feat(argocd): Disable local admin account

README.md

@@ -1,40 +0,0 @@
-# gitops
-
-Argo CD manifests for a single-node k3s cluster.
-
-## Node configuration
-
-These live on the node, not in this repo, so reapply them when rebuilding it.
-
-### k3s
-
-The bundled Traefik is replaced by the Argo CD-managed one, which is exposed
-via `externalIPs` rather than ServiceLB. Control-plane metrics endpoints are
-exposed for Prometheus:
-
-```yaml
-# /etc/rancher/k3s/config.yaml
-disable:
-  - traefik
-  - servicelb
-kube-controller-manager-arg:
-  - bind-address=0.0.0.0
-kube-scheduler-arg:
-  - bind-address=0.0.0.0
-kube-proxy-arg:
-  - metrics-bind-address=0.0.0.0
-```
-
-### Image garbage collection
-
-Kubelet only prunes images once the disk crosses 85%, so unused images pile up
-on a large disk. Also expire images that haven't been used in 7 days:
-
-```yaml
-# /var/lib/rancher/k3s/agent/etc/kubelet.conf.d/50-image-gc.conf
-apiVersion: kubelet.config.k8s.io/v1beta1
-kind: KubeletConfiguration
-imageMaximumGCAge: 168h
-```
-
-Apply with `sudo systemctl restart k3s`.

add-ons/argocd-dashboard/oidc-sealedsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: argocd-oidc
-  namespace: argocd
-spec:
-  encryptedData:
-    clientSecret: AgBqp25ilSAdFoj5LmPESSi/5Gq/Cai4vmZs1czKXmohOAMq7HIRO+fLWn+wU5B7R44s0kQ2Xw1ohF2hzTVljsK31PIdYNLbblfxYduKIJLCW1Um3/fCyYC6WSAFlZnaEn1iGghvR468Bsh8KT3OFIx3R6L5fu1dJ3t7JYE557GtkLbD7EWD70q57itUa+2OdL+1XdvSXOrqSVYjBcFdbxTRTUtvh8LR9J0Mg+uRYsk17UInfCqT3FRQtwRGQMQs+UX/4AuKzyTjw60w2lcfIsm/SBGvG/72FENUt46XGALoXmj3h4DaZBCH0j2LHWi3c+1psKTEXner5jw00Xa3eNOBKoDwIoEOIyGjIrhLf60d9Gm9Fp1weqcf8JTJdO3sXd4RXleUT+2zsu4vIeIXShXgCC/dz03kSXpPcM4/4XG/hWfu7Xgffc72Erdqbwj2SFpksVTQp1mWrhVu01qB45AwcaySpUovdYEm4DWhq7eB91sk8zhmHCNaDosnOlSjd1UD63L9Rg4y+objdVNEKODhFueSWh/Lb2wDQIxq3dR8Apy0cqSmrJ8QrJV8eAtsupHfn7Hg2zTvIM4jnKV8zQ+Jiut+Kpb+pC8jlcJPRfp6k3lpUjP9t95q+T8CVfvCMyEw8u0w9OUpGhozUMbW/BlP6tsWaJWKLnocIROxYPh3Rf4UtJ8Ol3qEW3Wkc+i6FyrIUlEGkQAad7USrADTx14Ge/XfZ6KO+Yt3FgyS8884u9dH8egkcEYZbHiZweAAd552JwIZn8gj7oUPxq8UQtNK
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/part-of: argocd
-      name: argocd-oidc
-      namespace: argocd

add-ons/argocd-image-updater/ghcr-sealedsecret.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: ghcr-pull
-  namespace: argocd
-spec:
-  encryptedData:
-    .dockerconfigjson: AgCRsZSHP+T0U4pLck8AJ++dCb47OklXOgediZXPUSENy2/W/o4ooDgr+vP9GmSMoSm/5FBahmiSF8WYth0TYL4bdTKMQfnFO4kAOxk5QXuyyaKL+ZxL3XFfKRUeVD4m+HFJrvUsHC36TeJy0SYwkaS5isWdNTPFPdNRhXQ9OiTKQlL2tPZgOzk48CH5wDCugI3uC6/1tuzoeNzbIWRFpbkDtwhdGBqnZIiZZhOliXBV5wGnEcPKpxBnE21PNBsr2A8/lisuTsmcsyZDj3uenLjcdITdTs57sss8HPEI9u+cIuNFCZVO/URtJEV1k24oEr3CAPJojic6vT6jS0Ow9H3VEJpEObAN4E02+yC/gZjkLOBSO9aq77SzVRJpTxmcuW4s2U91hegYzS33H0jBCB1EJ5y/rYZUFrdBQnr16gENbMo8HuYf0jnogDvyGjd4Kf4HWDl97yiOv2xdm7Jb3MBrgyCQSw2uU4QpvgwGpTCo8j3LrfqQjBZRyTn/HplLO+zGkQKcqsNosZ0a+fm990gDWEgBuNjf/2iVLsYMJrz8da3Fu4k2TTtzxtAZ0eFJbxa97CRC3d/4nx/vS/S3zTzoXhp2XHdlG3RfurrKKtxeretRlTtbTM8CjahMB0/oLgBKSaNs5gEtvaATKe8jBfAw+WHxCFJC+0Jxj8IfDq0KWv2I1OO2r+7TK+o2Ed/7SucJQd4e4NQJfWQW/xiq4RL3StJdO3WXcICloslTMtE9EaZn/w/dx98bLRus9mrkom+tPSHw63tHPn6C4B75Ya8qA5LSBylMEZXg8CG5xfqmR3C0F/c4XCYerfbzNg88AIw2VBsAgW6aySCkZCa9rkaCx5AyzblCVQxGZ+PpR0RdaBkuT2hXoWHBZZu9Dmhk6Qr1HyqCBaV2DmsYFcYB+pfHUKzT0BAWO7BdbiLFil0V779JZw==
-  template:
-    metadata:
-      name: ghcr-pull
-      namespace: argocd
-    type: kubernetes.io/dockerconfigjson

add-ons/argocd-image-updater/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ghcr-sealedsecret.yaml
-  - pixelos-applications.yaml
-  - redoost.yaml

add-ons/argocd-image-updater/pixelos-applications.yaml

@@ -1,16 +0,0 @@
-apiVersion: argocd-image-updater.argoproj.io/v1alpha1
-kind: ImageUpdater
-metadata:
-  name: pixelos-applications
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  applicationRefs:
-    - namePattern: pixelos-applications
-      images:
-        - alias: app
-          imageName: ghcr.io/pixelos-ci/applications:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-            pullSecret: pullsecret:argocd/ghcr-pull

add-ons/argocd-image-updater/redoost.yaml

@@ -1,27 +0,0 @@
-apiVersion: argocd-image-updater.argoproj.io/v1alpha1
-kind: ImageUpdater
-metadata:
-  name: redoost
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  applicationRefs:
-    - namePattern: redoost
-      images:
-        - alias: api
-          imageName: ghcr.io/whyredfire/redoost-api:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-          manifestTargets:
-            helm:
-              name: api.image.repository
-              tag: api.image.tag
-        - alias: frontend
-          imageName: ghcr.io/whyredfire/redoost-frontend:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-          manifestTargets:
-            helm:
-              name: frontend.image.repository
-              tag: frontend.image.tag

add-ons/authentik/blueprint-argocd.yaml

@@ -1,51 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-argocd
-  namespace: authentik
-data:
-  argocd.yaml: |
-    version: 1
-    metadata:
-      name: ArgoCD
-    entries:
-      - model: authentik_providers_oauth2.oauth2provider
-        id: argocd-provider
-        identifiers:
-          name: argocd
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          client_type: public
-          client_id: argocd
-          grant_types:
-            - authorization_code
-            - refresh_token
-          redirect_uris:
-            - matching_mode: strict
-              url: https://argo.whyredfire.dev/auth/callback
-            - matching_mode: strict
-              url: https://argo.whyredfire.dev/pkce/verify
-            - matching_mode: strict
-              url: http://localhost:8085/auth/callback
-            - matching_mode: strict
-              url: argocd://auth/callback
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-      - model: authentik_core.application
-        id: argocd
-        identifiers:
-          slug: argocd
-        attrs:
-          name: ArgoCD
-          provider: !KeyOf argocd-provider
-          meta_launch_url: https://argo.whyredfire.dev
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf argocd
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-garage-ui.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-garage-ui
-  namespace: authentik
-data:
-  garage-ui.yaml: |
-    version: 1
-    metadata:
-      name: Garage UI
-    entries:
-      - model: authentik_providers_proxy.proxyprovider
-        id: garage-ui-provider
-        identifiers:
-          name: garage-ui
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          mode: forward_single
-          external_host: https://garage.whyredfire.dev
-      - model: authentik_core.application
-        id: garage-ui
-        identifiers:
-          slug: garage-ui
-        attrs:
-          name: Garage UI
-          provider: !KeyOf garage-ui-provider
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf garage-ui
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-grafana.yaml

@@ -1,38 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-grafana
-  namespace: authentik
-data:
-  grafana.yaml: |
-    version: 1
-    metadata:
-      name: Grafana
-    entries:
-      - model: authentik_providers_oauth2.oauth2provider
-        id: grafana-provider
-        identifiers:
-          name: grafana
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          client_id: grafana
-          client_secret: !Env GRAFANA_CLIENT_SECRET
-          grant_types:
-            - authorization_code
-            - refresh_token
-          redirect_uris:
-            - matching_mode: strict
-              url: https://grafana.whyredfire.dev/login/generic_oauth
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-      - model: authentik_core.application
-        identifiers:
-          slug: grafana
-        attrs:
-          name: Grafana
-          provider: !KeyOf grafana-provider
-          meta_launch_url: https://grafana.whyredfire.dev

add-ons/authentik/blueprint-outpost.yaml

@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-outpost
-  namespace: authentik
-data:
-  outpost.yaml: |
-    version: 1
-    metadata:
-      name: Embedded outpost
-    entries:
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: mounted/cm-blueprint-garage-ui/garage-ui.yaml
-          required: true
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: mounted/cm-blueprint-pgweb/pgweb.yaml
-          required: true
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: mounted/cm-blueprint-qbittorrent/qbittorrent.yaml
-          required: true
-      - model: authentik_outposts.outpost
-        identifiers:
-          managed: goauthentik.io/outposts/embedded
-        attrs:
-          providers:
-            - !Find [authentik_providers_proxy.proxyprovider, [name, garage-ui]]
-            - !Find [authentik_providers_proxy.proxyprovider, [name, pgweb]]
-            - !Find [authentik_providers_proxy.proxyprovider, [name, qbittorrent]]

add-ons/authentik/blueprint-pgweb.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-pgweb
-  namespace: authentik
-data:
-  pgweb.yaml: |
-    version: 1
-    metadata:
-      name: pgweb
-    entries:
-      - model: authentik_providers_proxy.proxyprovider
-        id: pgweb-provider
-        identifiers:
-          name: pgweb
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          mode: forward_single
-          external_host: https://pgweb.whyredfire.dev
-      - model: authentik_core.application
-        id: pgweb
-        identifiers:
-          slug: pgweb
-        attrs:
-          name: pgweb
-          provider: !KeyOf pgweb-provider
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf pgweb
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-qbittorrent.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-qbittorrent
-  namespace: authentik
-data:
-  qbittorrent.yaml: |
-    version: 1
-    metadata:
-      name: qBittorrent
-    entries:
-      - model: authentik_providers_proxy.proxyprovider
-        id: qbittorrent-provider
-        identifiers:
-          name: qbittorrent
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          mode: forward_single
-          external_host: https://qbit.whyredfire.dev
-      - model: authentik_core.application
-        id: qbittorrent
-        identifiers:
-          slug: qbittorrent
-        attrs:
-          name: qBittorrent
-          provider: !KeyOf qbittorrent-provider
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf qbittorrent
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/blueprint-wireguard-admin.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-wireguard-admin
-  namespace: authentik
-data:
-  wireguard-admin.yaml: |
-    version: 1
-    metadata:
-      name: WireGuard admin
-    entries:
-      # wg-easy requires email_verified, which the default mapping sends as false.
-      - model: authentik_providers_oauth2.scopemapping
-        id: verified-email
-        identifiers:
-          name: wireguard-admin email
-        attrs:
-          scope_name: email
-          expression: |
-            return {
-                "email": request.user.email,
-                "email_verified": True,
-            }
-      - model: authentik_providers_oauth2.oauth2provider
-        id: wireguard-admin-provider
-        identifiers:
-          name: wireguard-admin
-        attrs:
-          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
-          client_id: wireguard-admin
-          client_secret: !Env WIREGUARD_CLIENT_SECRET
-          grant_types:
-            - authorization_code
-            - refresh_token
-          redirect_uris:
-            - matching_mode: strict
-              url: https://wg-admin.whyredfire.dev/api/auth/oidc/callback
-            - matching_mode: strict
-              url: https://wg-admin.whyredfire.dev/api/auth/oidc/link
-          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          property_mappings:
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
-            - !KeyOf verified-email
-            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
-      - model: authentik_core.application
-        id: wireguard-admin
-        identifiers:
-          slug: wireguard-admin
-        attrs:
-          name: WireGuard Admin
-          provider: !KeyOf wireguard-admin-provider
-          meta_launch_url: https://wg-admin.whyredfire.dev
-      # wg-easy makes every user an admin.
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf wireguard-admin
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]

add-ons/authentik/httproute.yaml

@@ -1,37 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: authentik
-  namespace: authentik
-spec:
-  hostnames:
-    - auth.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    # The ArgoCD Android app posts to the token endpoint without its trailing slash
-    - backendRefs:
-        - name: authentik-server
-          port: 80
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              replaceFullPath: /application/o/token/
-              type: ReplaceFullPath
-      matches:
-        - path:
-            type: Exact
-            value: /application/o/token
-    - backendRefs:
-        - name: authentik-server
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

add-ons/authentik/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - blueprint-argocd.yaml
-  - blueprint-garage-ui.yaml
-  - blueprint-google-login.yaml
-  - blueprint-grafana.yaml
-  - blueprint-outpost.yaml
-  - blueprint-pgweb.yaml
-  - blueprint-qbittorrent.yaml
-  - blueprint-wireguard-admin.yaml
-  - httproute.yaml
-  - referencegrant.yaml
-  - networkpolicy.yaml

add-ons/authentik/networkpolicy.yaml

@@ -1,57 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: authentik
-  namespace: authentik
-spec:
-  egress:
-    - to:
-        - podSelector: {}
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 5432
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: postgres
-          podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - podSelector: {}
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 9000
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/authentik/referencegrant.yaml

@@ -1,20 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: ReferenceGrant
-metadata:
-  name: outpost
-  namespace: authentik
-spec:
-  from:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: garage
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: pgweb
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: qbit
-  to:
-    - group: ""
-      kind: Service
-      name: authentik-server

