chore(apps): Add network policies to standalone apps

add-ons/argocd-image-updater/ghcr-sealedsecret.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: ghcr-pull
-  namespace: argocd
-spec:
-  encryptedData:
-    .dockerconfigjson: AgCRsZSHP+T0U4pLck8AJ++dCb47OklXOgediZXPUSENy2/W/o4ooDgr+vP9GmSMoSm/5FBahmiSF8WYth0TYL4bdTKMQfnFO4kAOxk5QXuyyaKL+ZxL3XFfKRUeVD4m+HFJrvUsHC36TeJy0SYwkaS5isWdNTPFPdNRhXQ9OiTKQlL2tPZgOzk48CH5wDCugI3uC6/1tuzoeNzbIWRFpbkDtwhdGBqnZIiZZhOliXBV5wGnEcPKpxBnE21PNBsr2A8/lisuTsmcsyZDj3uenLjcdITdTs57sss8HPEI9u+cIuNFCZVO/URtJEV1k24oEr3CAPJojic6vT6jS0Ow9H3VEJpEObAN4E02+yC/gZjkLOBSO9aq77SzVRJpTxmcuW4s2U91hegYzS33H0jBCB1EJ5y/rYZUFrdBQnr16gENbMo8HuYf0jnogDvyGjd4Kf4HWDl97yiOv2xdm7Jb3MBrgyCQSw2uU4QpvgwGpTCo8j3LrfqQjBZRyTn/HplLO+zGkQKcqsNosZ0a+fm990gDWEgBuNjf/2iVLsYMJrz8da3Fu4k2TTtzxtAZ0eFJbxa97CRC3d/4nx/vS/S3zTzoXhp2XHdlG3RfurrKKtxeretRlTtbTM8CjahMB0/oLgBKSaNs5gEtvaATKe8jBfAw+WHxCFJC+0Jxj8IfDq0KWv2I1OO2r+7TK+o2Ed/7SucJQd4e4NQJfWQW/xiq4RL3StJdO3WXcICloslTMtE9EaZn/w/dx98bLRus9mrkom+tPSHw63tHPn6C4B75Ya8qA5LSBylMEZXg8CG5xfqmR3C0F/c4XCYerfbzNg88AIw2VBsAgW6aySCkZCa9rkaCx5AyzblCVQxGZ+PpR0RdaBkuT2hXoWHBZZu9Dmhk6Qr1HyqCBaV2DmsYFcYB+pfHUKzT0BAWO7BdbiLFil0V779JZw==
-  template:
-    metadata:
-      name: ghcr-pull
-      namespace: argocd
-    type: kubernetes.io/dockerconfigjson

add-ons/argocd-image-updater/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ghcr-sealedsecret.yaml
-  - pixelos-applications.yaml
-  - redoost.yaml

add-ons/argocd-image-updater/pixelos-applications.yaml

@@ -1,16 +0,0 @@
-apiVersion: argocd-image-updater.argoproj.io/v1alpha1
-kind: ImageUpdater
-metadata:
-  name: pixelos-applications
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  applicationRefs:
-    - namePattern: pixelos-applications
-      images:
-        - alias: app
-          imageName: ghcr.io/pixelos-ci/applications:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-            pullSecret: pullsecret:argocd/ghcr-pull

add-ons/argocd-image-updater/redoost.yaml

@@ -1,27 +0,0 @@
-apiVersion: argocd-image-updater.argoproj.io/v1alpha1
-kind: ImageUpdater
-metadata:
-  name: redoost
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  applicationRefs:
-    - namePattern: redoost
-      images:
-        - alias: api
-          imageName: ghcr.io/whyredfire/redoost-api:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-          manifestTargets:
-            helm:
-              name: api.image.repository
-              tag: api.image.tag
-        - alias: frontend
-          imageName: ghcr.io/whyredfire/redoost-frontend:latest
-          commonUpdateSettings:
-            updateStrategy: digest
-          manifestTargets:
-            helm:
-              name: frontend.image.repository
-              tag: frontend.image.tag

