUoSi2mA+CHH948Ul6KbNiCbhv4AptlV4amg1PDITz4YmtOWh0rO9PxQFN92FY6dScoDSyACon1nniE9p2k/fF9AsagDoBLl+h66mreHH8KlzjlmsVTuq2Wdn9sCZKw0EfyH8u78Th8Kj7/tpAEKmjvt81YM6miZGgOT71Vg/ttluLqetud98rz/G7wLPKsonFGvrBCVvmJ+cSYs6jp/HNAY5pN30A0515vRutXDeo7Q0UUoOwxGdFRd//lptKZus/WrvyzBqKmGzArn9CLjWqpLA0Jtg=
-    url: AgBjKOHHrbW6YouHDudb2TOBBqQnvsK1FAZG+matWvjJcdCDzEHaX5libU103q9dAMzrEizYrRcy0TxPVn8frwblRcdOvRXL4RDzSaLxS5vnWW/pfCjk9O3imwG987jy1qiRgsiqXNDhaiNor0KCak/9oYiNjhwVzqmQJW3A6lyjwjYZO+1piNeQGn5oO1mIBJnz/dNw6lrtevSG5B785h9Jpo3n2UUbvFgOcPT4lOOxpWBETAvIo5o5fy4AdfKwHCBfm/GpAsXWyNV3bop6h117NVsXc+ysigjC0NIjCobf03J5EA9H1f/byuSyiUDsI1LVAtw+0YlUSvAXGYwVnnCLqxJDkIkrXlVtF18+kR9ktavm1Xkq2eIeL32yJ/v+WTcT9ilOhwEdfHin89l5Qhv4/VJL2CWlpllpZnHvgyD8RjeI0liW4v3HKZkiHbXmthNNrdCinJQJWpsvZBGC41NHYtFXd18i/iu29MwZ6Z7+dR/i5QHF/PxH3OH4ZB58Khuy7Y2BbKNK/KBVjV3Hm4hzHXtbEawPI4SOSyhgqTeD3eh2O5Xs7PQFkgbZzO2vOIRtRxO3F5oJOdGUhjWCLpi+gqcQhHsVodM+hYkVFsYMGBbGHKdGBX78e2q3QHBNSpyDLyoR5TOw6BzQG+C+oqlbcMwF+fkMzPT6nRbKmKtEdFqFZAW2Y6RA3jYf5Fn870wayZ/Hj5j8vhpcR6LW5DKamFkcGSZ7+ugAHEo9Tsx8xMfMaFqU1KeTUOI=
-  template:
-    metadata:
-      labels:
-        argocd.argoproj.io/secret-type: repository
-      name: applications-repo
-      namespace: argocd

argocd-apps/apps/autoregexbot.yaml

@@ -2,18 +2,17 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "3"
-  name: pixelos-applications
+  name: telegram-autoregexbot
   namespace: argocd
 spec:
   destination:
-    namespace: pixelos
+    namespace: telegram-bot
     server: https://kubernetes.default.svc
   project: default
   source:
     path: k8s
-    repoURL: git@github.com:PixelOS-CI/applications.git
+    repoURL: https://github.com/santarl/telegram-autoregexbot
     targetRevision: main
   syncPolicy:
     automated:
@@ -21,4 +20,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      - ServerSideApply=true