add-ons/authentik/sealed-secret.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: authentik-secrets
-  namespace: authentik
-spec:
-  encryptedData:
-    AUTHENTIK_BOOTSTRAP_PASSWORD: AgCdmFtQtxaSvL+ggv8kdkufOxVEhBOPMWEKmv0k6LpakDZdXDKBEdcb4bj8eYSbAePTpoPbSraV0GxMxw/D+Xm9o0JbbXqW+G9MfxDTJDE8n1eFkw/bRjq2gIZq/MNRH0ORBMpviQeAFnzt2gfcvu3Fua2RIQji1JHR67d6xTtzGTIunyte7UFh1OIDr9JWE+6mfjKVuebbWq1qUXq5ScrWf0UYjJ/qHJiMjM7NZeEq8v9D9uYZoXoZj5Ew6BRP+UWGZOgoulxgJys5mdAo4k6NMYapT8vEyyyOmzDlBYPG0KucQgiVHBwW8UaBvRQ3WES/xYgD44fwSIiLwtFsU0rCfDQXUMlbA05wvcy8u0Fq8v8xKCWZhpWpxKzaLHRIFL9QKfRmil60nvwYferjVRtfObdY28hU+/vh/LDJ6NMj5d5APgQ/1/otX/XQ48Ezrmo2nZqhqdbFKlJq9eSukcfB5KARvKrY7tvFmGr8tyqqqn2eAeDlcy8ivNomF9sIqYKVadtv4UlO/SjwTM0UEUyN2tIGTWBGWI6kDWKFjUtjsJTmMSTKFvTHyd24sUa8QskZgGLqMmF1z+Z8upVK3qgo5EKjFvvT9MekVZp+gj0eD9dZreEs8QeScw0+Oxl+ksrp6bJWXwh/A05/QSkPQm7A1Fx7KoVRdo2PVEJun7Jk4HuOrYXG+EAvDE0A66psM1XntLPdUlHbdt15a9JxMrTc4LI3ARw9TFDi9tL89G1JMQdBJGi63AOuOtLPVXm96zI=
-    AUTHENTIK_POSTGRESQL__PASSWORD: AgAlxWe8VpLJ9qzrJJqIBbWgctSdBBjx8HUXVqLQtZx1zWURks7YsB8RGdBYO/o/aQ42Q3EI/YLGiNdvm+7M+Bmbmg4GoXTxNujgfg8W4BZ46Z2g1sq/4mJhj3Bx/fiRAL8QaqJNbSiSmGoCRXuwseuiqDSrEn69ly/Y+wRlV22ZyPqa4vU/cesOFVYu6EAWKhS/6Af5TrsxEVwFPQUmOpsMGTxHV4GSkbYiXAjq9Rr2JkgtmISDiSGTFB6QcITF5QzdaAKaDym1ol/j2VLAXACgesVvUs3cFtRCprusXctUtNZdURriytUn7UusbeB+7YeG4hJohgGRZne83OkPd2RyYj2XyS2t7G5vV83WDFFBsOkvXQDGlnfSgAovyTX8hpUbwvWq2nkpRm+NhJYyryXR9QRZcnUdf4LZgSwDWasy1nUwTuOs2W6YIsdN3yV+BLq+yC77vDRrdlNbibc54EycuwDPzMnqazlGoPrxO53li/qGJN4v+et1cfevk3dXguYrOH7E2Kmqh0nAjp3mojoPfG+1RTzwRoiMjaLxEbtkLWzq/gBJTsVdWtTq1CpfEVT47Todc44lDmtk64OQffxQbq+ryaR6q7V8bRynsTYPJVFi0+VD5mjdmWz5IDDP5+fCMb6xZD6oTqgVoFV3zWSAj05J87Ok/lR99xCU0WqxYrF6o+3Bvg5i9D7flAw8nrFmuNc7G7SXgcQu2QIHfOikVXL6WScJl1Ycu9v38KvtZep5XjzGgHQ2SvfkulhaSlU=
-    AUTHENTIK_SECRET_KEY: AgDZtbDVvUGwkMw+uBUv7CyPd1lNrh23svotEiD9v+8gDaJlE6P4r1qLijYn1dqH063RdmmW3wndlohM/MjAXzSJbdRX3hv5Dk6Rd2fJKZdOiGuHFNRTLXsVwe1k0JwyweOzdBYcjHnfvSwEpI1ahFEtsmA9QhJ1HOpMxoMyA6oBWGkcjdO888wrL7EkMTYeAtwtIdnqA45X4Zqi7hhRdtZjhWBZ0d3pel1105DAxd1vyiK1mALvXhfFI3ixKYyU3Mb9q8O6KXHrv4JqOW/Zz9OQVpf0/yVRxv2xkYFvgaj66xW0KcA5rVp68NSDEGE1O4a/W2B09n1vtb5ZRml2597j0/36/wYkl9Q87jFEBkXi2xfDUTBHlm2ik8DwcOK6f54j2sHmWJMywPHsBYBvxVdRFQMxXXETQJWaas5ToL78HzFLsL3uuoez7umFMXtta3Dg3t6AqC3NwbWqicKgU8zJVPWNJAoLr9wrmJBOBLXgMHGnowLAkfNJNwQIAu2SaQwLpOZEfTkyKc+HBm6/rM++IpvCg1KJXGoUPbAq7qt97t8d0ev2JdHs3kMU8G5PnNfE+nf/6limWxp29Z/vXdMZ0JHWk+ivCia9yrdP0IXEqvSAuewEniKY+nYWlPZpJwX6kNpVcSK7DTIVzv+l9vcSPrLnkjwuzmnd+Sv4lA0cYkwh0uZ+00FF/0RVCEj8OP/c840bINdsSX13BXkaeeA2InZFWvC5PrjNKY9RIb1k2Hyo2EGS1ZTuIUNMFN/XORlBC2IdT0Tld1LpmKL8GuW+2SLJUJRwv23SmmAFWhPljg==
-    GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM=
-    GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ==
-    GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA==
-    WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti
-  template:
-    metadata:
-      name: authentik-secrets
-      namespace: authentik

add-ons/cert-manager/cloudflare-api-token-sealed-secret.yaml

@@ -1,13 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: cloudflare-api-token
-  namespace: cert-manager
-spec:
-  encryptedData:
-    api-token: AgAdOsht6DLr8etz8DyU3JJVzoinxnldvBWzS/GBJWzDvAUKw5O0Lu8JpPEZTVMj97uKs16YZsiDCwODBZSD2PJZUAmKwcaWFgCSqBjnWsaCgsEW4Fo9i/SnovgzIPRsc8Q0BOaGZ/85j2hsHHX9lGQZdzLvPFqtR8oU3gCQyFPOJnOFwegUUavf/OzbCsaSd5+g8RZdB5tGdoScw0rlpV2rMff3IqBvAG/drLj4zcjq1vviC0XF5E79rKu2wLPmVVXfLxt/hpO431OCxLyoBJ/2drb16hqUv0yrFVykllfnVu2YxMg7Tzu0m0F6QHEaIu3FTyTQyhX5iG6a0hjYjlmUY3wkenm6V+bc9/Z2w45cYkXwyjumjTzjGvofIjf4pV8F0jYlYcobnY0w8cfij5yLo6WcMuYWImxF7j+94cmANVgFhZkhevSpwFE7uP9x8KakTGHd12NTNvJE8n1hYy7vS7giJGy8TSKPoFr6B2793m532aVR4EeIF2BfU4zENrcr6w5zWQRvmh/UPYj0fd61kefIRorjt6Xt0ydwzgEE7ggxFYN/6Pbn8ZNOwQvGIppHVZCzH2IGh147Pmg/U7RQsPzWRVshhlr4sY1cBA1PGsdOODuGuvtVTR2EJ/AoL79X8stMXOxhv0/bzRiAhHS0sg4H0xp5z5x8g/xSva6KY0o6IKgBEbGDuIa1L39VNu/5TeP/+68ln76zJiWlO6W3Ksl4jwk+ALLCo2U7OXqTk/4HJygn10mLnlvF+YlfIfvq1a/61g==
-  template:
-    metadata:
-      name: cloudflare-api-token
-      namespace: cert-manager
-    type: Opaque

add-ons/cnpg/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - networkpolicy.yaml

add-ons/cnpg/networkpolicy.yaml

@@ -1,41 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: cnpg
-  namespace: cnpg-system
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - ports:
-        - port: 8000
-          protocol: TCP
-      to:
-        - namespaceSelector: {}
-          podSelector:
-            matchExpressions:
-              - key: cnpg.io/cluster
-                operator: Exists
-  ingress:
-    - ports:
-        - port: 9443
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: cloudnative-pg
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/kube-prometheus-stack/grafana-admin-sealedsecret.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: grafana-admin
-  namespace: monitoring
-spec:
-  encryptedData:
-    admin-password: AgDHA/P0QjtI0wgwOJTWOtRf49kKuqmX6sMCB4Vsk8LpGhFMYWgP8pnXxTAbV50qTnqVdY7GQfsabcWWaYDV7FTH3oRtAHbV+gplabbhlxIF3o+lwunkGcObbex9PrCI/9/qX4DL/wOVLTftlOKHzyX2+ajGnufDMuF3n4axiKAJNGiKiuawQIhksV4EgaGPtAhiInQUte5BylwlKIciTl6eiTDus3B+DVW0ubsX5VPVKRnJj2jKKM1woc+F3/+aSVKDzavjX2zKrptltWUgaY+KPIwuEsYB+kzy9JwtgD189NdGR+3f4zQNJ3pX+p9WzfhocyXdEiFAGPdqaPP0E4mMSd8WPpmdsCiFGN6aeu8vJJQOONyC/Bm63em+BJk1AaGWm1XgwC+GauUdkqAHNiva+XQpqIEBI20ddHJBN8HyS1xZajg2JI3Mxukfph0WjPoQ9kqhAkFjIfoIv1uvusL7fDAXhmAyp0s23f67WTzXB1ZWEyRGbgPZIoC0eHztILRIngUuC3L14/aTOhiTxcnX4VVUAJyXy1tM+NM3KCL6T7pQX81VnFerfzW+VeIzSpIU7AIaXuBf60d47j88Ff7Zm2qp257L0ov+sMY8jp33v8Vx4oB20h2bqdGbCdt4NWeD0hCBAU26vaFVuiUmZZuNuLNQqsCABa7cE86+BlRCVG0KXgylrFMNjE1IvgHj+LbazAWFQ0kSKpXKyD/AT0bX3ZNUQlL/U9jDMSuNTzYCjMe/znsQ
-    admin-user: AgB0Uxo17KMXzvE/IbxYE9M6xDN30OXhQ66hD+MD1fUmNriResa+iGpCknByxOWDtccojz6abbVTJBw/ACjWGWDcmuafrRmkXcy6/l7gcirb/TVubUlyurecr9n1Iqna2Ip4/5IhEnBuVzx2e5xe5r0npRmWI0qeFN795OO6++2I3rZUR8lUMpywTs6oyGSKKQ/9qOCaN+bARIvja4fxGw6mzPNkIHS7MAOsiUElNft8fmT+JufSfQ0npvxgimvsQCFyfxQjWwZwX+LLKSesPAcDD6iXQvaR51NCfwpfRptfom/99QeIXjv0OyBysQUWfZyYNx3I8VKOEWXLSvCafCQVJV/tuHkWob1hVZcaSRZxJolnSZQ3mQ4hgYxfr9QZp3D4rQMgpzvqsJ/EwShwWEFqrOy353X5PNvJhQTB005FGky9yumYpiJjtAyX1QWeM9wBedZfKYUi7YLV9YXiXk91n13nQxfJ/HRRZFvqnCYtTXFRfX8PGbYF6aaW2nop3xcaDZ932y9fZQ9Q6AlasKUm+qCfkfl6dUOfVHftJRLpvm/60GLw5ylz9XTHS1EEPJAPpty8YExuxYWdHn5RoCbRHjKyQWxckKjFG6qZ7LcQpQuitSqwzcCqE04n/naWLoKJpMJhI0Ecs1hYai7LCFKNqZJm9HqncaeZ9SZAd4jquKOoVIJAJMyGDdzLQFkuq/7Z75y9fQ==
-  template:
-    metadata:
-      name: grafana-admin
-      namespace: monitoring

add-ons/kube-prometheus-stack/grafana-db-sealedsecret.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: grafana-db
-  namespace: monitoring
-spec:
-  encryptedData:
-    password: AgAGsDkcxjB3fakl0/pOZF/ej8gxCo7BUac0LJxfRR106PA4V9n2otOAiyVhmN45sNE2pscm2vDJdHtv5fWaR7AyZLaBk3dSn8at5vFh6Zgx20KLXWXGUrPaJLD07fuvNI4fgmFqEHnWsYUiO35mBfr01s6gTJPPr+y9b9LUzAA+WCuJERNwt+hFwmRDkI8rUvwr2Jy3TGKAJFJCXK1vkPtsGvIi8zHONlo+DI1uEH5qFECzScjXy4zEwKd54VoZtmS9F+QCJhXeGxy28v00jYCjPuIN0vhbzlJbLxDfYRskOuIxU88LWbGd9CDse0ZQvNW0i4cZbhL4Xsr/rCYeQfVMjc9eC//h5hsF7FPtKp589/lnC2jnpSYUfAz6sORY5elmg9QgB7yin6ItOCkVTBLZ3KPicOzu9oVLks5oTb1h2ndyNn3ltThPUo3RQpqOlq70HVpeB5cnn1Vdlty7/DJ8EtQSpVl1Zh26xTSsK1BLabs/sEVKRT7D1qyFtUT7aZDD1e63giFJIZzOiO6i3gaeTlLUyUmj5XlwfI0sTlTVIn0v4af1d/rgIUWqHYw/LMxYAF/x1M8LIRwtFjpWDYH4QuB2Keu0vMcTiErL+OGfM06izLntIzdoNM96TEj1dpLOHBxAh6cGNj6K22AzXfaToDcSpdO/yVzQPuzIWwr/joiEakUHCAKF+wQbI5vtO2suZTadSlo4T5M5clrIDkRTht5d2p4DNBaSG18N0T0yoic5RqQyUbOdSkepyWbWJuiluOXi5/X0gRG1DUBtNkWR
-  template:
-    metadata:
-      name: grafana-db
-      namespace: monitoring

add-ons/kube-prometheus-stack/grafana-oidc-sealedsecret.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: grafana-oidc
-  namespace: monitoring
-spec:
-  encryptedData:
-    client-secret: AgDYt08vksKi/llySruExrqYKajxYNy6qlSze2pUy88XZOftNv/HEQrsoe5pcDK1fTBDgrPQhQgbX3mjD7I9psSVFrA6/tw19MQZK9QjyClz/92rGOf/iW7sqKJJ/rUYydPyPva48DwTvg/peGmUDleodE1bfogKrHfz36fJdop37KeTi8k0UZoyNQK0o/FayliyJzp9oX6rlJoa26szmQ0JP9/akBd2JTAruNw1JbOdmFx8GpIGU3Bl8uvbcDQwZ4LuGxn1hOiPutXuA5NTS8xrC7GnLBPMtAvg8etZr5JL6ZLh/cGPGyN7tWpjqrJ4Y9hyR+ryapZh4I6/uRrRG8BpqXILUri0T2CB7/VSFrRka2b3CWtrlUiaCYDK4d5UF1I3K9x7WnK9rWNDMx9hxOQ+4hL6wFhX9k3nfDH9yJ7C8+4u4jTJVOfE01HbR5d2ZBfvP8sEO8sAePgD84ViRVcAAZ2LmW9aPrMdNhlQXf1ODDOnj4FaXP+yZIEq+fqsiyQtLDNBsIwDDJgCv4l7ac6NQKbpN2rfEfs4UFk5g8Jj3TfvpXieFe4+VuUyAwy/7npvxuAn50xrcjAo/m6cyEgJ76oyK2tdHM44m5CX+MwMhNIVU1Mmuq4oZ98pRXx0f1xptcwcXiFV2Eor5lKmNx4mDaYDDgbFrPGJ8w9k6gnDsYUnxP5LfAhpcwFxQcSyhj2XdbSnP+mZio59W0+adGQoksNuZjF72COME7ijNREsAmUJ6d9EKffQsH8zf3rHb03vzNWVzofgOKDTHyfNy6bdiZgezxGjNdcgFixdU1Fqjw==
-  template:
-    metadata:
-      name: grafana-oidc
-      namespace: monitoring

add-ons/kube-prometheus-stack/httproute.yaml

@@ -1,21 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: grafana
-  namespace: monitoring
-spec:
-  hostnames:
-    - grafana.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: kube-prometheus-stack-grafana
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

add-ons/kube-prometheus-stack/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - grafana-admin-sealedsecret.yaml
-  - grafana-db-sealedsecret.yaml
-  - grafana-oidc-sealedsecret.yaml
-  - httproute.yaml

add-ons/loki/s3-sealedsecret.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: loki-s3
-  namespace: monitoring
-spec:
-  encryptedData:
-    LOKI_S3_ACCESS_KEY_ID: AgCy95N0v+X9sAZ6eLZ1dT4x/TZbZdJdKDBdoB1EB0XD69KtjRnTIp6fnK7fWhJK8LBQMinvses1ZT8zxjXoYtP+eP/UMF3A5BPKp3GtwWqgGLWWcDEdRIPryf4isovw/5JRV7EoaS2GOqmXrGmzqW3S5B0CkGBBfp4vE22ClkONw0lh8RQorAHnHAQ5oBjdnUwcudKkqzCUpymZsLEU19TFx1xuHrI1b9pPBDUZKJc5sRQeJpMh0TOmP6G21SHvoVpfGb91nX7rFqt5uCxwXp00rWTJQDLmrBHITTzw/regKbtDz/hnow/Rmw9VvrKeh0olIxUjDwPfRFLalu2OKmV1oa60ta99Q5OExqQKKIWjOyOHovBAtpTP6q6z0/mMg/O0qoj+PyW6OJ8Ojkf7zYJAEyDil66ijALwXQd6bARjnePcrrmNCFcHVDIKRgraO4ZJDkPdfekKdCY9nepxGGdYDbFcl+CgieiKp5C+DQ2MAurAiWVIy07gfc0EwTneTIZa6gJsL1extnD1QMxF+Q51q6v4raTyvydMg7q2fcJNWs9E8c3buVJ+xbyuTGdotqaEgKgL9h7AGPznuXLBEv3jsZ0DZzooaXQr9e2eSOaj1Wdj9fBTkTDwtcCQOkWVTzQv0jdRzHkyadKaCkSLEy+wFvyoCmm90I1v41kUNAKb+OfErQF2oneR/kFvCRR63fHkrqeLlpfYX0yu6yWOKhDHN7WsQ6wd2s76PA==
-    LOKI_S3_SECRET_ACCESS_KEY: AgCR6N449J9uv9ZIb1CCZzlEMIgmnnWWGiYqDj5awSzun/j7nnU5CiqY0Q7YNUztKI2y/0TQAHdrS9Q46d3c27ZIiCwDJGK69w6Bcc8XPotzFZl7htRvc792CZtx9OShqLYrltoGvmNCLB1AY5wnxTJPQJ7p8Xat9GJA7CgRHerwhfhtuT3vKGRVOkjpQ5tRDaIYGQO8o7Tj2eaIn/dBwMgCVlfd2x2XLS7RzV8F+DTQ+94jpS7h+zJGsnEqH4nEO40OaD87ZTn8CnHlw9H9TL9shu8dNVULYK3j5Z9vHHPjBQ5oiTBdwtayJ0lBDOjimlMMYXiJhczsoR8PwYG7TNL/OZZIF8uMvuZX7lFLa/15W99XhLZSKoTbtYNT2HAzWNLM29unor3eDBebwZGyVu8VzQVECtU1/6EGnY0enMpldxUhJnVq3YmifZ74lktIcLy9g96lIYvJs10OrMZqMf7ANr74T6tLj+kDvlTS7AZF+27m5bK7Da3Uj15qvLsxox5XYsTfZa82Kz9XM67/Dif5PdGz3LCkVJHKBpSbAwoy54NqaIIlRrl08J947o7AR7M6T+L+kbU8JTREH0bbnAIgFvkBZow0LvL0rNB6I0A5aSO9jrMnb04I876Tf2JyRX0pLhtovo+253I3kQf8X9S49suYcJeTdATKtIMC2sE5wb23AdFeHLZz603HobieozAm7X5sDCaXQSROHUMPF2+f2sRifTxcryPP9YhpBZvm7zuqFDSjfQI3dtLrl8I7/Ohbn3J6whP6rgSqKBQaLS+s
-  template:
-    metadata:
-      name: loki-s3
-      namespace: monitoring