add-ons/authentik/blueprint-jellyfin-ldap.yaml

@@ -1,116 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: blueprint-jellyfin-ldap
-  namespace: authentik
-data:
-  jellyfin-ldap.yaml: |
-    version: 1
-    metadata:
-      name: Jellyfin LDAP
-    entries:
-      - model: authentik_stages_password.passwordstage
-        id: ldap-password
-        identifiers:
-          name: ldap-authentication-password
-        attrs:
-          backends:
-            - authentik.core.auth.InbuiltBackend
-            - authentik.core.auth.TokenBackend
-      - model: authentik_stages_identification.identificationstage
-        id: ldap-identification
-        identifiers:
-          name: ldap-authentication-identification
-        attrs:
-          user_fields:
-            - username
-          password_stage: !KeyOf ldap-password
-      - model: authentik_stages_user_login.userloginstage
-        id: ldap-login
-        identifiers:
-          name: ldap-authentication-login
-      - model: authentik_flows.flow
-        id: ldap-flow
-        identifiers:
-          slug: ldap-authentication
-        attrs:
-          designation: authentication
-          name: LDAP bind
-          title: LDAP bind
-      - model: authentik_flows.flowstagebinding
-        identifiers:
-          order: 10
-          stage: !KeyOf ldap-identification
-          target: !KeyOf ldap-flow
-      - model: authentik_flows.flowstagebinding
-        identifiers:
-          order: 30
-          stage: !KeyOf ldap-login
-          target: !KeyOf ldap-flow
-      - model: authentik_core.user
-        id: ldap-jellyfin
-        identifiers:
-          username: ldap-jellyfin
-        attrs:
-          name: Jellyfin LDAP bind
-          password: !Env JELLYFIN_LDAP_PASSWORD
-      - model: authentik_providers_ldap.ldapprovider
-        id: jellyfin-ldap-provider
-        identifiers:
-          name: jellyfin-ldap
-        attrs:
-          authorization_flow: !KeyOf ldap-flow
-          invalidation_flow: !Find [authentik_flows.flow, [slug, default-invalidation-flow]]
-          base_dn: dc=ldap,dc=goauthentik,dc=io
-          certificate: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
-          bind_mode: direct
-          search_mode: direct
-          mfa_support: false # else ";" in a password is read as a TOTP separator
-        permissions:
-          - permission: authentik_providers_ldap.search_full_directory
-            user: !KeyOf ldap-jellyfin
-      - model: authentik_core.application
-        id: jellyfin-ldap
-        identifiers:
-          slug: jellyfin-ldap
-        attrs:
-          name: Jellyfin LDAP
-          provider: !KeyOf jellyfin-ldap-provider
-          policy_engine_mode: any
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 0
-          target: !KeyOf jellyfin-ldap
-        attrs:
-          group: !Find [authentik_core.group, [name, admins]]
-      - model: authentik_policies.policybinding
-        identifiers:
-          order: 10
-          target: !KeyOf jellyfin-ldap
-        attrs:
-          user: !KeyOf ldap-jellyfin
-      - model: authentik_outposts.outpost
-        identifiers:
-          name: ldap
-        attrs:
-          type: ldap
-          service_connection: !Find [authentik_outposts.kubernetesserviceconnection, [name, Local Kubernetes Cluster]]
-          providers:
-            - !KeyOf jellyfin-ldap-provider
-          config:
-            authentik_host: http://authentik-server.authentik.svc.cluster.local
-      - model: authentik_core.user
-        identifiers:
-          username: whyredfire
-        attrs:
-          attributes:
-            jellyfinUsername: karan
-      - model: authentik_core.token
-        identifiers:
-          identifier: jellyfin-whyredfire
-        attrs:
-          user: !Find [authentik_core.user, [username, whyredfire]]
-          intent: app_password
-          key: !Env JELLYFIN_APP_PASSWORD
-          expiring: false
-          description: Jellyfin

add-ons/authentik/kustomization.yaml

@@ -6,11 +6,9 @@ resources:
   - blueprint-garage-ui.yaml
   - blueprint-google-login.yaml
   - blueprint-grafana.yaml
-  - blueprint-jellyfin-ldap.yaml
   - blueprint-outpost.yaml
   - blueprint-pgweb.yaml
   - blueprint-qbittorrent.yaml
   - blueprint-wireguard-admin.yaml
   - httproute.yaml
   - referencegrant.yaml
-  - networkpolicy.yaml

add-ons/authentik/networkpolicy.yaml

@@ -1,57 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: authentik
-  namespace: authentik
-spec:
-  egress:
-    - to:
-        - podSelector: {}
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 5432
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: postgres
-          podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - podSelector: {}
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 9000
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/authentik/sealed-secret.yaml