add-ons/postgres/authentik-db-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: authentik-db
-  namespace: postgres
-spec:
-  encryptedData:
-    password: AgDLpRHzrgu7ZjiHPa6Ryk1SJ7/hWlN50lKj6vwUP8IXWhsqKD75eniNRVEkogcsL4bxoL+xD5PK+A9p3MQe7gLlBlH0EJd0f5J3tSN+scxFpYxwjR8Dma1+sIlC2l87rD276Vr9rqXNe9x83ooJ6nHSDPGMidEryUzNUNzcObjG53BgQRW39ZzjHIlju3wt6iRcAxalfRC3v2mTPJyYaiz+He9ipO6LCJ/sv/po4QloASghBUK4zUGHyn8UCQzDuhQ3nnYZCyFG4T4ey8XWL53pFopTzWpRn+4g0yQXI+qvb28kfy4L8QvNgRhIzoWYMLQVswVVvzRE2y3nrkWRhG3Z4FgJSfGuOOR6obXboWNA008d4Q0In58O7lTxh+cwDNzGRY9WrWmFhx9ib1b2O729I+Vu1aTUa7IkaYg5BpMLuUjEiY6DfVZW+OvvQYPd6+a3mhitjk+NwVGZBdR20lW3bz35SY63yLfDrA1bBex2iq4jLGXEBlJz+loAU+yko1zua2RYC/tgfJpyU9NrSy+9ti59I8e0+I4o9YkJ2VmVtcoFd6L0ZOmdayw4r6hDtB+EHW6Wz0vnIrwx3fxMjSaXEvtNjZOVeKVvm9Cv2qJqTJGcRfiUeSbqEXtti1tlwupTe3bBXfotV1MqjmsAUJehhdfwYscvdmo60XMKJheyoAfB3LQw+uAg6CLtmfe78W9IUK23ofFfgtiQwp2/3gXmmp4XPAEctwXe//SaZWbVTdl5bKEiNvrrqGEI0zdcWfU=
-    username: AgDRt25giEz0pQQNgaKjvHh7pM5PKgp+LasT7uBRtkjdzvPVgjnmYjo5EIGMv16VGk1AzxoHk/gI+ERlVGACzrOoi7n5LoTwqmnbcw/AcsBB2TM18KdFKzMjJFZ7S65+lC2y1jt2fOaiTdlQ/OzU251x9NSiHPnLBw3K14M8kD6Yyq93kN2q78o9gD06KjXWGmbnADH1H9gJSCwSJmLMS9WWri0Mr86l/JgMwVCdEoDKOFwlqQWWr8SAm1P/5q61TyIOPjjUe1AMFMSZTFezFuchf6NBieztHN/JW5nmPWSc43aH5u1zjjaTJu2qk3ipSN5BBCkoKZ9boW/wqy4AriRJfitq8LxIObAFgkJMHG5RTjtxU8j2z8oKHll9UxO0yRSIkdhBI3h6iJAqDmi75bH+RIfdx1kiT3g+nkXsmR5/ptBORyNejppeSYsh/jptdJNtzjmBlGlORtLX9Ah8I3Hj/gr6x++GjwphYZLlwjVa1S7vSnWwpdGKP/0RwBNMFeqf8PerN/tp519b96toja9QyA0y0lJzh9XmMcfOUKYamg2i31tn+4ab1GOGlMGeck/MQ+3G4skJmEiCMvxQjGSOuNjL9W1DnSvjPsK8pNnJ5ndUCQatu1a04psQ0dJK/jVluwuIm34u3lOmisWEoTzb9Y2PYUavIpkPt5be0qmCh9+r5xdL+gBLccGdVdrB4zQ7caW26Lp76WE=
-  template:
-    metadata:
-      labels:
-        cnpg.io/reload: "true"
-      name: authentik-db
-      namespace: postgres
-    type: kubernetes.io/basic-auth

add-ons/postgres/cluster.yaml

@@ -1,49 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres
-  namespace: postgres
-spec:
-  enablePDB: false
-  imageName: ghcr.io/cloudnative-pg/postgresql:18
-  instances: 1
-  managed:
-    roles:
-      - ensure: present
-        login: true
-        name: authentik
-        passwordSecret:
-          name: authentik-db
-      - ensure: present
-        login: true
-        name: grafana
-        passwordSecret:
-          name: grafana-db
-      - ensure: present
-        inRoles:
-          - pg_read_all_data
-        login: true
-        name: pgweb
-        passwordSecret:
-          name: pgweb-db
-      - ensure: present
-        login: true
-        name: redoost
-        passwordSecret:
-          name: redoost-db
-  postgresql:
-    # Each app role may only connect to its own database; pgweb to all but authentik.
-    pg_hba:
-      - host sameuser all all scram-sha-256
-      - host authentik pgweb all reject
-      - host all pgweb all scram-sha-256
-      - host all all all reject
-  resources:
-    limits:
-      cpu: 1000m
-      memory: 1Gi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  storage:
-    size: 5Gi

add-ons/postgres/grafana-database.yaml

@@ -1,11 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: grafana
-  namespace: postgres
-spec:
-  cluster:
-    name: postgres
-  databaseReclaimPolicy: retain
-  name: grafana
-  owner: grafana

add-ons/postgres/grafana-db-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: grafana-db
-  namespace: postgres
-spec:
-  encryptedData:
-    password: AgCS2VPTseFFkdtaDAjYv6+9M+s6ndiezfWjV+OyPTPurfHJxLFkUlPC8gnZkut9gRhz1jsakP91an0aFEZTWHlM/amvSkomUWbwxKw6l9Co1U0IjK6PUPWKkQtLA++vFaL40u8yHFMbMLkND3oLPqNadcCGl+cmLgmSq5VgEayaClx4MPlhSBFYBvpJJ3B/CkK2odnXYO1aSeBIKPQFIlbiooSWjBA0CzJ9gQQFSnEVkDqHfkd3nEVHaziCdhpOCDyH6twQlafMqUjIbVKPJ2yd2dZSJZRLh6t6FY5EHhTh6PIbniRJ3ZtX2uTaZJ/tJF2af3QfRMUJ6go4r+16IKM/Q1ZrOcJfa7Zz+9RoC4d9dkl30hysr88WX2+GHx1E+beEd0v0Kv5IR8CZlbRyQV+DYDgwjFD9ALE37EMhpkCyb1qi1ulhl+8LIXLB08nedbIqqvPrmjUd3+y1EpuATeCgIsaVeACxBN2iUJ+JjVOFE/umnSgEGVctSIQSl4kZz/SFpS1Ygy0yrVOSmt9rtvPaWSWlg8yN4TTli1OKCJreyLDVSXV+/Pf+3UoN8p/SR7r1cC3jb4KBy61O/7jovMgO3XuhYHtUyJdrgp0h3DS116yBtFVomGKhCRMriLXb7VG9zD/spgYpmikPMrMABm9OPaLOBiKMEz+VN8Nd7cXZ1/us6kV77lSUInZV4osall09avYn8NaTN93hIS6J/Xb81b7yuH6Au6p13Zf6dkefEF6vu/g3m0eP3ZlgIkroF1rNe6IrkzxA0U9dDvrr3ayB
-    username: AgB1nXmxGuR6ObktViN4tvpH9W5B2HdzDVAwd4dtv0nBSGkS4NXA5B65BzF8NpWRVcnbS5hr6H0KfnAWHguDGL3/pEU6fdam3At8F+2i0oXSH9Pt+C2SxEcH2ecRHK+7VqNgJhd8j9i89G8DQGAgFjWj9UpfOCwr65G7UrHkomdBgitSFQD0dXMPJ973ZSlRZOxECT8NKjmgMX/iHztBszIms/ACB6u4Yfg64nAZUta1/Ky95ZSb5ZgrqABE+GLgRIKngAhr4OlpiVZelsTz0ccjCU4bT6a4ZqiqkbDLS19nO2rOSMDsnxgqoVBRF1Bz4Ry4R3e3jpQx4xBQrV4x+FFCymEi1rpZ8KQCrRf88YD+A+jRsBGnsB79wcaq996zw2tQ3kZd743C7AM9ZzXiNuGVGlhXqld6IbvHzyh1F9X02+diPVFftAO9owPEiTBcZVscj6RREmkOGcYHLtjhCghzHR0iQZ1DvazqyPSyUuvKyyXcX5m1b0DzgONqEgdmHD+saZZbAacQakUdoOS1hGLGgExaXS1pLV20eSIpoAJls9WbRXCeAIfWbN2MV2y1BUUDvmIAkdkocQbthovl2NeOy1FYVZZSmS6jY4zv59PDXFx2HMcNsj8qzZu4gDlEfngY5L+L6Lqr0XQKN250gYEkuduYaPoftCiaThMKCc9eJkAlQ9GdvrQrW49wBcXnErvFVmfuNcWr
-  template:
-    metadata:
-      labels:
-        cnpg.io/reload: "true"
-      name: grafana-db
-      namespace: postgres
-    type: kubernetes.io/basic-auth

add-ons/postgres/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cluster.yaml
-  - authentik-db-sealedsecret.yaml
-  - authentik-database.yaml
-  - grafana-db-sealedsecret.yaml
-  - grafana-database.yaml
-  - pgweb-db-sealedsecret.yaml
-  - redoost-db-sealedsecret.yaml
-  - redoost-database.yaml
-  - networkpolicy.yaml

add-ons/postgres/networkpolicy.yaml

@@ -1,72 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: postgres
-  namespace: postgres
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: cnpg-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: cloudnative-pg
-      ports:
-        - port: 8000
-          protocol: TCP
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: authentik
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: authentik
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: monitoring
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: grafana
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: pgweb
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: pgweb
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-      ports:
-        - port: 5432
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      cnpg.io/cluster: postgres
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/postgres/pgweb-db-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: pgweb-db
-  namespace: postgres
-spec:
-  encryptedData:
-    password: AgCCnUlPp1buEwCQDC/q1Fy8JHfi5QzuUCMoIXJoi5xgJewkI7ti0JctSrJJvdvS0QUm7se5s85tewKjsA1tIGrC8/nsSSeGbNmqRXS5BbGVdr6SIQhExTmVNdQqQwoyYtV8/ebW4ntt+HrIdgO16o6nsDb5lXblYguZps535SqwSN6vRLHhD3+Wg8SBjHZV11i/9w1nufy4KhgW5jlBhosKOaGVpgH33OQdsDMvkSF5FcljgeUm7R+R5sBYXh5VfPpEjsBB0zi8nDzSNS8aDVrQuv3aFeNnJ4vgBRV8a8/VclaMO9RqXgnl+HjHczbEau+x8AHZ19lLVXJ3rxi4itgOGXevVGEdHi+i+WJX3yfakGrleBneqkbY4VUuuu8T0l1wveLxRGBNwR39xl+wSZU8skDWoDh0Qdgcxpiez9Ewit3s9WE7SALtdUhVdwBdzZVctqZMVUeUDDBGYk5cyTZmRAMR0oBYAHSFD+C7+oyVjJsnZOp4sn/1q8vOOZzLeMu640tyopCChL1eIqbUxz+c0WsVXOQkIZFO2XErkLi0mpf9/rksRc8jWPZL3xTqcgQmGPujpm116K6nclf6urgghj+UW2KWilZRD2M1qXFEi4UdyDFPMs9bOMqymuk0zr8bM2+xJUvaC5AAByjFOEvwoqrXMp/55+4OhcEXkce482Ohl22EF9UznwegpxgcSvDVsdvA63nqkA6/ScYVf6vOJMV1IV3V/xrCmCfvrgzw7oOdfLMFF3DFlK7b2bcwdm7tJGnjIVxRKEk/Oac0hcmb
-    username: AgCrlxpjKHYriSWpb27Yy244lRX8YJFTWFxfT6Zpf/FG3nJ0BmcFRCzADbE9+E82Uugbsomv7Bx+GG3PbdzZGZJkxnGptLLIMIXbFlRr0W7cKFCWasmti8CW3KmVSp6YSZ/QR17GPmEkehFnmooK5DGhxZJcrK2+yFhN16JtCh/XGuXHVwVGMZMcVm8mKWcPKgH1yCfxQfFCk/xD8+3FySTKz1B/eyaUhaWncL8iCaMQgTd4G9YUomL0ykqwu6RzO/UkC7taq0dnvSg/XC6NDfZJ3juqdAw86RagJH3H41T41WM42ItXHCVy8XEAkJALZO8+caJC1Aa8kqvtPQh+5ParKpQK2CGGoIpcy8gicfWsGC2Ohtmoma0J37Ha/ur4BUuEbesnrvkYGDyf+j6rwJ1tA1Ff5w1POeySqRbpK8M7pEwLNTA3dNzhqBfY8sLdIwDx6W5ElBDz/481IzC1vKgNCaINjvCIvT4ZMHMVEwaAHxTyjv/On0Gi/U2m38Qnu+IxZXC/Zi1LPvFCCE3ieVHOKA4gyxooKIriORzxzxZbD7hvg+o4Dhkd6hxWRYfpIMZBQi6Ov7jHzY2VJroJ80wzsLXFLNwP4pEpSjcQsmus/ErLJGwHUeWYASo5cVmBdrbtQEDWGSFm2pi1FSCLnC/7/eWsPJqqS0tHCT35+Iabgk0EbXEPHgE3ShR7b3j/+qwhACLktg==
-  template:
-    metadata:
-      labels:
-        cnpg.io/reload: "true"
-      name: pgweb-db
-      namespace: postgres
-    type: kubernetes.io/basic-auth

add-ons/postgres/redoost-database.yaml

@@ -1,11 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: redoost
-  namespace: postgres
-spec:
-  cluster:
-    name: postgres
-  databaseReclaimPolicy: retain
-  name: redoost
-  owner: redoost

add-ons/postgres/redoost-db-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: redoost-db
-  namespace: postgres
-spec:
-  encryptedData:
-    password: AgABXpIKEczwyJR1ZLvcmtcQluGi0ACDO3SCC+D2OfaSxpUF0ZtmE0b5ngq2HmYj7GPMZ3vAEaJ42oXDgEiS8Teq9ACxmCIo7XMeA5X2w6w7RCmhgQdx7N3G+nL0fO5l49URckk8xDZVFCSo4wjbtmjQrdes5CbMlImtG11byFAyjs5lBAN9niJZ2tnJqJhpEvI9/6St0AlVjhsRhwvaV0zlVBtKFcBvSKemcBHkTA2gPBeJ3xmizuc4NsJHhCriiOAhJ+IA19eBzvN/bmfSxdJb2F1LdSQxlLDstnuO/dJDKkvIul6TrWwtqRbCI5tM3K0lHbGeeDmIRVPmsK99Kw3FAoSSKIZ0u3FTXqMF5mi9+abJAxHgD/JYn0Ecx/09Hp4lUwEWK3RIqmbfq6ose3YcSRULJeksSIQtGsOmkE0LxZkQV1F15lOAWL9QhYTDXZbD2JTnkc06SLSk2THpl9o0+F4ZNI+TpLHGASIH8nu95qVh3u7odwjaqe5Czh/njIGw7zuh718hLQtXi7P4soAj46Db2Gw9ZjSw412LGfU3ETDjeIeA4wQXhp78HtEn/vsDRMgx9EQH/726Y3BehdEzpx3g95zBvyT2T04UPc+J+K0zwp3c4rLmkyqxlXOq8NW2p1huQsdk8QTMojCep73k8VSzKpq9i2I9ktWTPJbiXP1KpLA8q0J6awgFD3c1IjYoeeOptfz0kR5oTQa8syTdlj4QVYrxopWqGhK7Cn2G4zwc1Gv1F2sO+KL7/KUe+Z/vp4kICKdL6JfQbUJf4WAU
-    username: AgB7DGwIppwLvtb61d9cn/FnzC9bwAdhvk0XR2BTiO4EaA9py79Y55Y0pmSmdi167MCfsQNBZEYHV/pD1RncdzHbMV+rKs1Y9Q8ghFUcuTaXC03tkYfZX/JnwdKAaqhyMqGkycyFWsVip7i2uoodJ2M0QhuD3L6dgXeq6rFQhrc5GjL/7bWiKcYY6X82qbYToJCHAHzmZ6lXcRwGqtV9TcC72CtHgP6vsBTaTZLadptxh9xI89SiLej/9m2D1lhSshJ6K90BTeaLVqeR19hP/VCOltnQfeV2GfJgBAfstTEnTHpqtGuPct+zo/IvbFnnjLmcNgVwzCerk6O25mgIuOQxkQp/gnoswnzMojPzwWnKsl5mrlrjkYRuGrFZjykB6th/xat/VarHyMJUpKlmNcealkWvy9TfHzCyQtCHW/fwHiWJ6W2/Cvf6ABBDl5kn0oj41l1Ekm8zxR7GCoucd/iAvizWJ8V9d4g/P28gBl7UI+WDFRkKcYATKZ2s6P60ORXj+aeYnoV0s64if+Er/fdbYXdSo7YiZVOtKy3nGIRsq9pl17QM1GXNmKNcpSE3SwKudEwIKcLSKZ8oCAn0gm2KwGGbJ6sRWu2+zysxgcoDnmpZje4SoO+xXLKDJ9NMCI1RBmDByk8IoNxn6efQXZesn1TQd0QqdjRF4+yXxPgpfzjK5TBEFx8ya8LMZWlhU2dxIQpJusV1
-  template:
-    metadata:
-      labels:
-        cnpg.io/reload: "true"
-      name: redoost-db
-      namespace: postgres
-    type: kubernetes.io/basic-auth

add-ons/traefik/networkpolicy.yaml

@@ -1,39 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: traefik
-  namespace: traefik
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - namespaceSelector: {}
-  ingress:
-    - from:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-      ports:
-        - port: 8000
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: traefik
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/traefik/wildcard-pixelos-net.yaml