@@ -12,8 +12,6 @@ spec:
     GOOGLE_CLIENT_ID: AgDOTuDt2E53pPy4ZL+VC6Gvb1I+kuL6ziDjOwWM+CkDpxuBSNxdsCOZap+TWMjOUhxgxev9mhijBTN1DuTtcnLNZopX0Rm2ZtVIq+k3Mm0a6cI6AZCi4nBbiAsNXCx1fUHz00b7meG/hVi6UB4skPR1VFdIu5LZ3QZo3GS5cZ7PMRmCq0UIrP74Hhvlz9CpC2nTPYRx/SsBbbcjYh/DIS6FWiwm8GuIE60Mt9tiiG3Yntb5YF0ZibmEcPzcFfNdxD2uEqTMNOPR0PwbEjdd83LOLLI37/OyW5C0uZIMofjeIx6JuipSaG758kLRfBWXewWSN0BPJIUrKBD7xbZaJ9l25UbpJSB1dZX5nKNh4cRi3xpbdzS4JqhNcytmUgO43NglV0AkiEY2PGzuqj0RiZPlDu0lAEh14cI5SYXAVzlapxE/Zq/DCYBdUYN4Qg6G4hTLNv1wsA/UK8O7KExQ4JqgEfQYyhykMlFdXHERdY1AvhapcTO+KbX1wvU+gVg1GgBz1V+iCWeuxzFwvNDoepCc8rsPUVRr86MCDIKT/I4RTwLNsFyG2Igcj+C1GcoPwMJEY7pJorVBFLYd7Czp2PVm1t1s4Tk+ad+hkURYLnOenOAmSAgUUIYKDxAyxAzzKLOQYxtYKrXw1QmSlaIgz70TAWsBUIimu5/5mC9C6rBcm6soi9hBm207kAkS4h1TlsHdigstJOLggO3ajZMrEqTN0IQFQKP0/SlO7qaHD2R0VW+J8D1C3XhKTeH+XJNIH+JyCD18iDfLXINJ2frfWcvtDPCVzKQMJtM=
     GOOGLE_CLIENT_SECRET: AgDYAawB7EWhFwOTmRWP8MBjhslEZr9iq+wkOFbYmsDAnW3ADa9g7JILJn33eWG6jTjTE3SH/K0vmhqE+cppCyUtR9qk1vV+lSxuhrqb68l6J5tYPPY45bwq9Ol5Osar6PjuwX5eFLFZwi2hKy61aGH6SzoqJ606hBhMTQijI4X0IYHoEagEg52Fug5y+qEn09CV9Nq9QmaBPJTI8IQfbxqzAVe3E7XMEmjwBBd5pLprOkZAe0cZKFFUx9yRphf8zT8YcxBS+GoiN/Q1lLdQr8fMBWJ3kw5uwmaJwwsGDGyvac9IKGujhlduIba51AfXQ6qels7bqpvN67MmoL5f+j5vT7pB4c3fNNyqkx9Bu8d1dhoZqpaWEa75c2hIlwSMZYOSB1p8lwulzFIyehkuRgGeJqosjmKw0cIspLM/wLXV3MSeGG32opltOW2CtyaK4B7JPDvOhS7M8vjhsP/FxpAfkeQO4GIVS7WbM7sN5i9oAVit/RRhoN1IkZ8+8KEl1B1AkOu6vOCfgMyd0wM3E1EfIN21HyaGZGR5gBLyLl1vKv0TtmH5RJgOkwKmEi5yUL7pyhHLeGuDprtQmt2+l+hFn1xAEN7SHhrynUBFu4ZXfa18q1wcr83trbbl940OB3Xpcu6E2/QgWLAnSDioYyqQXaXXJ9HMddydbSHrYe4/yo2N3katZ3YuZQLZOyl/4eLduWN7jcKMexKU/eLl3Aa9+16mg/g4iMk1WbZTpKGL1GSwAQ==
     GRAFANA_CLIENT_SECRET: AgCuqXVJoaIdMAoQTjSTLM1kVCvi5k+M8sVtg7cBGjMR2/Bry2FdU2fji/ND4A5w2FfSLLHOmC7J704krMzdKkH9+wsmhGoKbZG4Ur4ImBPiDdApE4JPOOrMWtpxnyGmNkPBv16ztmWj+3Q0pyo0fb1+0l2Gg9XnSG8O0vJXTt28IhfuROzh9r5rRaMilUKnIgEnWybgsPbxYUfqPJE7g5wvZIVxOcpiYlJxFC6MkjEkwkUO7TKCqSNbeSeRvhjRbxAd0ZHkrKGZ0LSLpKDBp7ZfRXBasuUy1sfhLTZNtGWS8YhC5YfoizUs13iafFE3acbkJz/DVJ8at0nsJKrxrfjYOv6kce9RSc4j41mBm8NTv8lhNc/qygxKu+BmNWi5go93PPpA1kno6OonwNNy36rSU0PyElXKUmMegsVXnu7sfDjQfld+VzJPQiDK6gdj090mJ7p2LyBmN1QbSJNvGQ0vNGvqxNjiXHlGantMaA/U6Od2B7AYHu447kJNHnya9KWel3eBWaLC12sfSEfwn5EmWe+7w0wyQd6Frgv9BP/EXQ35SQp7p2dA5WJxSI/2vtue98F3bfnvaJLLrPRiZg/Mqz4DSS875ojPtJc2iEyWprziHehk84zIDC/MuxhmJxj8Xh7zh/zHK6qdFEE8NKLtKlfpFbEzs/p2qtkzQUtCXm618rHOQ+7Rh7JI7u/P7tG11NWmKX15dbmT/Z20MLKsUXq+ymfT0nty8h0FbNAfXaiBENEDpMRCLNu+mCMND5nSqATghSvwFGMgaTbbu3OW99fpn/cK5iMNxXIunai7VA==