@@ -1,14 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-pixelos-net
-  namespace: traefik
-spec:
-  dnsNames:
-    - '*.pixelos.net'
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
-  privateKey:
-    rotationPolicy: Always
-  secretName: wildcard-pixelos-net

apps/bentopdf/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - deployment.yaml
   - service.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/bentopdf/networkpolicy.yaml

@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: bentopdf
-  namespace: bentopdf
-spec:
-  egress: []
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 8080
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: bentopdf
-  policyTypes:
-    - Ingress
-    - Egress

apps/garage-ui/httproute.yaml

@@ -14,23 +14,9 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
     - backendRefs:
         - name: garage-ui
           port: 80
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix

apps/garage-ui/kustomization.yaml

@@ -2,6 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - middleware.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/garage-ui/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: garage
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/garage-ui/networkpolicy.yaml

@@ -1,40 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: garage-ui
-  namespace: garage
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 3903
-          protocol: TCP
-      to:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: garage
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 8080
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: garage-ui
-  policyTypes:
-    - Ingress
-    - Egress

apps/garage-ui/sealed-secret.yaml

@@ -5,9 +5,9 @@ metadata:
   namespace: garage
 spec:
   encryptedData:
-    admin-password: AgDIy9i34wa9hD57pft2B8SmSmCF5UyksaOD5NyUovQhLwJqv6QuZoXOQ8dS2aCMK9B2jFw2oaycJPgW02HEsUiuaorifAz/wmjrU8yXtGTcxpqxQfS0+EUhefHtcWBYVcTc23qMpllJZLEr7+aR+sCF6jAq1CHeuSCdAOTkhjBTbFmcodIZWCspxrqoxF4NLBGKSdKIuWLekH8w8oJ1ymf/VUj/LizJIKZn7QoRpS5KYVBM2hzlXipUr1FWSjmCmolTPv/ICW6CYHtlOnEvYUTOnEAdmAx5DD2HocKs+OjBUuFgnYwj2XIyLOoVI+nrACrQSvmzXOUrKNI5y54DU2PNgAa1zetWfHk/Xv468bLQc9bSBFhSSNTrl3mi8Aa381mKJ5aRXLGa89fCqGWAyrzKle0yc1msg90jriJMh5kN026KHXw/yeqcrTCD9MdTMr51UusfhzkE6LSnKmXX0XQNjP4OLOKu7kFXj8xRox0W0CNbXyg4keQcWnWKF1LUgG3X2+1CIZNFex7S7OE8KYtxP4O7aqy1kRZvgVsUONafaIPB+k+Gosnw7ImEQ4Zu8L1ATqpeEioHoxeac+RhavXjte7UqSjIV6moxWrwrK2EMZPHhm2Kh+h8S3ROA/78Y58hFkEYQFnJQwwwByGctS0zLIOCybVm/lz8puohlZAcfzf+J++0R6sxkWZtIa4YWG2g6RuTjUoqcgHPwrRYmbvB3WmYu9/w+717HZob13QP9C4mpT7Zhposw44JuJMN7MA=
+    admin-password: AgCQeGAvd1QdDC8IUwNYqHJxRES1jfPbonYTyutCklms6tjebQw1pRKnbDWGRaFmgWg5jFRPYf6TAMRnZnA/1dKJMOrV9vGjqx++r+khWbe5oqvcoQInqVdbkfulHoP/Bf6jc2mj9znGqpW6E7e6Z94pwwYkpaY2CIYhfcs7PiaTh7HiFMmoNWlGmHBh+lIZ//WJblgpFdQRWR9j7CiIJOLC3OmAvGV+Uh5i15fdA9aTBLZaB1pWh/kqug/mmj6q5E3Bp7BlC7Pm20Dbyn85kfA9RjAM/AkWSycGcBgk+FaJKFVJnPzrHcx6CdkbUnczxGVrbs+C89pzCk8ysaOVSNDErW0rCWNaHrflRx6P1+OUamCWWafZdkWTGQ4m0I5pX5IQ40zIK1uE8Zzil8EJPynfs37fNzn54wVBmsaKpsFC/3y+d8UTVgf1shJF0cqPimWjCZPqvUZrimL/20tPhTSERaxtWSq14l39bQUc4sNZdaKc69IkI04geI9OPvE+XXQNYe86XPYlNJ/R5curg1RvQxAR59sb04RmZAfdSvcwYxpK1Ekchq/e9IK4ft6Ul70nE/oN43NE2Ck1+5/EOjucFmIQzZ49Jq2OIjHuBjA/p/BmwAhiZVwPObRJ0VoL9XDv7BVB+S/+RWnFjDW7J5YhWquZ2Y6XwspHhpjvHmH+LLSio/34VpWQgG/lSAhvSPuRkIp/XxhQwemti+3yQNeqfXtvpfKa1IgAg9ic/rbocQIUtQDaT4yYFi7cruTpx7U=
-    admin-token: AgAJHn+bv6P/JJVplonJWgc/vnqXRQSsaKlTnrEUmH+P72YqMPEbt/Ma9ptkWOewQNr6mceYHUpXQuhczuAmeebe0GS7jr1md+Clnap+8NMKHbhYSCX0/MwvV7JUcWfZ6xJcttPHbP6a8s6SToidDOohBtY6gkeuA+12AtGI0t6xugAcCwBKqZnAY2lacD1nEqyatUP2cGHXTMmaNzsyz3g9QvuhCPrOx6FeC7JjmC/JdwqyLHN/b/NvVdCZUmvNjsPaq0U7UK7UCbcWYbjxof2u/3QF+EFlNBrpb4DYipOVqtrY57IrfYbUNucd+e5X71Kjpg+iwR+IPyGXS8OGJQQsh1ytYeZLbHpaCpmm2HVU0JMZx7p25QSqwNzP81wjU1VKkw1WEZG4RW4eHS6/aISSBouG4g/IRo8E93nskfj6Ue0+feFv1k50l2L4ROYtEUwMaeaA7zpwr6tTei1fenJ86sa3HAIwgIdiV1qqp2TTWwpr4xFHlVYdYvb+igt7Q4h73FwvYt3kAMTmH5O2iatGZfo36pqTGOqrfBPu5p+agkuA97MSumqHKzqADSPyNz0BmqzV7DPvuKsKxaFYAiEbNjD5bCIyDUwNnQIucMUbHtEfLngN+yD79kZiwBY1xS7sf8QG5yOYi0U5Ra1f/AEKasPUEOsiphrypcTZ3GzVv6aIaF/AJPWZZGDT0S0kXIB6u19Lyl6V5NUEXImnpBI8gyoMflIiFB18qt0nX7CBbNdRcwHGzcCjy2nshkvhSRmW0OiWw3v4UkDu8YAaSZDRFGjKJQ==
+    admin-token: AgDBYTHO2ZgJig+h3wIv1ru7VxEDKIq+SUjOygg39lVaF1bH0ADaWOdr1m6nP37LiBCyQSGtqilUGqXPV91VRiJJqFBXLTnYs0JbmXGekkfeImztAd7LL3yqKHThji/Bo+vD00PC3SAbpder2d6BJhOMez2XqFY2vPSY81earoiR+ajzuvHBC4PuwDjNYwnNq5BkGCF/D6EOenVfVJZdWHG4/oCciJzX+fwYQYw0sY8ur5cRxyY6wyWC2QH9YflDKbwFteiqnh8E1+B4mqSFiTcaM79FAU6rYxknXmw/BArNdbXvAxvYDyGKxQA1k6GwW9TWSg/CpKAmuJW2Xv1nMCqt3ZIJCTO/H1PIi24XouNBGc9n0VOWKNWZTI8CIZLRB+/LzLuT/vjhu4qA/LE6SkDXw1dTkgkkUChUKN4PrWfwTVIEgZwjPdewOZ9D9JT8TmPSZtGvVuDVOJl7+wBYGT4SkI9W2qU91h1VT+vmXO/7QyQ/kj2ny092GjT2aJTFAbtusAjV3dKZnfodXaCX/dQ3JnSuP2mWQGZ/2Gj5AB92FNvqeTkiqovS2hGgXjyOYp4JeXVPvBa1tWEo0Cy4FrqBLaycNIHuhGiWAhLrivXTX2YqyM3NfEmEuyzXu5M3E6eQhaF8uveDjqhxF1z07IUXU8zBCvHtC7vX2aYPfSKGWcpvGKa8NnkjamRY1qJbj1Jr15a9UBSM1TyWNGp3pxFHyy707FlayRDIdJOe0iYqQw/5qZQJBl1u4/1zbOldP3dPFtbGuhR257+wNWwKKfACorTsBg==
-    jwt-key.pem: AgBLwseufpRTqJdLEFeRr4ZN4VihNmua9GMPEEm/iARbWgNqCl64QzvJGy6XWM+RdXkS4z5jrjMg2Z2AJDHvd8qnFpDPBd4peAYw03vaxxpkz/TNz2+9HO4Nultn2wA2bd3CfA43doSs1T49lksCKn33puYEh8q5BB9hMUgU8JFc1sEMKS7auWoPQlwAOnJ4Qi4ISQZZ/C2IPLVW1VUJfPTsAenJ7ZgqE42DFFmghDfaFEQb8BcMNDuQCU8BJSqC3BoSMiuxmtkurzk7aXegVOEBcbdmPEkKa0h63kuTJCHZth5mVz4NatpgO6EDovGahO2EJkuAY1fyDhL0EpUSf+XHyaTpsDa/M+qvPZvd6wjGLjIH2CV1bHkvqx2GjKqv4zPkki3ESlxan/qfh0uFcGG2a2bSezmFbibvXr6uvmKo7KcbZWevc2GYgmODRJRW4bl5MTp0YDKcxF4I2kFboJhnCG5aw8hfw7LLUdk9iCT89u7UV/cHafG9TpoxkpIHyZmKrZLLczAvkLdABFX+6UYbFG3N+kVlFUXe6K7Gt1LrMVievNDIlds0y4b1paXIsj855znXZO7+zLcmpJKEnmjOJ9wa6TLCsI3wdTzEoLQOO9HPgywGRo3lxNu9mbiYnRbjwpO1pXs8RNfQj0ERNwE/EZoE+51SkGAADvqeWG/fT4bHadKaTYWitiVwXOjKJeXjEm3BpQI6hNyLMO4J/JMTAGHdqNttv3yeu5FJWJ4MrYS/tyXUSVBTojU2599/soFPqDUn/1IClkOKrdG15ZJCedMB55qOPf1k51dvIbhUVBEQlDyRDGksqPItVf1tM/+RhuGrasRk58zVuY5qm9JQFReNiNZv
+    jwt-key.pem: AgBYRkRh01LSyyozE46odjgrHsZ6gI3ykVOdV7qMPEFt5lILq44BKFt3vVL+yAUz0brVPQeEjz7dg+xsurAKKMjvuxzkOqBsSFhWwBzy+f+GfTSZPBrBNPAX7jI05dUNbcu2UuxYMlgVq6VWa9lf0Gc8yvuEuD0nS2qmpj1ACL6awLBKnkVXL9c5mvoC97DRyk920rPTnERJGU5q7i+zue4sxufYJwJZAJLOmdpzavHfQ3lCcJr6FfboFmGnvD6SM85rXTtImyDY4tsXf4J1rRriYR1OQe91j4SSbvxDFskXYSQ4bTgjimat21SXLCImj/Pqh6LJz7wMd9aW95ju4jDE1q1og0ToIL0Nybl9ANhqlJgFtOfvQRnaJVQQw/2GitlDVejJHCYWsVsSxQtAhvrGdWDOrZ1eTzvsmBnGcWzDwtC1YN3u+Wd0qJBfoRIJLiinwLaJ7ponm5MSb9Qjkym99gXm6XUO0MlHS52pfVaai+OmyWE6B6nF9tf3YVXfjZcNVB1pFHCZZR6XcnIm+wi1EwxXR8NIeFgqiaIm+BwX9u6IMiQOHCVznHD5nc2wfSXpeeT75IX/HAzRWC2cc6a8vPsr+h4A4hqW+cOoMYb9gQQIa+F5X4LcWb6f/0HJHh1IO4vf+P2hVU/5CkpgGJk+x48KgkrX0CE+bafQQjNp8JTdis1gxSGEX0QUaVGl+x7exGhrKlW81ZZTovequibx1JhdNSXNbWZxQ2fXz7SdN+/AjYyEh1gNPI2Zx6RRJc5BlDSSt7TYwqy1NUcPfbJV7hbqV7oDUH8JrsoSk+xxB0WDE+Uh5P4MsQna6NWkWyFV4tvfK4QyMupQaxOAKOYV27DxBaTr
   template:
     metadata:
       name: garage-ui-secrets

apps/garage/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - httproute-s3.yaml
   - sealed-secret.yaml
   - service-admin.yaml
-  - networkpolicy.yaml

apps/garage/networkpolicy.yaml

@@ -1,44 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: garage
-  namespace: garage
-spec:
-  egress: []
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: monitoring
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: loki
-      ports:
-        - port: 3900
-          protocol: TCP
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-      ports:
-        - port: 3902
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: garage-ui
-      ports:
-        - port: 3903
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: garage
-  policyTypes:
-    - Ingress
-    - Egress

apps/garage/sealed-secret.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: garage
 spec:
   encryptedData:
-    rpcSecret: AgB5qZc+lP+J11wyLaNSG++stokqfiu0KuX+FPIzO9WZIHsdNGoBlcCifn9jsbVxB5z9tbSlteSTS/hVLHvYWEGPK5MNdRZORG5lSGqf428+jmdCp4kXAQp80nBHsqsOpJeHJtuM3IlEEpHMfV18cXnz9Q3fOj7hcSBRb28XzdAdyEIr3ZG7ThPScXR0lQFwYe5/W4GikGQvLUHSn8DwZgsJesP4bJdHlHaifPYZMLFa4JSv0bcwrz5+WjsKWU3xa5wkHrMT05ihaK63n9vUOb4/AwPQHBL2BJfl95DlmoRAIvAqwlfA3d7N7Nekb9G8ZupUTnPRZBQ2+32JsHZ64B+nIR1/WC6+8U+2McTMJtORCidHbf0i0E6Q6ClpMeoGobtVy6z+rOkUF3Z9xW/WwS1hznb5LXRW1My/KPvo0pztyEipdTZFqRkq2teGf1pXvELORlA3yoE3K1JU3RgCmDWOD4sUbuacWhjG1127Zo+W3gnxudVbODJ+s/F7HLC+6IHlWBarTd9QbTHemD/8/iZpkqWmyg1oexowvzWlG6jWFsxBe+hMQ9vzFmPkYDsfzBNMeJohwhOxPG3h/aWkBw1FHqd5/VOY7R1t+BpCI9xanWKL9F/rOa5wH5wfOyLptLv057ZxCBCRZQNDeVsAaU+Z+odBYhGQxnsZIPly9L8vAnS5h68A1bnTHhyob4RuIaLoSTKGDHnNOvzIhclu5DSfr5cSkRxbRRFPD67KSpNhoU7NUnjJJE171yJZADI/f5XZPVfe/1mu7Y3epDExT/oD
+    rpcSecret: AgDWvOoSUADQx+cExTUDmk6/BWR8a7U5HRGf+T38P24FrP4DJiKl3GJ3Ce9a3eF7SqO/1TXiaN80+c4NX0dMEmnaS8III2Zbaa7x/rOHP608Vh1z2Nnxly11X10okVy+Qym9O5/oA3cue2bu6K3eG8W38mn3hCA9kWC6g9OiAwjBTxJXYmsUFYbj69Iloo9moBBLEtztu8T9vYu8rGqcchKzzjnvcS91kiduq9rY9/ZvYC4zx469DgnV/di8cjGdU6JAtsoHwggDtCVf2hvkyOIHTyPM9Y/EVGCsOsIzhJnTdsyRGn4su3ruLmS8VqbKC22Q86pSHjwdlD5RoZJjYtMWr5Q5YAvFbnTH9/+d0r363BfxlNsVkINd5d2OwlPpagEQ9pg4oFnnk48tsVEoYz1RCy9x/bK3U4B0Jin6l0T2NJ3umXPriLxBQbODWVA9vcv6G1tQiiuOsbYCWigoxe3ACpuYQDV+XujfmEZr3pcIw0hwKXtUWHI079aUkICcMEbtE3gLc1dNVQpja1SimZOUlqf6pz3YLv6L1e2X+yR93p2rN6hc8IJh3KA8ZR1Ymbbq2LaOwdyla50uuhsOkE2TGDTGmf9NyXjGcUys5LgNpRruzXEm/KgUX4tP7iMjHu5HbnDe9oiv66qfuIORiR2P3lbOdx3s+XmPd/87afw6YHA896ccCRkGpGnFanbrR+Z7MRqCOZsSLnQd1JpjnWJJU/bzrSl4q+PUV1Bt+hvAf8wXUrDtES6MdpOKUe4XW8s3QbVHvCx1iOSzP+r59T4N
   template:
     metadata:
       name: garage-secrets

apps/holyarrs/deployment.yaml

@@ -1,74 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: holyarrs
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: holyarrs
-    spec:
-      containers:
-        - env:
-            - name: TZ
-              value: Etc/UTC
-            - name: HOLYARRS_ALLOWED_HOSTS
-              value: holyarrs.whyredfire.dev
-            # Traefik's pods
-            - name: HOLYARRS_TRUSTED_PROXIES
-              value: 10.42.0.0/16
-          image: holyarrs/holyarrs:1.0.9@sha256:3d941aa8a78d4474cc016a0d994b2531aa8692015aaad487cbdee136e8dd4226
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          name: holyarrs
-          ports:
-            - containerPort: 6262
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-          resources:
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-            requests:
-              cpu: 50m
-              memory: 192Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            # Same path as Jellyfin; one mount so imports hardlink instead of copy
-            - mountPath: /media
-              name: media
-      # Owner of /srv/media, same as qBittorrent
-      securityContext:
-        fsGroup: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: holyarrs-config
-        - hostPath:
-            path: /srv/media
-          name: media

apps/holyarrs/networkpolicy.yaml

@@ -1,62 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  # Metadata and indexers are on the internet; in the cluster it only talks
-  # to Jellyfin and qBittorrent
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 8096
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: jellyfin
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: jellyfin
-    - ports:
-        - port: 8080
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: qbit
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: qbittorrent
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 6262
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: holyarrs
-  policyTypes:
-    - Ingress
-    - Egress

apps/holyarrs/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: holyarrs-config
-  namespace: holyarrs
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

apps/holyarrs/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  ports:
-    - name: http
-      port: 6262
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: holyarrs

apps/jellyfin/kustomization.yaml

@@ -3,4 +3,3 @@ kind: Kustomization
 resources:
   - httproute-local.yaml
   - httproute.yaml
-  - networkpolicy-holyarrs.yaml

apps/jellyfin/networkpolicy-holyarrs.yaml

@@ -1,25 +0,0 @@
-# Lets HolyArrs ask Jellyfin to rescan after imports and sign people in.
-# Adds to the chart's policy, which only admits traefik.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: jellyfin-from-holyarrs
-  namespace: jellyfin
-spec:
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: holyarrs
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: holyarrs
-      ports:
-        - port: 8096
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: jellyfin
-      app.kubernetes.io/instance: jellyfin
-  policyTypes:
-    - Ingress

apps/pgweb/bookmark-grafana.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pgweb-bookmark-grafana
-  namespace: pgweb
-data:
-  grafana.toml: |
-    host = "postgres-rw.postgres.svc.cluster.local"
-    user = "pgweb"
-    passwordvar = "DATABASE_PASSWORD"
-    database = "grafana"
-    sslmode = "require"
-    readonly = true

apps/pgweb/bookmark-redoost.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pgweb-bookmark-redoost
-  namespace: pgweb
-data:
-  redoost.toml: |
-    host = "postgres-rw.postgres.svc.cluster.local"
-    user = "pgweb"
-    passwordvar = "DATABASE_PASSWORD"
-    database = "redoost"
-    sslmode = "require"
-    readonly = true

apps/pgweb/deployment.yaml

@@ -1,73 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pgweb
-  namespace: pgweb
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: pgweb
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: pgweb
-    spec:
-      containers:
-        - args:
-            - --bookmarks-dir=/bookmarks
-            - --bookmarks-only
-            - --no-ssh
-            - --readonly
-            - --skip-open
-          env:
-            - name: DATABASE_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  key: password
-                  name: pgweb
-          image: ghcr.io/whyredfire/pgweb:sha-2c734cc
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          name: pgweb
-          ports:
-            - containerPort: 8081
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          resources:
-            limits:
-              cpu: 500m
-              memory: 128Mi
-            requests:
-              cpu: 10m
-              memory: 32Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - mountPath: /bookmarks
-              name: bookmarks
-              readOnly: true
-      securityContext:
-        runAsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      volumes:
-        - name: bookmarks
-          projected:
-            sources:
-              - configMap:
-                  name: pgweb-bookmark-grafana
-              - configMap:
-                  name: pgweb-bookmark-redoost

apps/pgweb/httproute.yaml

@@ -1,37 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: pgweb
-  namespace: pgweb
-spec:
-  hostnames:
-    - pgweb.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
-    - backendRefs:
-        - name: pgweb
-          port: 8081
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/pgweb/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - bookmark-grafana.yaml
-  - bookmark-redoost.yaml
-  - deployment.yaml
-  - service.yaml
-  - networkpolicy.yaml
-  - middleware.yaml
-  - httproute.yaml

apps/pgweb/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: pgweb
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/pgweb/networkpolicy.yaml

@@ -1,44 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: pgweb
-  namespace: pgweb
-spec:
-  # Only traefik may reach pgweb, so authentik can't be bypassed.
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 5432
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: postgres
-          podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 8081
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: pgweb
-  policyTypes:
-    - Ingress
-    - Egress

apps/pgweb/sealed-secret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: pgweb
-  namespace: pgweb
-spec:
-  encryptedData:
-    password: AgCCLx1xyP6tj0NnqQpB20SXNfb1k+Y2jL2U5JEz1UMR+bx7LXCGkFoWBGdvLBEO0gOtoYwcG2zQf89ukurqVx4V6Z7/22/0ERvOw1HiFrqnHh9B+1KhO/76iC2V+0a+2elCYrPuTUeV8MaBbleY8qPHqTVbx7P5umvtrvmI9YcLaROw/6FKmgwN75JYMWjeeAhrhW4knOgJKgZqXFcGUIqPeC08TBVvRfIfkxyahx1mS3Bi4Wu1GdYaaUOfyrhCUuyhhE9Fo/dAFVkshnJGRPpBvIjM/iFsR8LZYO+WuVE4HbX2Jf/re7jZMELs+PbliX4I4RUNUTo8P6J0GEMlpHXTzkpVvtRsSy6SZynEmr3u3rLFW6y7xvqx+fMNEIO366Vn6wkDMCakHroo7ZCCgMIhwTqtbIkJ1wLm89SzMXaAapR0ZPpF2W2t//XZ6XAPnAXuwW1aynLddHd/4q4H4GFJgH1igMtAU4Rdt69P7F6V2w/SgDR5kAXVzh9VOFdiWQ0cB00E9d19PpAIbEhx6SJ8zgout/RjYGZJyr+jLML97KqiSwaH7k6dH4JfezLeBnlknulbge7NRoL1QiN0h+rs/O66+lD37mlQV63mWDgbkqhzDIV7Q2ORRyj1PZ1mJ9arzNnWOGD3DpjO3IRVW95XEHqj4Q7FGZ5AOMHYG/Jh92LWqLmVjKG74omWf3gsFAdN6SojEf40TICFCaiPUpo7rwPCBialScmMBVDq9RJmlCjdXrIlEbBx5AxI/HR/oT2wrS9Z7slwN42jYq3T9f7A
-  template:
-    metadata:
-      name: pgweb
-      namespace: pgweb

apps/qbit/deployment.yaml

@@ -1,140 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-  namespace: qbit
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: qbittorrent
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: qbittorrent
-    spec:
-      containers:
-        - env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Etc/UTC
-            - name: WEBUI_PORT
-              value: "8080"
-            - name: TORRENTING_PORT
-              value: "6881"
-          image: lscr.io/linuxserver/qbittorrent:5.2.4_v2.0.15-ls480
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          name: qbittorrent
-          ports:
-            - containerPort: 8080
-              name: http
-          resources:
-            limits:
-              cpu: 1000m
-              memory: 2Gi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            - mountPath: /downloads
-              name: downloads
-      dnsConfig:
-        nameservers:
-          - 127.0.0.1
-      dnsPolicy: None
-      initContainers:
-        - args:
-            - ip rule del table 51820; ip -6 rule del table 51820; exec /gluetun-entrypoint
-          command:
-            - /bin/sh
-            - -c
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: custom
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_IMPLEMENTATION
-              value: kernelspace
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_PRIVATE_KEY
-                  name: wireguard
-            - name: WIREGUARD_PUBLIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_PUBLIC_KEY
-                  name: wireguard
-            - name: WIREGUARD_ADDRESSES
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ADDRESSES
-                  name: wireguard
-            - name: WIREGUARD_ENDPOINT_IP
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ENDPOINT_IP
-                  name: wireguard
-            - name: WIREGUARD_ENDPOINT_PORT
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ENDPOINT_PORT
-                  name: wireguard
-            - name: WIREGUARD_MTU
-              value: "1280"
-            - name: WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL
-              value: 25s
-            - name: FIREWALL_INPUT_PORTS
-              value: "8080"
-            - name: HEALTH_VPN_DURATION_INITIAL
-              value: 30s
-            - name: TZ
-              value: Etc/UTC
-          image: qmcgaw/gluetun:v3.41.3
-          livenessProbe:
-            exec:
-              command:
-                - /gluetun-entrypoint
-                - healthcheck
-            periodSeconds: 30
-            timeoutSeconds: 10
-          name: gluetun
-          resources:
-            limits:
-              cpu: 500m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 96Mi
-          restartPolicy: Always
-          securityContext:
-            capabilities:
-              add:
-                - NET_ADMIN
-          startupProbe:
-            exec:
-              command:
-                - /gluetun-entrypoint
-                - healthcheck
-            failureThreshold: 30
-            periodSeconds: 5
-            timeoutSeconds: 5
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: qbit-config-pvc
-        - hostPath:
-            path: /srv/media
-          name: downloads

apps/qbit/httproute.yaml

@@ -1,37 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: qbittorrent
-  namespace: qbit
-spec:
-  hostnames:
-    - qbit.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
-    - backendRefs:
-        - name: qbittorrent
-          port: 8080
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/qbit/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: qbit
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/qbit/networkpolicy.yaml

@@ -1,39 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: qbittorrent
-  namespace: qbit
-spec:
-  egress:
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 8080
-          protocol: TCP
-    # HolyArrs sends releases and follows downloads through the Web API
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: holyarrs
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: holyarrs
-      ports:
-        - port: 8080
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: qbittorrent
-  policyTypes:
-    - Ingress
-    - Egress

apps/qbit/sealed-secret.yaml

@@ -1,17 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: wireguard
-  namespace: qbit
-spec:
-  encryptedData:
-    WIREGUARD_ADDRESSES: AgAgYz7lVospXNvfy7IZOK/fxQe2OWJ6cc7ZzQf7kfXtZgARrffOg2trievpkcimVhi2dL8CTbYwuiJ72M0FirxOq9zTyUGh48AagZk9JygQntCrkJp7O9E3nSpyTJanq2L5QWug3WePvrjK8ShzmSJLQT43l/hAxFPy9u2JbblU5vjpvPpZCHpVU7HuZ/lqfNEI5zRj6mzxZnphmctEGzXW+wilw+WHENvDBL+jqSMgylAycu/5+Uc5X1JGLqEN2DWRyCQBRMDxkiMBnVvE+ImfkxHU+ZcTMUANllnqNwjot/jpFDZb1b916n8eBLMoSUkwKpTP5DfT0slez7hC+bJ9tkUXAAUHDRm18XTtGY1Ouh1uqtIQl8HiuY0hoShfPF3BfC/4wNXMRZjsj1R++z6kP/vQyiSu+z2PuEI8yzDRnNQGEnSnog7bTJBdui/MXHUc7Q+wgVNZ0/c4HfViZbw4zP6GVf+jshdUbOR8HC+KxRlKzU8cNDeUdnydUxplF+By8gyWg1hPY/GlD+8hRWqi1QDLdgl5JXEwDpU++WmKhiBHrm72f1BgZ5jlIiMON3Z2Vo18DzY8j9zUA59uAQsxDhSu7+wiuWQYbZrSVdFY006eBWaI3gVPeu3e3++i2ogKFfc6q5gmmaxhs1CLhhUypddKUzkfXDz7alMuauKq/h4uLesoqIFEXD9eWPs4mP9qirYx8MAZP9txx/YP
-    WIREGUARD_ENDPOINT_IP: AgDEkEaKaG9zfbuT9Hx3HMWZJzVT8QnMWN7eebCx654Gwn6XNtxD/22d8wxIRfhllrv47HCsCUR855ptHD9HQjeJ08WhMFm7nQl1rYI/5vKfZDyWdSR3grBzGConz0Eue3y5uljXcr0yN+9kqzURPr5MPs6fKRJVfSWaMFbsjb2S1Y3HRPXU3+xdoDxeOeVmMV/pP1enGRnZX890UF5QR2wfZcEXB6WPWWC1XnPxc7CFmLNRi4RRhLjh+A9WDIqEny5gviBTFXQsOEnFqAEFSmey/zMF+Rk2lGEWl6ROFzdH7ypr9KNA0dtMmfCLJ9AQF9P6MMD/uh2CyB5K9Jk5xNGoy3EgpQyjHp7q6FGiUG/jT2RXBdfoiJoq/NPsgQB3leIzEBBQk/DRau+xcob6H75nVtS+fVWOJFt6tsWKVAQhDc7YO7WvwRyTups+3s0iHxS8SXbshiC+ndZPZClPO4UXVY9OhMAUZ3sKwS2c0Ffj3xzJZWTnO7JBcONYmjo9qASd6FJQKPvIy6T4t9EEe6iL05t0/mIsnOIEdoN2le5Lv4DK5mmlboCW3FzSK/e/QD1iZLJVwrTF7gvBKvsGk+hCng6GZMsr/3++t2bZYMUjMZPTpDaTk2z3N2An8Qg0X2HM57D/pTZiaiKTy83cjQsnFhkLBHzsqGhtJbScJHtasAMt07+kW9t/8T5LTGSv8h6w0e2Iyj/TsShc1ZuA
-    WIREGUARD_ENDPOINT_PORT: AgCANmOaOgGnXywiDn755qCxBADq995QPGwBQYiApioSaYC32UP64SVP6RRDBGvC+jjFqhmXZlSDTN0LdrKG0x9d7klVIlF2awTIdRKAzN9wki0lLZQZ9Xx0wQl/YVXTKgcVtiuWeOmSJOEPm8Zxw8/1Rj21bg1PV05VZc4jxqsq+s0AdDy8DDIphD0Pobp0/U8MpowFRFEGnjmfE+Ap0wV/L7CR1opFr0PJHuEbgjp2+WfgnnG2Hwqj8nEUXiZzZzd0YIQ53sE7rlpBfTgWIBpeisOD1NAmAr5UxdTSlYhKn11pdMgIdybYGS22RTYMdKh9S6I+S0AjA0Gnci2O62c7y1aFIMxLrq2G8LhTlCEiRrYirGzNQZiVooGAnJE2evcTVnjZTGS2eHH5d+86Fq2anD+YzYhW9QLyp8goEyqHjuf7EoGF5H78Ij0lJ+rPreA0dSU0uOEC4dKZQpvdjkMZFu++uusNWLh1x8tvQBdRBDqExc2qbulBnn8VxRk1jwMKjwRarGrt0K4f2Dn3pWGc8d7JuLxnJ5QDljp/BaNlrOhnp95h1Uh4vQoj6fvn78aMkAQDbIIVaCx2IFVPEJBXCfbYIbV7mY1M7roRTZPUQ4+mGDe3IEPeXLvI96QK5en+0VsksB37+eFp7BIsNibzViJI5KgBYp+Hd9PECPYKivPjhP15vqLEcqGuskahvxp7xblS
-    WIREGUARD_PRIVATE_KEY: AgB1iJHqHhWudTU26hAXvWpp8OsCccV7ASH1BG+hmo5nXTEyBpjCQ58yuYMIYHIJq+iLlrHTr3cn4s2Q9CO+BEnca1O6sfOYzewoIqvVVjF4ol2TurPz+Q+FhqO1W+IAE4qrg/2/qTwyg7HcvBHEsKvIH0M9huAk6hgzGrh0Hx1NK2AyvtEkW11Bxubux4LVNxjqS9RuNNzIvVURU4aN6sDX1Jhkvv6cr/DU8QwopojHJnrxVOA++rWgF4IFvkz0K487WKkE7Pn+aTW0t+vN0JgxIobznoyMVRkUqeEDbE1nBaf+/JSQ1FREcv4CSIzT+Zcb1XslkGB4vOjEC0ZBkiQaAxHQdl0Fdthmt/5NnXonl+5mFDVepDmoGPmsk272uMGxl0vvTXWZXQfasspf0MBGBjR/NF6MPVkEf2n6Gkk3INvtQUbtwjKpmbQj1INBKVhOgEH5RDwyYsHz6FkrtPQmv8odwcTpQzL4gC7bZ5aRY/MGJDnWRNHZsU2j4Juqpc7q8t15xT26gvhedGwcD07uYM97gGvMtVhiCFAYj8XOKJAfhqeROgbGjWSpUC/9D5ERNg9BYhYyYjcOmrmdL3x2LZEiWCwKI6jR0YssmuGsAgX0z01h4OvLTN+kjc9hurdPdat2zqNr7w48CdE117ahLd3li//iYWlEC5mVCnHQ6iRrh65LstfCDwWBdFHTLfdpAhe0Ugd6rcVJt1sHPGL/5E6tLECU8zwOThU6WygHmvWpjLzWIX1bO2eF6g==
-    WIREGUARD_PUBLIC_KEY: AgASGQ2/lkGyl0HYWYlwuJZ1EtxoHrCIf/Zgzk7hCe3he1kHZHrcDpdoMPVEd5ys72wHW1crygowq1h1ySHPRb/gU6OgxBQHvZkGXBxmXon8u3KIuahuAnXwHsftO7qIepAGTka9S8/7GTeXEutXGMOWgfdRO3RzBUzkmoFH6lyFwco1U6SBfyfN0MVfPTTlMk4fV6DBZk4ygOf6Slow3/CR5+2otNRFx3fnzPTU2bEg0QvuMXg2RPmse9YnjIiSKl5gVmt5FwIyo7IDpgJy67rwfGu17Hv3cIhOdLLskPkakd97MVxpBp8xeGLSOL+5ogeoi2rvKvF3AbRyuMhi1eUlTuYuFp672tPQqkrTr512LsL44+WZdivhEAAl/bkMSJDHejAyta0n/3BJTIBaF9T7/ZPagfMSE6rBwpI9qpiNHNaCD+qeo9f4+f9VvVj0TTvhGku3ERh3cWiaJ3RElcpzhlWNlBb1Rnnmz5d++ES85W78vq58HjfYv9Y0JzOWmjdk0PhOxd7us4qNGOUaEs9CnkdDKU2AAnbbPkIw7CIGR8fTeNsyQw4L0VtP9X5X9NvjAsBsCgzPKQg8dcGFL07G/JLWVOCFQidn9L0SxQXH5O6bH4lic2jFQjCdwmOD9CkT/49Gb6ZzxwUnlYTO6mlNtIiFKhH/b+WAjDc9LMfwvSxNft1fkjgFjrSvk8No9NyU8QVvIPxQLJnKdVxSWWAaI8pePPeKaTD3a/qeANkb8HWIh6Z17zNx1ggC9A==
-    wgcf-account.toml: AgCmivAwuSXzJouUpC2FRB5vzLQ6Zj4LYzTbpwo6S6FuB0npes/61jtvdBuT+zdw+GuXhANRW0g4IBo8B/m/rtOzauZ0Sao6hqvlwTBbTPd6B/lnwQMMF/u4SrdsmRjFrlPxRWWs4rVZfDVcoeQqy7GCpRRHx36z/uwTGoFbz1yvTWO9RLJWCTMI8es8zoHzudpe9fS6PcAo4Cxv4ezA7kPMqQ88JkT5C0HdTNj5xEm/lhkrA/5mdF2ScDC8JOVJnJkURirr0glPRRoYlKB9wlSXcLtXMjlVWu72cND29QcOmJHaSyVZLzWtu83rA8axZBjX9c2Dgtw7zwtf06Lapcj91Qo2ul4vKXMfH9CoCzEpMwllSWKZZndV+OgkG53qKWzvrDj/bagK4qX4TLibCAdGd0hQ+/IX9ATJdmdRgHMu2AW3dudsLMXJJF8/5NdKS9ULeWXA/Fi1P+Ahebi1mS3NyRIQpAB0Fa9+FoaHUIp4itNOaOVQEQP/xKUCBeB4yFTqcCqnOwogPbzpsvPJWnoUTKCKDB9PCActjAiRPkGsxj+rh8FGfm/xjSbuzdLg42fHiFSO17zMr1xWbuhhUv4/LM0JXJki61e7/ZOPTjzJACykH2L9KYoC+jHv1+Tfr+tXnhO5yX9G7BUKF4r0CCciVufnH1N0j8ZsSDoqxT9avimH0hJJiJ596pW/UbM9KXbf8omqShd88rGHF++eX51Kp3eU2+JVFhpYsrWjtYOSUHobU6NqJZDYMc1TE3hAa8GeiGtuKweovD/mcbhEXvNksIOQqB2JZ8dODgFtN8WAcRQqRALoag5OyokcpZcnpd9NUgvPVUpCyddnKnF3oF9hR1uhhG71U7rf7OTtNO9KZwy0tg20cPQ+fz88vXLRejezCqf7yfVgd6pqxXtw7XgPHMR0j0RhKMrahee3Q/TWBou/XB1kVYkJHLfg6QLmRiaWVT4I/xd7zEZF7Li0VNc49g==
-  template:
-    metadata:
-      name: wireguard
-      namespace: qbit