-    JELLYFIN_APP_PASSWORD: AgCzqHmMF80Bh4OcOl0OStJb/zQk0BKzCjIblpELwMLsAuBtIOO0OK/IYrjlCO0T8Vn9jd00LQI1m7R5d+vCxcwbQVNhyw1zHDFg1MI28irvdJmp7439Si7R/T+gObB1I2Vww8d9OZJj5Zm9ngQoM+Oh5ne7c/+W7Qc9xgpWBDtcseCX5QDA1Uu4TJH1cShDQMPb3+KLq7MlKgoWw5uJZA/dJspdR1eqFyaXGHh+rceMZmzwG8sNz43KtVWKN0u7KrN+OE9RYdreQGCw09Yet8FwYA4+z4pAFbOIhyCfqdEW0uWA95f9PA27Z7GgO/CG2vonv73V7nvItIArPchdzdMwD+/UimLllH70tPB6GfZqMsU4FnwdhAyl/UhVO4/PILNZFyyku3SfWtIc2GAf8w0i7KB/zSZoo+HdrGsG8i5020XOG9lIqH/vNTeU4zPBWROEtCKzPjmewBdR2CmGtDu4RrN3XHK5sljwXU3o5QucrD9k8RZ+TjQh6dk/cp373xB1ywMAF9+NmFalnIy4RXJSvjh2H5NLrFFty2vxLqsrVNYdlc8UjNOB06pCnugMBBCx9UIc92ntfoMCmdK7EsUguYB7KWbygbBMfVZ/PusWNMFpmqca5LzcQnoYVKtExRzfofftws9yd0zyQ1MnrEHAC28GlJjYKoIfP/8Tkvah68w9dIoiJ2cIgwkU41JiJ9tjRDIYdvIDBZUPKl3gDF6hbb1K+XbjrEHP5FAZ3Dul0uts2BxRbxBi
-    JELLYFIN_LDAP_PASSWORD: AgAmgR2Br9bWrqKtnUmcbicWUqVPcgVGLOgTkEhiC5rQPr2W/VXQDecb5ErIfl7XmvhyjMh/4lVymaUntpvD7tYGh0F5IeFTe9NVGL1ssanH7YqY4vQAfDdgQYOWUzl4cC5Lo79bUQcNk31YuJkqDlEiHXWv8W7u0L7X3ijbMvFcgkMwPgZuHPAwJGB9Uok2odtAeSCIQDZ/ri+TfSAqD4rBqKbvueP1o+bkNXN8qai1obvTtPH7NrTy4Qi0JAGQUu43RtTzjxoSaqr3Xq7Z9l+HvYJTxqRUhrNkME378OvNqcH6ob0J6siFyiMJnzfGw2BzhzJ11Y9PEVnzL8c3fC/VtF7bErhid/x9OzFf4qBs9ba1S/710P5BB1cqI8MmqGvc1vIHeH/J8AyWkbWGPqLdsqLZ4k5lcwDJ67R6RwMQIivc2oaUQJnBU2IEzT+EydAyzSMO/Obfc32UFuk64B0IigsXKii274r1tAxa3Ua8lvpi1rQkqhx6Fe8Nwkvxe116gLjWKqBiJ6dTPMuwvt3OkRjMpKBs9AH9V8t90lWqO4cBGd1kZYKTcAHyQkIM8XqIiOuwyzjuW8Kxjl7skT9DuV+X6GLWoUnZNpo16Vu4OUigWb7uuNuMcp1bI7fX0U0CR1H58h1dAUfLRGP06tOK8xakrmmsC/QCu8ErC2broAPOWKLsFQVRafiSjRcvQ7z2OcN/JHLAPeJUJcFVhdTJSpVQa41KW3MX9uFO8oXLLyQSrFFrKF7Y
     WIREGUARD_CLIENT_SECRET: AgChVcZeF7KFvb0r9dkUg+53Rx7owhpI+ttOsTZ2Bd6h8Luike/g2Fj0wbBJqOeIqQIHGCHXB+lZ1wZHG8kL4BeDseMt5v22w8WOffZpfwcFtx9AYKjvKeNldFuFnaQjQbSigYJY1fFZXObn7tMB0zppSHb93G1q7r3/JsseXIrsBGFY2cHakE1gu+NC9glIdQLByxQzTrdHF/92bHsOcLa1Bqqtihxrfy2wBAykZloiyNIj+bhD1EIpCjHB2Dx5Cu5Sqz+lguHOIAs1jOaxA1NGjQJADo0+w5prtUhuB57nNHQrOLFzZyJqHr59ENYjsrz6jmroCuffbjyI0aKsCn/82oWfJzoSKvMGI9PnS9CzoGC+mKu2FWvDvdTvultGy0lk4m6pvNQIxUz+PPNUeagS43e6xiGgHKKaBZf0r5cWqFtbSrYl8hn0Fw7u3A0c+7N5/lx2//icrwFfajvF1Rguay1vvhKn1Wl9OSvo9F+Prtm85r4Gu4qsds42TpmTMr7d+fsL4hftGZg4KUdpqAca02uTURkS+3RiSYmTL/D9RrNy34oGuq8KkW4feLfHOub92J7GK/6febePsdyuTE6NCaikWekTPUEtmJAKMgRfZWkc2fL81pLT2QrMq/9DwTelrTLrAA8rtxT5TkN0aIfF+Gn3n1fOhTjYAqzMeKKRyrhODF8D+MKsi3knau2SFPDAJaXTvgInHImqtIL2RBtzv6DvIP8bUkaFLlMiOz0y5tcegzFcsp9HCQ8YjwQcJJb3tavZLe/VWJqOPrRP1+ti
   template:
     metadata:

add-ons/cnpg/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - networkpolicy.yaml

add-ons/cnpg/networkpolicy.yaml

@@ -1,41 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: cnpg
-  namespace: cnpg-system
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - ports:
-        - port: 8000
-          protocol: TCP
-      to:
-        - namespaceSelector: {}
-          podSelector:
-            matchExpressions:
-              - key: cnpg.io/cluster
-                operator: Exists
-  ingress:
-    - ports:
-        - port: 9443
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: cloudnative-pg
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/postgres/kustomization.yaml

@@ -9,4 +9,3 @@ resources:
   - pgweb-db-sealedsecret.yaml
   - redoost-db-sealedsecret.yaml
   - redoost-database.yaml
-  - networkpolicy.yaml

add-ons/postgres/networkpolicy.yaml

@@ -1,72 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: postgres
-  namespace: postgres
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-  ingress:
-    - from:
-        - podSelector:
-            matchLabels:
-              cnpg.io/cluster: postgres
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: cnpg-system
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: cloudnative-pg
-      ports:
-        - port: 8000
-          protocol: TCP
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: authentik
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: authentik
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: monitoring
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: grafana
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: pgweb
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: pgweb
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-      ports:
-        - port: 5432
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      cnpg.io/cluster: postgres
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/traefik/kustomization.yaml