apps/qbit/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent
-  namespace: qbit
-spec:
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: qbittorrent

apps/redoost/auth-sealedsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: redoost-auth
-  namespace: redoost
-spec:
-  encryptedData:
-    REDOOST_JWT_SECRET: AgBlwaY7ZaZZSSpLoS4XOF5+dghrmIXZu4YN7kQxlm2WunpxMjw4VjCz5Iz6OxvsJrh0R4rf4YfIotHTlbs1Ylc9JtjrjcO0joi3+VwenIGLbGKi3tq0JJCJohrAkFF08Ro9d2UEFx39vhEXJ6EFDoNqhZp8v51OXdLRe5gAU7kwEHyWIxZMzxC9LeVLCPN3Ss+LJCALa+ePoYOENYADy9PK0BgsvXddnUmRIaxRVv81qc74c1tHnzCL79nazVtFw4gdqV9m9QuPzRem2pHXRvIC8O8J08LeCSrp1XXJnRB7SDWEdKYS6iSL+/ohOhxYGRUSDq+bG68b7pWTQu8Gp/jHyPiZWcjtL5V6fzs4otE8Ur7prAbflXZHLuxzUjPHsUJ6JMoP/Eousb5ui/rcA2jtjVOlPmxaIncj2Q5JK4jABMt8s19oyFedlEHD2Er7WXF7ZoYY2LFu5c645ltju3HlUflxac66NDhVDqy5BGpFyjwkC/XJ6mrl3gqp756UaFrFW8ViuJllhYty08KBU5eA9AOvi9JRl0AVHGQPAE0kV+4SC97Q0zXcqNb0FR9PloOUNvoqyFyjU/n8LUO8ObWw8zrCPljigexHRKEawwgxEVCrqMNHaAtzEhD5uXrDvsTZ4ONFOAooR+dSKM13HSMyvwFyPY+vzZr6D1Mef4dxYfHwJeV6WtZuAFFsfQFS7QhFpCIDsDXV3FDxY4PJnREG9jFr/lkgShlLFD7IcdDBYC1BxwjNUNdMUW5oA1AiKyByd5aCQgetHy1UbJKGy7yO
-    REDOOST_OIDC_CLIENT_SECRET: AgDS2dN+lFtGk/DHb7TNj3+trQLgxNIQZBth1nHLH90gXh1Etz04wKwWmI+/OJWGqxaa4xbxrcJWJDaAQeAK34qOQ6nu3uVV10lK0PBHqaGVA9s7uu9LsMy08dGC3IcHGI7dSyNaBoWAgO/CbRJYRBIEl9ePibm5bvhMo0VQZk8LtiBxrsySLyYqBSEDLOxbrGGtEO6jAlAe21jKTFOdaSdwZ+oGPWAuKICciA8bl4A5iqkJR8P0AD0azZ/HjYtygOL9Lextlf2IcRyzFC6lmyYEyn/O02rTGgFuCZHHDcF1fS9VOXDXlJVpvFSd7fsbvLa1BOqZ4y0UlJ7BVP03IzmieJIbl3Ey57Pr/mWlpQ9j6a7Fo90zF1Z8eribSZvJIuRdLPWIBfHJTqBVB6S0YiUNcn2KArwx5hKbRqEfb1NDFyDV0cfT7dXTN69xcc4YByBdaUmFjZZKfz0gYIOYKZo8bkA/vHiIjYYOdamSJpdThNFMLuqD6mJdsNx3EZLoXjkezmbWig764AudHfkzU9OOqi095rW1tP2mSK9T1qAxjs/lr/PGNjTQU5CNQ/XOi0qZgnjUmRZEyuDz79lvL8LeE9XWLVQ3eQ+z2Mm//YNcx1soaHdDnhUKtFXEqcl3tj9InWmCloHtB8xtxyBoB2yEUR5eEls3qHCfdiebt7mINDMdO0QqmNdleFKz3TTs7/2NgJ3xfzK/cSkkfXxvUHmRgYpGWG8887KifIEONZvn6ZLDfg==
-  template:
-    metadata:
-      name: redoost-auth
-      namespace: redoost
-    type: Opaque

apps/redoost/database-sealedsecret.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: redoost-db
-  namespace: redoost
-spec:
-  encryptedData:
-    REDOOST_DATABASE_URL: AgBqe7ze4oAAyWrbSdLWaaQ3laVs7WxBobr0/H/YFpXIyALuVZP2O5rtB/0BGauc1xPEQl9aeYkmSzAvaK0ECtEvU/Wj9QLfSJ0WCcGXrK+Cou7ykW6lSwFfbTOzDylCDpZtSEKanFFj8KCmeu/7PS/gwi9zsJXKR4xgfaWEPztCr6ND8iHY6RkBAxljl3NLeR0y6auC/eq/Tj08IkTGlXHeF9nQN7SaCl4t+kxtjY+k1CLbXUmbmNY16c0H2DFwbLQ9RgsyvL6aXnJ2LeqRvNsg3QdZDPDJwvs1wqR/4U+hTRh8tAGrmIoqQKuxcasEL5bmBX6Bo1JVlS9xgULf9bPbHP4mncClHFJrXTHmNv10cLLuyd/o0YdBStWoaeIv2YSchnaoRH0Qu26GbF1CF2KrgE9Dwu6iCJn9Ux5LPhWBvjsNfJ6r7unw97IwEHSsrWT93osddiPi4rGLXS4rP89CouvUbN3LYsyJuI832Jj163lk/+EERxXR+ctVQJsgH1gZuHlswLXEkn0BvCT44w5+Sc0NgPkGeKyld4Fnn5FmHlba8qkyks9+J+mZBJC26fh9wZJN0JFbTkLov6sk6nGEMEvrIJyVBrAJi1FmEG0Uec8Fr/NyLv+1TZm0eeRZ1mk8J5h6QydsBu5Cq2wabfysnMsIJmS4YpL6kYSIcF0j8zr/ISfjEFchfnI9AcGQ8rhqYcytjkud+I+kpaq6R9wDMpUB7FV0S2J48A7seXmvJw7wA1ojdXFuQ7Ix0HCUIcFrvTPs6KqXe75DfXEtQ8Lm2xc+OWz7xm9DfbPkeo2s1CSmHpUg7WeRjNp7aoiJgFvy6+xZi8xe7nt8B7P87SHf5IbtLLpY9v2bcPjXJ8R/lzyXE/kOK+H/Dr9YDrGDZvZm
-  template:
-    metadata:
-      name: redoost-db
-      namespace: redoost
-    type: Opaque

apps/redoost/kustomization.yaml

@@ -2,6 +2,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
-  - database-sealedsecret.yaml
-  - auth-sealedsecret.yaml
-  - middleware.yaml

apps/redoost/middleware.yaml

@@ -1,9 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: compress
-  namespace: redoost
-spec:
-  compress: {}

apps/redoost/sealed-secret.yaml

@@ -5,8 +5,8 @@ metadata:
   namespace: redoost
 spec:
   encryptedData:
-    REDOOST_S3_ACCESS_KEY_ID: AgAsARN/0zM6asSlm+13UwKz2YvviQDwuvzPiP+Xy+kCi8VUdaQohzG0f7FfDhmG/0zvgc2EawNenf8QfUuEVYUMw/xa3orbvardL0RkOZN7dnm9bLm0LiuzRs6i5VgWSOBhCVZd3oMhlVyI2Pzbu09VtcTIqbIPrrrcrQzA5a9rIes8MKGEQbU3pdZILSKLFXgFWCqDGiex9ugkweI6jp9gk71hRzqpYOP9AA2df5kB0n+7HcIB4rDq7WlA/iXkCMH1NGhjDBMpRE/HyxhP0Td2WXqNsYKDM8Licq1qBnuSGT2FaTsCKXZ0X3ClFpbaXipzAwimqK4eg65tneT5NKbLnWjNZKx08scw98PcQzS4g+9l8nH8IIKOVq2+MuC+85e6yEgfkEjwknltEGSJl4VwdFUm5Ec2GVi1X9zWW4BzHuGWJYE/tj3atoCHfUnht3O8WVo1s4pSOMyInsetSlhV2YVMncOKVDHciY67+ih71jqiHqABGclbDzaQKFeXFY/e2J6o1tTRQ2ej5jxdjU+hdqig5/jsGqRc67t4oiOPEgEq4FmDTp27FGUIM20w3l74PC8vhX7GWOJfpl8DqvYgAJyYLO0hzSeE/Gl07/UZalq2Cinl0BwvROJ7kPVB4H+NqfbGl77AxMXWu49AUV3BBKG3xFI5eEVY9CRTL5lAY+WKW31543pgvB9lvYbq7LuTnvlOcKSwlXD0EeAWo4eyLuwtPOk0n8c26w==
+    REDOOST_S3_ACCESS_KEY_ID: AgC0A+pQKuYKMLfMPRAtL6a3PBEkwgghd7IbH8ZGhgU086s23NvbOBM5sHHkApqOiQ9z2LarAfvvKpBdxlQTjInxhqdJ1lW/zkWHokHhSn/L4ule/efU18a5gXsxNXN0Mon9PZrS9wKAFR9ZNiEDFa2/L4iUtCesUR/MneUFqqqibxiUgt2R8sMmRIzP9O0b8T7vnw1EkgyO4HWpWlLrGPnBryWA4OEj9CGLrTT7Z8u3Z2J5m43dELfmzdAH4gM3RQPXAzAMY+QyxnhtGA6x52OTcD8XxqB1lW/dWzTq+zCjnmRR5HbpWjeuM6ojlFJZoBLxYRRMZowMEKFX4egKUvGEDmSKOX5Z+Hn5n11dyRFhpKrMU9vy+utLvVtDM/rr5NqK1Bna0u40VdUUwpdoqAWUevw9yLld2QzOg06hjqQwpqVER7E1VTDKjVXveacaN7si+63abaw649eAaFhTitMEE9ORHZ7Fz3YZB5zdqnEQWZwzczJhhvqzNxP0pg1/JCEVrKYVfHCtuDoJ0BCeiuFPWU8lKYhYoxRzm6biWhdevM4o5CobnCedH/O+TDq6iPDDgC9iBNHIQjwfUAjjq44OXfl7X9+J3Q7xm7BYMD+/8LvycbBauFtOnkj32fyuUKF/EvoQF/AIQ3TX6rC/CkbIMT+m+mcAx75CB6hfpBFOMRKgpTT7WNR1zs6YrSEzNNQq95KvTIMVYEEKm+gjrnpv9mkCkCmSJPCWsw==
-    REDOOST_S3_SECRET_ACCESS_KEY: AgDEE69d7G2xfvL/SyMz4HbsYO6bilvv0lh7gtSgfGLSBK1K3Bzn4tf3h6xRFLlO/mhlQCiozWSB9TQdltZyDvYswYH23kEaPR5m27yudHK7nxN1G8I/uyKFzm6o48keU+SGCakutYJ3Mqrbicj/Ogi+5VPG8M6Yxh/hKYcMO9i3cJDoqn93Ldyv9jRty8q9nNhaZDs52di1p+1S4FOZ0+ryrIPVtdPGfM2KViFnLG3DEBqMkxHNegWGRjie+AVKY/MOqVE64I7t+XBYnjLfy4aRpGFHhEXhihkfGklQMMKFwlIc8OChs0RfPHTWHlbTg73Xmr9uDyUDWgAG7VPfjuQU6RfgkWCGe3WjLF/7hPZmfzR/S2nhPZzNugFRBeWG6Q2FJ+ACPoJQFCmht2JackU9X7HivJee3UgfG0q63Ja2OK35oiwmHcPj2Wfv7YGarmnMw6QRiKY6ZpQN3/mlUyWNPMnwoRrb+JWQJTkVrRL1lZloydgtFX1y25v3XYjR6jU0s0aN1jacxIVto1C5UgNhLBIjhebXBnqVlWn4nJzYTLZvKnY0mHv8sF2cEXZNi4wqa8VdifZjSriqJKDCnQSPX0Gvr9XTRiqRWFNzoTRr0U6AnV3/zlxJaBb21zXAY7QbpbzExEbazJjhaaSCGoCGhVsVFOdn2KydbZd0mFR/o5KUDR7GXMJj/6wvNsjduyvlNFxJgCwElhApHTWxtsXWYR0yFeuIuTfyn6hbTo8TMQqPqAGKowSst+q0DvOKz7E7P5HZrvFBGkucSr5JdIxY
+    REDOOST_S3_SECRET_ACCESS_KEY: AgCp8zFoy+Clr5qY/57jfSwYT44a2jwTFzHgOPoYfE6LXXtis40QjrteEjyc9oE4dE2IlR3wY85twCcqMEbJW24mkTbQf5E4B4V5XaUTi2XhMkrms1tfwaKJzYJiPfoS5u/WyrMN7LK/pqryEVGODKh/57PNoEDK/N/ab7w1iKfxGQQVuwDSCdsT3RtrinzKXKHUFsR4f3wpOAO9nh/53atgZ9MMs+6DFLmkdXvIfjgJ/PqCrtxKx3hTXFNhrwbDIUJFF/wF9SUy6C2CyHCycdeU5HJFSahCIRMZvFAhDrl0Ubsi/MFgWsQouj2q6VEK8VAWDttCJaiSf9g/KhELneKCYC7qo7e4PzhHhAHUGO5fILWxd7HySj4CxSiCDiF3kIqVUXo/sqlbgBNMvPb+NNqo19g27jcFZPh/AZZkuBSxsdmEYfgg1RAcYmwPGUxksRcj36yknYjX4pMxJNqVGDH1nLsplOa5b8h+evxMnjK6oNduRP96zHd+Qo4sC2ThBF3Ar8STJpbbJ+KgdW1HnHo38JYd0J8q/pcVq5xY3+VX8Gy8JSrb9wdFMZnb+iWmyL/GNwLIqqbZw1zcKF7Rru78fl8Y5VWDnrpbjn1buqDxwyFkDhcxX9WISoAPKXP9K2Cs5UOIKwu50cOAyA+cMOMsYbTnkvAuDMZ5aBPp80j0TQLu4luPPvKG1RumhYxGthmEpwQaPyXuJfhOBbuVrsiNlaCKe+d3Jv9l3Y4PVlTBJg7ZD7YpfLoyvt1Y9ELAI5qiUjZ4Ru5TxX2lIqZOoZ/G
   template:
     metadata:
       name: redoost-s3

apps/rustbin/kustomization.yaml

@@ -5,4 +5,3 @@ resources:
   - deployment.yaml
   - service.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/rustbin/networkpolicy.yaml