@@ -3,5 +3,3 @@ kind: Kustomization
 resources:
   - wildcard-whyredfire-dev.yaml
   - wildcard-whyredfire-dpdns-org.yaml
-  - wildcard-pixelos-net.yaml
-  - networkpolicy.yaml

add-ons/traefik/networkpolicy.yaml

@@ -1,39 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: traefik
-  namespace: traefik
-spec:
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 6443
-          protocol: TCP
-    - to:
-        - namespaceSelector: {}
-  ingress:
-    - from:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-      ports:
-        - port: 8000
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: traefik
-  policyTypes:
-    - Ingress
-    - Egress

add-ons/traefik/wildcard-pixelos-net.yaml

@@ -1,14 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-pixelos-net
-  namespace: traefik
-spec:
-  dnsNames:
-    - '*.pixelos.net'
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
-  privateKey:
-    rotationPolicy: Always
-  secretName: wildcard-pixelos-net

apps/garage/kustomization.yaml

@@ -4,4 +4,3 @@ resources:
   - httproute-s3.yaml
   - sealed-secret.yaml
   - service-admin.yaml
-  - networkpolicy.yaml

apps/garage/networkpolicy.yaml

@@ -1,44 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: garage
-  namespace: garage
-spec:
-  egress: []
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: monitoring
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: loki
-      ports:
-        - port: 3900
-          protocol: TCP
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: redoost
-      ports:
-        - port: 3902
-          protocol: TCP
-    - from:
-        - podSelector:
-            matchLabels:
-              app.kubernetes.io/name: garage-ui
-      ports:
-        - port: 3903
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: garage
-  policyTypes:
-    - Ingress
-    - Egress

apps/holyarrs/deployment.yaml

@@ -1,74 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: holyarrs
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: holyarrs
-    spec:
-      containers:
-        - env:
-            - name: TZ
-              value: Etc/UTC
-            - name: HOLYARRS_ALLOWED_HOSTS
-              value: holyarrs.whyredfire.dev
-            # Traefik's pods
-            - name: HOLYARRS_TRUSTED_PROXIES
-              value: 10.42.0.0/16
-          image: holyarrs/holyarrs:1.0.9@sha256:3d941aa8a78d4474cc016a0d994b2531aa8692015aaad487cbdee136e8dd4226
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          name: holyarrs
-          ports:
-            - containerPort: 6262
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-          resources:
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-            requests:
-              cpu: 50m
-              memory: 192Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            # Same path as Jellyfin; one mount so imports hardlink instead of copy
-            - mountPath: /media
-              name: media
-      # Owner of /srv/media, same as qBittorrent
-      securityContext:
-        fsGroup: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: holyarrs-config
-        - hostPath:
-            path: /srv/media
-          name: media

apps/holyarrs/httproute.yaml

@@ -1,23 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  hostnames:
-    - holyarrs.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: holyarrs
-          port: 6262
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/holyarrs/kustomization.yaml

@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - httproute.yaml
-  - networkpolicy.yaml

apps/holyarrs/networkpolicy.yaml

@@ -1,62 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  # Metadata and indexers are on the internet; in the cluster it only talks
-  # to Jellyfin and qBittorrent
-  egress:
-    - ports:
-        - port: 53
-          protocol: UDP
-        - port: 53
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: kube-system
-          podSelector:
-            matchLabels:
-              k8s-app: kube-dns
-    - ports:
-        - port: 8096
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: jellyfin
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: jellyfin
-    - ports:
-        - port: 8080
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: qbit
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: qbittorrent
-    - to:
-        - ipBlock:
-            cidr: 0.0.0.0/0
-            except:
-              - 10.0.0.0/8
-              - 172.16.0.0/12
-              - 192.168.0.0/16
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-      ports:
-        - port: 6262
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: holyarrs
-  policyTypes:
-    - Ingress
-    - Egress

apps/holyarrs/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: holyarrs-config
-  namespace: holyarrs
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

apps/holyarrs/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: holyarrs
-  namespace: holyarrs
-spec:
-  ports:
-    - name: http
-      port: 6262
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: holyarrs

apps/jellyfin/kustomization.yaml

@@ -3,5 +3,3 @@ kind: Kustomization
 resources:
   - httproute-local.yaml
   - httproute.yaml
-  - networkpolicy-holyarrs.yaml
-  - networkpolicy-ldap.yaml

apps/jellyfin/networkpolicy-holyarrs.yaml

@@ -1,25 +0,0 @@
-# Lets HolyArrs ask Jellyfin to rescan after imports and sign people in.
-# Adds to the chart's policy, which only admits traefik.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: jellyfin-from-holyarrs
-  namespace: jellyfin
-spec:
-  ingress:
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: holyarrs
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: holyarrs
-      ports:
-        - port: 8096
-          protocol: TCP
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: jellyfin
-      app.kubernetes.io/instance: jellyfin
-  policyTypes:
-    - Ingress