@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: rustbin
-  namespace: rustbin
-spec:
-  egress: []
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 3000
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: rustbin
-  policyTypes:
-    - Ingress
-    - Egress

apps/splitpro/cluster.yaml

@@ -0,0 +1,33 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: splitpro-db
+  namespace: splitpro
+spec:
+  bootstrap:
+    initdb:
+      database: splitpro
+      owner: splitpro
+      postInitApplicationSQL:
+        - CREATE EXTENSION IF NOT EXISTS pg_cron;
+        - GRANT USAGE ON SCHEMA cron TO splitpro;
+        - GRANT REFERENCES ON cron.job TO splitpro;
+        - GRANT EXECUTE ON FUNCTION cron.alter_job(bigint, text, text, text, text, boolean) TO splitpro;
+  enablePDB: false
+  imageName: ghcr.io/whyredfire/postgres-cnpg:18-sha-62e724e
+  instances: 1
+  postgresql:
+    parameters:
+      cron.database_name: splitpro
+      cron.timezone: UTC
+      cron.use_background_workers: "on"
+    shared_preload_libraries:
+      - pg_cron
+  resources:
+    limits:
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  storage:
+    size: 1Gi

apps/splitpro/deployment.yaml

@@ -0,0 +1,108 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: splitpro
+  namespace: splitpro
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: splitpro
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: splitpro
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  key: uri
+                  name: splitpro-db-app
+            - name: DEFAULT_HOMEPAGE
+              value: /balances
+            - name: HOSTNAME
+              value: 0.0.0.0
+            - name: INVITE_ONLY
+              value: "false"
+            - name: NEXTAUTH_URL
+              value: https://split.whyredfire.dev
+            - name: NEXTAUTH_URL_INTERNAL
+              value: http://localhost:3000
+          envFrom:
+            - secretRef:
+                name: splitpro
+          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
+          livenessProbe:
+            httpGet:
+              path: /api/auth/providers
+              port: http
+          name: splitpro
+          ports:
+            - containerPort: 3000
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /api/auth/providers
+              port: http
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 50m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+          startupProbe:
+            failureThreshold: 60
+            httpGet:
+              path: /api/auth/providers
+              port: http
+            periodSeconds: 5
+          volumeMounts:
+            - mountPath: /app/uploads
+              name: uploads
+            - mountPath: /app/.next/cache
+              name: cache
+            - mountPath: /tmp
+              name: tmp
+      initContainers:
+        - command:
+            - sh
+            - -c
+            - until nc -z -w 2 splitpro-db-rw 5432; do echo waiting for database; sleep 2; done
+          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
+          name: wait-for-db
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+      securityContext:
+        fsGroup: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - emptyDir:
+            sizeLimit: 256Mi
+          name: cache
+        - emptyDir:
+            sizeLimit: 256Mi
+          name: tmp
+        - name: uploads
+          persistentVolumeClaim:
+            claimName: splitpro-uploads

apps/splitpro/httproute.yaml

@@ -3,11 +3,11 @@ kind: HTTPRoute
 metadata:
   annotations:
     argocd.argoproj.io/sync-wave: "2"
-  name: holyarrs
+  name: splitpro
-  namespace: holyarrs
+  namespace: splitpro
 spec:
   hostnames:
-    - holyarrs.whyredfire.dev
+    - split.whyredfire.dev
   parentRefs:
     - kind: Gateway
       name: traefik-gateway
@@ -15,8 +15,8 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: holyarrs
+        - name: splitpro
-          port: 6262
+          port: 3000
       matches:
         - path:
             type: PathPrefix

apps/splitpro/kustomization.yaml

@@ -2,9 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
+  - cluster.yaml
   - pvc.yaml
   - deployment.yaml
   - service.yaml
-  - middleware.yaml
   - httproute.yaml
-  - networkpolicy.yaml

apps/splitpro/pvc.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: qbit-config-pvc
+  name: splitpro-uploads
-  namespace: qbit
+  namespace: splitpro
 spec:
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 500Mi
+      storage: 2Gi

apps/splitpro/sealed-secret.yaml

@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: splitpro
+  namespace: splitpro
+spec:
+  encryptedData:
+    GOOGLE_CLIENT_ID: AgDRctXaM2WUp9CYS1HQaxq1F6qJ6wyuV5PRK1hhSYCGCpZwId6mT/M+YCGiPnvAqR2W0L0cJ199ytZ5aV7UBrgbLG6XK7jN1txxpdWTSq0pONPj2jOrUvqdToA/6hUCsQBW6oqshbhjV/H53PxmKzR/t2zTQ0xoI64FK81INBsyaCY1gzdZQWYZCkmDhBUrvzfprcI6ayTvOtMhJkXMFU/TNielxjQtmRKnjz1wqyKZkvie7ZS2oEzU7R+VuuoMQVyL/N1pcu8rd5/WaJxJNgtG0oTFtJMQMCKvV80nXRWTXaTCGtpd4Ior+COgUW1ruzxU7HvrOMeQk/pwRPtVuANA5XUgwABWJH+RMmSDTsmqFlqaIYluE4swYGeR2dvEVWv4PN7YjBuJzYrWOCntp571JLw9jJ8ffCCEETQiEYc65ZMochp1rayZaHFJXAoorS/AbOK5fBYpdwM7R9KYl9tGxYzNcqzihezqb2hZuIIyEQnCtKPJl68TywiDXcUiftwlIhf56v2Us9nYaHRsIVstot1FhkrO2DqYrRxJ9/k8wPeJjPFCqrpx56y9bqRiyq4R4tfAKv/iHTZ2d8hVUZ1Pr/bc2pqwjxtjzBlGBXrAC4xSQWf463wk5IvY2dthRq0LZsXd7c8zV8QN9ZGwtWgWulNB/VXIsv0LoI7lmujWbCAGcis8helOo1wRgYE/NVeD/SEpJGEPkzx9XRuplj+00WsjOYmsbfvtQIcOOJbEtM3d6vqLd+SeFswSg1z01YFX6gagPhHCbDqfy0+DFkkM3QVsAPxKrBwT
+    GOOGLE_CLIENT_SECRET: AgAkBnqzqC9srhWzQA/q7ZfMpgfTy+J0on856vHPrIS8oe5P30vciaGlgkQdf1oMLA5ovHaSq6x9AEqv7HRzoeSrdUSjswZce1akAcXU+wA0mQGzVsmaTpCERAJ7GXWmSgsvIQNQXF5N6BLiZliueDiMIy3sZYAcoffrZ5l22mWOSBlHCXXZqZoP+F4Y4tQrlO28NjlWGo1UBf83JZ6TZMtK7IOuYoMDsZo/NlE1x0zj3beMm1VLvHJXRn1plU06IwlIKH0xEed2izff4FQ7f4Q3Dqmtbz6PhTdVqy4HQvhIrkAl/6IwQCZdTWHRdgv6fXQWs+ZftoeRMHFXI0xB3YfbLoqO8Q2kDqgxSOM8Xixdbabq1v8u0EVZCNRryb+XuWwG46xWNPVF2Nl1SIaeLxWQhFGEXTUf9IqYH9fQ1kpqIlj5IgEa1MUWsx1eE+vik1shT20woU7Lj21Zcu3RZob92qMVNZHheB2Lzkcw+dP1BwRIwXTiLXfdyDDHXlajnkvkkrrcwO62K4zEIIS/LyoLt2vdk63mfXKSz343pnpOsN2hEqJSTkCx3CFhB4JBSybSFrBtljcCDjK95dvsTQq8qZKEqLFZEQjRWXxsiR9aoNo2MCmPA+dDfvsJ7/GZ8mnjyNdLw+UCxrTiyXMI0pAgezZZZf96KPGUL+LnRbJiTHxxsfk+q2/nMZeU+ftZdV0F7zrCUQhkyJZwhYk2XsblyHiKsPCvLHtKbhIXVpwnLdXPgw==
+    NEXTAUTH_SECRET: AgCdNnXbHEuOlg1UnJii5eGJVfBZh5nWaybBODJJK3FbyhYPuj2KhGfNB/ld529FpddAEDv1IGWwKAOaSCkhSv1Nh1P2NZj37jpgbsHx8vw1omLLSkWqtRf1m4AhHhEwQoY49dlAk4AxSkjk5IckH8PbbRWFXx8Ns8kAGrJLrp6i7EbxrkI3U+hbEz93sQwRJo8XOeYCEodr7JPKoYHwy5roAwB0PmFL56bZFfuCa9yEje4BFxdQMrm0grSDMotTDH3nTF6irq5HSOEgqnL7Tt3kHW+Uaz5mvUZcCxAMUoB9q2mjTjm8fiprybVfMmCsib3epcZGrn0DiPZhihePkrfL6vTaz0pm1Nr7qkbtXFVY3RWgZjFpmDyAl/of7ddh9VYQVmqVAhfI610Czqqyou0zFuvlOXGlp1ljp7FNiwo+r02WxYoJ1leikB+CCnVxd/ErELA0AVneGUcWzoKG6r+OlDzsfV/gp2LXanAq2jKyeZ09ARhkLs3PHzkoGDaOF1Dr+3ZCidrfV+GRcnr73P7QEQNO6R+tEmL+idKiLr4uI56zrFg/Vb5Yxk/jMr2Hrfw7ai/nV2A+eqgXFQammCEZlDyCS8GPX8ULervbG/n4JmXXMUtGB9esM40cfTlsNhhv7sBC2P8QkOI00wvgdiwcPkOE+1i33Sxd1Vt20d8EP6TMfwhofQz2zYdYQEWYmBgiG+zX7mwwh3awuA5uH+ooA5vFe/aHPvMYM2rbTYDihEISJt1b6cbCiE8+Iw==
+  template:
+    metadata:
+      name: splitpro
+      namespace: splitpro

apps/splitpro/service.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: pgweb
+  name: splitpro
-  namespace: pgweb
+  namespace: splitpro
 spec:
   ports:
     - name: http
-      port: 8081
+      port: 3000
       targetPort: http
   selector:
-    app.kubernetes.io/name: pgweb
+    app.kubernetes.io/name: splitpro

apps/wireguard/deployment.yaml

@@ -1,108 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wireguard
-  namespace: wireguard
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: wireguard
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: wireguard
-    spec:
-      containers:
-        - args:
-            - |
-              # The node's kernel only has nftables, the image defaults to legacy iptables.
-              for b in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do
-                ln -sf xtables-nft-multi "/usr/sbin/$b"
-              done
-              # Only skips the setup wizard; password login is disabled.
-              INIT_PASSWORD="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
-              export INIT_PASSWORD
-              exec /usr/bin/dumb-init node server/index.mjs
-          command:
-            - /bin/sh
-            - -c
-          env:
-            - name: DISABLE_IPV6
-              value: "true"
-            - name: DISABLE_PASSWORD_AUTH
-              value: "true"
-            - name: INIT_ALLOWED_IPS
-              value: 192.168.2.0/24
-            - name: INIT_DNS
-              value: 192.168.2.1
-            - name: INIT_ENABLED
-              value: "true"
-            - name: INIT_HOST
-              value: wg.whyredfire.dev
-            - name: INIT_PORT
-              value: "27299"
-            - name: INIT_USERNAME
-              value: admin
-            - name: OAUTH_AUTO_LAUNCH
-              value: oidc
-            - name: OAUTH_AUTO_REGISTER
-              value: "true"
-            - name: OAUTH_OIDC_CLIENT_ID
-              value: wireguard-admin
-            - name: OAUTH_OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  key: oidc-client-secret
-                  name: wireguard
-            - name: OAUTH_OIDC_NAME
-              value: authentik
-            - name: OAUTH_OIDC_SERVER
-              value: https://auth.whyredfire.dev/application/o/wireguard-admin/
-            - name: OAUTH_PROVIDERS
-              value: oidc
-          image: ghcr.io/wg-easy/wg-easy:15.5.0
-          name: wg-easy
-          ports:
-            - containerPort: 27299
-              name: wireguard
-              protocol: UDP
-            - containerPort: 51821
-              name: http
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 10m
-              memory: 192Mi
-          securityContext:
-            capabilities:
-              add:
-                - NET_ADMIN
-          volumeMounts:
-            - mountPath: /etc/wireguard
-              name: data
-      initContainers:
-        - args:
-            - |
-              # VPN clients may reach the LAN, not this pod or the cluster networks.
-              set -eu
-              iptables-nft -t mangle -A PREROUTING -i wg0 -m addrtype --dst-type LOCAL -j DROP
-              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.42.0.0/16 -j DROP
-              iptables-nft -t mangle -A PREROUTING -i wg0 -d 10.43.0.0/16 -j DROP
-          command:
-            - /bin/sh
-            - -c
-          image: ghcr.io/wg-easy/wg-easy:15.5.0
-          name: firewall
-          securityContext:
-            capabilities:
-              add:
-                - NET_ADMIN
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: wireguard-data

apps/wireguard/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - service-admin.yaml
-  - httproute.yaml
-  - networkpolicy.yaml

apps/wireguard/networkpolicy.yaml

@@ -1,60 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: wireguard
-  namespace: wireguard
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 8000
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik
-    - to:
-        - ipBlock:
-            cidr: 192.168.2.0/24
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-      ports:
-        - port: 27299
-          protocol: UDP
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 51821
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: wireguard
-  policyTypes:
-    - Ingress
-    - Egress

apps/wireguard/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wireguard-data
-  namespace: wireguard
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 100Mi

apps/wireguard/sealed-secret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: wireguard
-  namespace: wireguard
-spec:
-  encryptedData:
-    oidc-client-secret: AgDML2QiPv8lLkyYYOXVI7IY+F3F6x4AoJP7OwNWcFzN699HTvud78sYW1zs9P3BX8FfUArkXHZhjG07OyP5HYxtbUvv4t1IyJaMqg1NsBSB9F3QPEVoanrEIwfUbrzbIcCjD9J0RRrf7aBeAL+zTI1odEOFQhdXwrwEliombjLTcjMMBZGW8IVAQ8/2Ip+Vl8fIGpoS0kP6PGW7NZMTehxBMImyLipzJeYrg2gHN8dlHgE+TWKIuAxV0TSmWV+QvjW6ivSWEwDOabGvQ9GxH3DCwSvPM4kEm5SfFXodzyEvFVsK0MFyY/TvsIU8kursZrSWNlhu437ncjPp4H9X/AYikYHqUnx0hbLRqspIP8OmdNu4A3VdQjGVJcqwsSWmKBIpXrKaoO2GmQQWKKhmbFfgJaCXDmnPBG1A4ngLnNzFdG4JuT5zZwfQRLe0BHxkVbTaN2MtsU47G2dS55TXoJk8q54Gi/buarf0eNj515DsgiI/CqaUchp3I9U+SWC4cHtAF8EncC1qbfqtMTpI/mEsK+L3RxKZFq0EPXmrOLYbrqjA4H44l7cdg8/3aVxmILCh0wleytUuYnQG0u1+vNk/5H73F+RZQT2UbOzQZ5VVIvzT1vNgu8EAfX8+HWvbRANuGB+4hAdOLv73myL2qnxyz3N5btXFOGbjDjAkxeLKf/qEsAXUBPiBGPh5NEdCEgMSzrgvdtfzQ/BzT8i0xUPBzjVvXAQQckOprZAuz9IOq5N4Ug7VRFgktyDpzQ2acpcWuxeq4opfrj5PGM5rUPkv
-  template:
-    metadata:
-      name: wireguard
-      namespace: wireguard

apps/wireguard/service-admin.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: wireguard-admin
-  namespace: wireguard
-spec:
-  ports:
-    - name: http
-      port: 51821
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: wireguard

apps/wireguard/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: wireguard
-  namespace: wireguard
-spec:
-  externalIPs:
-    - 192.168.2.5
-  ports:
-    - name: wireguard
-      port: 51820
-      protocol: UDP
-      targetPort: wireguard
-  selector:
-    app.kubernetes.io/name: wireguard

argocd-apps/add-ons/alloy.yaml

@@ -1,164 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
-    argocd.argoproj.io/sync-wave: "4"
-  name: alloy
-  namespace: argocd
-spec:
-  destination:
-    namespace: monitoring
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    chart: alloy
-    helm:
-      values: |
-        # Discovers pods through the API and pushes their logs to Loki
-        networkPolicy:
-          enabled: true
-          ingress: []
-          egress:
-            - ports:
-                - port: 53
-                  protocol: UDP
-                - port: 53
-                  protocol: TCP
-              to:
-                - namespaceSelector:
-                    matchLabels:
-                      kubernetes.io/metadata.name: kube-system
-                  podSelector:
-                    matchLabels:
-                      k8s-app: kube-dns
-            - ports:
-                - port: 6443
-                  protocol: TCP
-            - ports:
-                - port: 3100
-                  protocol: TCP
-              to:
-                - podSelector:
-                    matchLabels:
-                      app.kubernetes.io/name: loki
-        alloy:
-          configMap:
-            content: |
-              discovery.kubernetes "pods" {
-                role = "pod"
-                namespaces {
-                  names = ["garage", "postgres", "redoost", "traefik"]
-                }
-                selectors {
-                  role  = "pod"
-                  field = "spec.nodeName=" + sys.env("HOSTNAME")
-                }
-              }
-
-              discovery.relabel "pods" {
-                targets = discovery.kubernetes.pods.targets
-
-                rule {
-                  source_labels = ["__meta_kubernetes_namespace"]
-                  target_label  = "namespace"
-                }
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_name"]
-                  target_label  = "pod"
-                }
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_controller_name"]
-                  target_label  = "workload"
-                }
-                // A deployment owns its pods through a ReplicaSet named <deployment>-<hash>.
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_controller_kind", "__meta_kubernetes_pod_controller_name"]
-                  regex         = "ReplicaSet;(.+)-[a-z0-9]+"
-                  target_label  = "workload"
-                }
-                // A cronjob's runs are Jobs named <cronjob>-<timestamp>.
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_controller_kind", "__meta_kubernetes_pod_controller_name"]
-                  regex         = "Job;(.+)-[0-9]+"
-                  target_label  = "workload"
-                }
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_container_name"]
-                  target_label  = "container"
-                }
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name", "__meta_kubernetes_pod_label_app"]
-                  regex         = "^;*([^;]+)(;.*)?$"
-                  target_label  = "app"
-                }
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_node_name"]
-                  target_label  = "node"
-                }
-                rule {
-                  source_labels = ["__meta_kubernetes_pod_uid", "__meta_kubernetes_pod_container_name"]
-                  separator     = "/"
-                  replacement   = "/var/log/pods/*$1/*.log"
-                  target_label  = "__path__"
-                }
-              }
-
-              local.file_match "pods" {
-                path_targets = discovery.relabel.pods.output
-              }
-
-              loki.source.file "pods" {
-                targets    = local.file_match.pods.targets
-                forward_to = [loki.process.pods.receiver]
-              }
-
-              loki.process "pods" {
-                stage.cri {}
-                // Changes on every rotation and would start a new stream.
-                stage.label_drop {
-                  values = ["filename"]
-                }
-                forward_to = [loki.write.default.receiver]
-              }
-
-              loki.write "default" {
-                endpoint {
-                  url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
-                }
-              }
-          mounts:
-            varlog: true
-            extra:
-              - name: storage
-                mountPath: /var/lib/alloy
-          # Tail positions survive pod restarts, so logs are not shipped twice.
-          storagePath: /var/lib/alloy
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-        configReloader:
-          resources:
-            limits:
-              cpu: 50m
-              memory: 100Mi
-        controller:
-          volumes:
-            extra:
-              - name: storage
-                hostPath:
-                  path: /var/lib/alloy
-                  type: DirectoryOrCreate
-    repoURL: https://grafana.github.io/helm-charts
-    targetRevision: 1.13.1
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/anubis-operator.yaml

@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  name: anubis-operator
+  namespace: argocd
+spec:
+  destination:
+    namespace: anubis-operator-system
+    server: https://kubernetes.default.svc
+  project: default
+  source:
+    kustomize:
+      images:
+        - public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
+    path: config/default
+    repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
+    targetRevision: v0.4.4
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

argocd-apps/add-ons/argocd-dashboard.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "3"
   name: argocd-dashboard
   namespace: argocd
@@ -12,7 +11,7 @@ spec:
     server: https://kubernetes.default.svc
   project: default
   source:
-    path: add-ons/argocd-dashboard
+    path: infra/argocd-dashboard
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
   syncPolicy:
@@ -21,4 +20,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/argocd-image-updater.yaml

@@ -1,35 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
-    argocd.argoproj.io/sync-wave: "1"
-  name: argocd-image-updater
-  namespace: argocd
-spec:
-  destination:
-    namespace: argocd
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: argocd-image-updater
-      repoURL: https://argoproj.github.io/argo-helm
-      targetRevision: 1.4.0
-      helm:
-        values: |
-          resources:
-            limits:
-              cpu: 200m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 64Mi
-    - path: add-ons/argocd-image-updater
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - ServerSideApply=true

argocd-apps/add-ons/argocd-repos.yaml

@@ -2,17 +2,16 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
+    argocd.argoproj.io/sync-wave: "1"
-    argocd.argoproj.io/sync-wave: "3"
+  name: argocd-repos
-  name: pgweb
   namespace: argocd
 spec:
   destination:
-    namespace: pgweb
+    namespace: argocd
     server: https://kubernetes.default.svc
   project: default
   source:
-    path: apps/pgweb
+    path: infra/argocd-repos
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
   syncPolicy:
@@ -21,4 +20,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/authentik.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "2"
   name: authentik
   namespace: argocd
@@ -28,18 +27,10 @@ spec:
                   name: authentik-secrets
           blueprints:
             configMaps:
-              - blueprint-argocd
+              - authentik-blueprints
-              - blueprint-garage-ui
-              - blueprint-google-login
-              - blueprint-grafana
-              - blueprint-outpost
-              - blueprint-pgweb
-              - blueprint-qbittorrent
-              - blueprint-wireguard-admin
           server:
             resources:
               limits:
-                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 100m
@@ -47,14 +38,13 @@ spec:
           worker:
             resources:
               limits:
-                cpu: 1000m
                 memory: 1Gi
               requests:
                 cpu: 50m
                 memory: 384Mi
       repoURL: https://charts.goauthentik.io
       targetRevision: 2026.8.3
-    - path: add-ons/authentik
+    - path: infra/authentik
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
   syncPolicy:
@@ -63,4 +53,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/cert-manager.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "1"
   name: cert-manager
   namespace: argocd
@@ -22,50 +21,9 @@ spec:
             kind: ControllerConfiguration
             featureGates:
               ExperimentalGatewayAPISupport: true
-          resources:
-            limits:
-              cpu: 200m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 64Mi
-          # The chart's egress fits the controller: ACME and Cloudflare on 443,
-          # DNS-01 propagation checks on 53, and the API on 6443
-          networkPolicy:
-            enabled: true
-          cainjector:
-            # Only talks to the API
-            networkPolicy:
-              enabled: true
-              egress:
-                - ports:
-                    - port: 6443
-                      protocol: TCP
-            resources:
-              limits:
-                cpu: 200m
-                memory: 256Mi
-              requests:
-                cpu: 10m
-                memory: 64Mi
-          webhook:
-            # Only talks to the API
-            networkPolicy:
-              enabled: true
-              egress:
-                - ports:
-                    - port: 6443
-                      protocol: TCP
-            resources:
-              limits:
-                cpu: 200m
-                memory: 128Mi
-              requests:
-                cpu: 10m
-                memory: 32Mi
       repoURL: https://charts.jetstack.io
-      targetRevision: v1.21.2
+      targetRevision: v1.21.1
-    - path: add-ons/cert-manager
+    - path: infra/cert-manager
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
   syncPolicy:

argocd-apps/add-ons/cnpg.yaml

@@ -2,7 +2,6 @@ apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
   annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
     argocd.argoproj.io/sync-wave: "0"
   name: cnpg
   namespace: argocd
@@ -11,25 +10,15 @@ spec:
     namespace: cnpg-system
     server: https://kubernetes.default.svc
   project: default
-  sources:
+  source:
-    - chart: cloudnative-pg
+    chart: cloudnative-pg
-      helm:
+    helm:
-        values: |
+      values: |
-          replicaCount: 1
+        replicaCount: 1
-          config:
+        config:
-            clusterWide: true
+          clusterWide: true
-          resources:
+    repoURL: https://cloudnative-pg.github.io/charts
-            limits:
+    targetRevision: 0.29.0
-              cpu: 500m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 64Mi
-      repoURL: https://cloudnative-pg.github.io/charts
-      targetRevision: 0.29.1
-    - path: add-ons/cnpg
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/kube-prometheus-stack.yaml

@@ -1,262 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
-    argocd.argoproj.io/sync-wave: "3"
-  name: kube-prometheus-stack
-  namespace: argocd
-spec:
-  destination:
-    namespace: monitoring
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: kube-prometheus-stack
-      helm:
-        values: |
-          alertmanager:
-            enabled: false
-          # Only node-exporter and cAdvisor are scraped.
-          defaultRules:
-            create: false
-          kubelet:
-            serviceMonitor:
-              interval: 60s
-              kubelet: false
-              probes: false
-              cAdvisorMetricRelabelings:
-                - action: keep
-                  sourceLabels: [__name__]
-                  regex: container_(cpu_usage_seconds_total|memory_working_set_bytes)
-                - action: drop
-                  sourceLabels: [id, pod]
-                  regex: .+;
-          kubeApiServer:
-            enabled: false
-          kubeControllerManager:
-            enabled: false
-          kubeScheduler:
-            enabled: false
-          kubeProxy:
-            enabled: false
-          kubeEtcd:
-            enabled: false
-          coreDns:
-            enabled: false
-          kubeStateMetrics:
-            enabled: false
-          prometheusOperator:
-            # The chart's policy only limits ingress to the webhook; egress stays open
-            networkPolicy:
-              enabled: true
-            admissionWebhooks:
-              certManager:
-                enabled: true
-            resources:
-              limits:
-                cpu: 200m
-                memory: 256Mi
-              requests:
-                cpu: 20m
-                memory: 64Mi
-            prometheusConfigReloader:
-              resources:
-                limits:
-                  cpu: 50m
-                  memory: 64Mi
-                requests:
-                  cpu: 10m
-                  memory: 32Mi
-            serviceMonitor:
-              selfMonitor: false
-          prometheus-node-exporter:
-            # CPU, memory, disks, network and temperature.
-            extraArgs:
-              - --collector.disable-defaults
-              - --collector.cpu
-              - --collector.meminfo
-              - --collector.filesystem
-              - --collector.netdev
-              - --collector.hwmon
-              - --web.disable-exporter-metrics
-              # The chart's defaults, as lists are replaced.
-              - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)
-              - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$
-              - --collector.netdev.device-exclude=^(veth.*|br-.*|docker0|cni0|lo)$
-            prometheus:
-              monitor:
-                # Collectors report more than these, like per-chip sensor labels.
-                metricRelabelings:
-                  - action: keep
-                    sourceLabels: [__name__]
-                    regex: node_(cpu_seconds_total|memory_(MemAvailable|MemTotal)_bytes|filesystem_(avail|size)_bytes|network_(receive|transmit)_bytes_total|hwmon_temp_celsius)
-            resources:
-              limits:
-                cpu: 200m
-                memory: 128Mi
-              requests:
-                cpu: 20m
-                memory: 32Mi
-          prometheus:
-            # Only Grafana queries it; it scrapes the kubelet and node-exporter on the
-            # node, matched by port so no node IP is needed
-            networkPolicy:
-              enabled: true
-              ingress:
-                - from:
-                    - podSelector:
-                        matchLabels:
-                          app.kubernetes.io/name: grafana
-                  ports:
-                    - port: 9090
-                      protocol: TCP
-              egress:
-                - ports:
-                    - port: 53
-                      protocol: UDP
-                    - port: 53
-                      protocol: TCP
-                  to:
-                    - namespaceSelector:
-                        matchLabels:
-                          kubernetes.io/metadata.name: kube-system
-                      podSelector:
-                        matchLabels:
-                          k8s-app: kube-dns
-                - ports:
-                    - port: 6443
-                      protocol: TCP
-                    - port: 9100
-                      protocol: TCP
-                    - port: 10250
-                      protocol: TCP
-            serviceMonitor:
-              selfMonitor: false
-            prometheusSpec:
-              scrapeInterval: 60s
-              retention: 90d
-              retentionSize: 45GB
-              # Pick up monitors and rules from every namespace, not just this release.
-              podMonitorSelectorNilUsesHelmValues: false
-              probeSelectorNilUsesHelmValues: false
-              ruleSelectorNilUsesHelmValues: false
-              scrapeConfigSelectorNilUsesHelmValues: false
-              serviceMonitorSelectorNilUsesHelmValues: false
-              resources:
-                limits:
-                  cpu: "1"
-                  memory: 3Gi
-                requests:
-                  cpu: 200m
-                  memory: 1Gi
-              storageSpec:
-                volumeClaimTemplate:
-                  spec:
-                    accessModes:
-                      - ReadWriteOnce
-                    resources:
-                      requests:
-                        storage: 50Gi
-          grafana:
-            # The chart takes one list of egress ports for every destination: OIDC
-            # on 443, Loki, Postgres, the API for the sidecars, and Prometheus
-            networkPolicy:
-              enabled: true
-              allowExternal: false
-              explicitNamespacesSelector:
-                matchLabels:
-                  kubernetes.io/metadata.name: traefik
-              egress:
-                enabled: true
-                ports:
-                  - port: 443
-                    protocol: TCP
-                  - port: 3100
-                    protocol: TCP
-                  - port: 5432
-                    protocol: TCP
-                  - port: 6443
-                    protocol: TCP
-                  - port: 9090
-                    protocol: TCP
-            admin:
-              existingSecret: grafana-admin
-            additionalDataSources:
-              - name: Loki
-                type: loki
-                uid: loki
-                url: http://loki.monitoring.svc.cluster.local:3100
-                isDefault: true
-            defaultDashboardsEnabled: false
-            envValueFrom:
-              GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
-                secretKeyRef:
-                  name: grafana-oidc
-                  key: client-secret
-              GF_DATABASE_PASSWORD:
-                secretKeyRef:
-                  name: grafana-db
-                  key: password
-            grafana.ini:
-              database:
-                type: postgres
-                host: postgres-rw.postgres.svc.cluster.local:5432
-                name: grafana
-                user: grafana
-                ssl_mode: require
-              server:
-                root_url: https://grafana.whyredfire.dev
-              auth:
-                # Break-glass admin login stays reachable at /login?disableAutoLogin=true
-                oauth_auto_login: true
-                signout_redirect_url: https://auth.whyredfire.dev/application/o/grafana/end-session/
-              auth.generic_oauth:
-                enabled: true
-                name: Authentik
-                client_id: grafana
-                scopes: openid profile email
-                auth_url: https://auth.whyredfire.dev/application/o/authorize/
-                token_url: https://auth.whyredfire.dev/application/o/token/
-                api_url: https://auth.whyredfire.dev/application/o/userinfo/
-                use_pkce: true
-                login_attribute_path: preferred_username
-                role_attribute_path: contains(groups, 'admins') && 'Admin'
-                role_attribute_strict: true
-            resources:
-              limits:
-                cpu: 500m
-                memory: 768Mi
-              requests:
-                cpu: 50m
-                memory: 256Mi
-            serviceMonitor:
-              enabled: false
-            sidecar:
-              datasources:
-                alertmanager:
-                  enabled: false
-                isDefaultDatasource: false
-              dashboards:
-                searchNamespace: ALL
-              resources:
-                limits:
-                  cpu: 100m
-                  memory: 256Mi
-                requests:
-                  cpu: 10m
-                  memory: 64Mi
-            testFramework:
-              enabled: false
-      repoURL: https://prometheus-community.github.io/helm-charts
-      targetRevision: 92.3.0
-    - path: add-ons/kube-prometheus-stack
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/kustomization.yaml

@@ -1,14 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - alloy.yaml
+  - anubis-operator.yaml
   - argocd-dashboard.yaml
-  - argocd-image-updater.yaml
+  - argocd-repos.yaml
   - authentik.yaml
   - cert-manager.yaml
   - cnpg.yaml
-  - kube-prometheus-stack.yaml
-  - loki.yaml
   - postgres.yaml
   - sealed-secrets.yaml
   - traefik.yaml

argocd-apps/add-ons/loki.yaml

@@ -1,129 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
-    argocd.argoproj.io/sync-wave: "4"
-  name: loki
-  namespace: argocd
-spec:
-  destination:
-    namespace: monitoring
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: loki
-      helm:
-        values: |
-          # Garage on 3900; the rules sidecar watches the API, which only the
-          # discovery port can allow
-          networkPolicy:
-            enabled: true
-            externalStorage:
-              ports:
-                - 3900
-            discovery:
-              port: 6443
-          loki:
-            auth_enabled: false
-            commonConfig:
-              replication_factor: 1
-            schemaConfig:
-              configs:
-                - from: "2026-09-01"
-                  store: tsdb
-                  object_store: s3
-                  schema: v13
-                  index:
-                    prefix: loki_index_
-                    period: 24h
-            storage:
-              bucketNames:
-                chunks: loki
-                ruler: loki
-              s3:
-                endpoint: http://garage.garage.svc.cluster.local:3900
-                region: garage
-                accessKeyId: ${LOKI_S3_ACCESS_KEY_ID}
-                secretAccessKey: ${LOKI_S3_SECRET_ACCESS_KEY}
-                s3ForcePathStyle: true
-                insecure: true
-            ingester:
-              chunk_encoding: zstd
-            compactor:
-              retention_enabled: true
-              delete_request_store: s3
-            limits_config:
-              retention_period: 2160h
-          singleBinary:
-            replicas: 1
-            extraEnvFrom:
-              - secretRef:
-                  name: loki-s3
-            resources:
-              limits:
-                cpu: "1"
-                memory: 2Gi
-              requests:
-                cpu: 100m
-                memory: 512Mi
-          # Memory limits sit ~20% above memcached's allocation.
-          chunksCache:
-            allocatedMemory: 512
-            resources:
-              limits:
-                cpu: 500m
-                memory: 614Mi
-              requests:
-                cpu: 50m
-                memory: 614Mi
-          resultsCache:
-            allocatedMemory: 128
-            resources:
-              limits:
-                cpu: 500m
-                memory: 154Mi
-              requests:
-                cpu: 50m
-                memory: 154Mi
-          memcachedExporter:
-            resources:
-              limits:
-                cpu: 100m
-                memory: 64Mi
-              requests:
-                cpu: 10m
-                memory: 16Mi
-          sidecar:
-            resources:
-              limits:
-                cpu: 100m
-                memory: 256Mi
-              requests:
-                cpu: 10m
-                memory: 64Mi
-          # Grafana and Alloy talk to Loki directly, there is a single tenant.
-          gateway:
-            enabled: false
-          lokiCanary:
-            enabled: false
-          test:
-            enabled: false
-          backend:
-            replicas: 0
-          read:
-            replicas: 0
-          write:
-            replicas: 0
-      repoURL: https://grafana-community.github.io/helm-charts
-      targetRevision: 18.15.1
-    - path: add-ons/loki
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true