apps/jellyfin/networkpolicy-ldap.yaml

@@ -1,25 +0,0 @@
-# Lets Jellyfin's LDAP plugin reach authentik's LDAP outpost (LDAPS).
-# Adds to the chart's policy, which keeps Jellyfin off the cluster network.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: jellyfin-to-ldap
-  namespace: jellyfin
-spec:
-  egress:
-    - ports:
-        - port: 6636
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: authentik
-          podSelector:
-            matchLabels:
-              goauthentik.io/outpost-name: ldap
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: jellyfin
-      app.kubernetes.io/instance: jellyfin
-  policyTypes:
-    - Egress

apps/qbit/networkpolicy.yaml

@@ -20,17 +20,6 @@ spec:
       ports:
         - port: 8080
           protocol: TCP
-    # HolyArrs sends releases and follows downloads through the Web API
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: holyarrs
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: holyarrs
-      ports:
-        - port: 8080
-          protocol: TCP
   podSelector:
     matchLabels:
       app.kubernetes.io/name: qbittorrent

apps/wireguard/networkpolicy.yaml

@@ -17,18 +17,6 @@ spec:
           podSelector:
             matchLabels:
               k8s-app: kube-dns
-    - ports:
-        - port: 8000
-          protocol: TCP
-        - port: 8443
-          protocol: TCP
-      to:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: traefik
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: traefik
     - to:
         - ipBlock:
             cidr: 192.168.2.0/24

argocd-apps/add-ons/alloy.yaml

@@ -15,33 +15,6 @@ spec:
     chart: alloy
     helm:
       values: |
-        # Discovers pods through the API and pushes their logs to Loki
-        networkPolicy:
-          enabled: true
-          ingress: []
-          egress:
-            - ports:
-                - port: 53
-                  protocol: UDP
-                - port: 53
-                  protocol: TCP
-              to:
-                - namespaceSelector:
-                    matchLabels:
-                      kubernetes.io/metadata.name: kube-system
-                  podSelector:
-                    matchLabels:
-                      k8s-app: kube-dns
-            - ports:
-                - port: 6443
-                  protocol: TCP
-            - ports:
-                - port: 3100
-                  protocol: TCP
-              to:
-                - podSelector:
-                    matchLabels:
-                      app.kubernetes.io/name: loki
         alloy:
           configMap:
             content: |

argocd-apps/add-ons/argocd-image-updater.yaml

@@ -1,35 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
-    argocd.argoproj.io/sync-wave: "1"
-  name: argocd-image-updater
-  namespace: argocd
-spec:
-  destination:
-    namespace: argocd
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: argocd-image-updater
-      repoURL: https://argoproj.github.io/argo-helm
-      targetRevision: 1.4.0
-      helm:
-        values: |
-          resources:
-            limits:
-              cpu: 200m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 64Mi
-    - path: add-ons/argocd-image-updater
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - ServerSideApply=true

argocd-apps/add-ons/authentik.yaml

@@ -32,7 +32,6 @@ spec:
               - blueprint-garage-ui
               - blueprint-google-login
               - blueprint-grafana
-              - blueprint-jellyfin-ldap
               - blueprint-outpost
               - blueprint-pgweb
               - blueprint-qbittorrent

argocd-apps/add-ons/cert-manager.yaml

@@ -29,18 +29,7 @@ spec:
             requests:
               cpu: 10m
               memory: 64Mi
-          # The chart's egress fits the controller: ACME and Cloudflare on 443,
-          # DNS-01 propagation checks on 53, and the API on 6443
-          networkPolicy:
-            enabled: true
           cainjector:
-            # Only talks to the API
-            networkPolicy:
-              enabled: true
-              egress:
-                - ports:
-                    - port: 6443
-                      protocol: TCP
             resources:
               limits:
                 cpu: 200m
@@ -49,13 +38,6 @@ spec:
                 cpu: 10m
                 memory: 64Mi
           webhook:
-            # Only talks to the API
-            networkPolicy:
-              enabled: true
-              egress:
-                - ports:
-                    - port: 6443
-                      protocol: TCP
             resources:
               limits:
                 cpu: 200m

argocd-apps/add-ons/cnpg.yaml

@@ -11,25 +11,22 @@ spec:
     namespace: cnpg-system
     server: https://kubernetes.default.svc
   project: default
-  sources:
+  source:
-    - chart: cloudnative-pg
+    chart: cloudnative-pg
-      helm:
+    helm:
-        values: |
+      values: |
-          replicaCount: 1
+        replicaCount: 1
-          config:
+        config:
-            clusterWide: true
+          clusterWide: true
-          resources:
+        resources:
-            limits:
+          limits:
-              cpu: 500m
+            cpu: 500m
-              memory: 256Mi
+            memory: 256Mi
-            requests:
+          requests:
-              cpu: 10m
+            cpu: 10m
-              memory: 64Mi
+            memory: 64Mi
-      repoURL: https://cloudnative-pg.github.io/charts
+    repoURL: https://cloudnative-pg.github.io/charts
-      targetRevision: 0.29.1
+    targetRevision: 0.29.1
-    - path: add-ons/cnpg
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
   syncPolicy:
     automated:
       prune: true

argocd-apps/add-ons/kube-prometheus-stack.yaml

@@ -47,9 +47,6 @@ spec:
           kubeStateMetrics:
             enabled: false
           prometheusOperator:
-            # The chart's policy only limits ingress to the webhook; egress stays open
-            networkPolicy:
-              enabled: true
             admissionWebhooks:
               certManager:
                 enabled: true
@@ -99,38 +96,6 @@ spec:
                 cpu: 20m
                 memory: 32Mi
           prometheus:
-            # Only Grafana queries it; it scrapes the kubelet and node-exporter on the
-            # node, matched by port so no node IP is needed
-            networkPolicy:
-              enabled: true
-              ingress:
-                - from:
-                    - podSelector:
-                        matchLabels:
-                          app.kubernetes.io/name: grafana
-                  ports:
-                    - port: 9090
-                      protocol: TCP
-              egress:
-                - ports:
-                    - port: 53
-                      protocol: UDP
-                    - port: 53
-                      protocol: TCP
-                  to:
-                    - namespaceSelector:
-                        matchLabels:
-                          kubernetes.io/metadata.name: kube-system
-                      podSelector:
-                        matchLabels:
-                          k8s-app: kube-dns
-                - ports:
-                    - port: 6443
-                      protocol: TCP
-                    - port: 9100
-                      protocol: TCP
-                    - port: 10250
-                      protocol: TCP
             serviceMonitor:
               selfMonitor: false
             prometheusSpec:
@@ -159,27 +124,6 @@ spec:
                       requests:
                         storage: 50Gi
           grafana:
-            # The chart takes one list of egress ports for every destination: OIDC
-            # on 443, Loki, Postgres, the API for the sidecars, and Prometheus
-            networkPolicy:
-              enabled: true
-              allowExternal: false
-              explicitNamespacesSelector:
-                matchLabels:
-                  kubernetes.io/metadata.name: traefik
-              egress:
-                enabled: true
-                ports:
-                  - port: 443
-                    protocol: TCP
-                  - port: 3100
-                    protocol: TCP
-                  - port: 5432
-                    protocol: TCP
-                  - port: 6443
-                    protocol: TCP
-                  - port: 9090
-                    protocol: TCP
             admin:
               existingSecret: grafana-admin
             additionalDataSources:

argocd-apps/add-ons/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 resources:
   - alloy.yaml
   - argocd-dashboard.yaml
-  - argocd-image-updater.yaml
   - authentik.yaml
   - cert-manager.yaml
   - cnpg.yaml

argocd-apps/add-ons/loki.yaml

@@ -15,15 +15,6 @@ spec:
     - chart: loki
       helm:
         values: |
-          # Garage on 3900; the rules sidecar watches the API, which only the
-          # discovery port can allow
-          networkPolicy:
-            enabled: true
-            externalStorage:
-              ports:
-                - 3900
-            discovery:
-              port: 6443
           loki:
             auth_enabled: false
             commonConfig:

argocd-apps/add-ons/sealed-secrets.yaml

@@ -16,13 +16,6 @@ spec:
     helm:
       values: |
         keyrenewperiod: "0"
-        # The API is reached by port alone, so the policy doesn't depend on the node's IP
-        networkPolicy:
-          enabled: true
-          egress:
-            enabled: true
-            kubeapiCidr: 0.0.0.0/0
-            kubeapiPort: 6443
         resources:
           limits:
             cpu: 200m

argocd-apps/add-ons/traefik.yaml

@@ -15,9 +15,6 @@ spec:
     - chart: traefik
       helm:
         values: |
-          # The network policy allows no internet egress
-          global:
-            checkNewVersion: false
           # Query strings are dropped, as OAuth callbacks carry codes.
           accessLog:
             enabled: true
@@ -64,17 +61,6 @@ spec:
                   - kind: Secret
                     name: wildcard-whyredfire-dpdns-org
                     group: ""
-              websecure-pixelos:
-                port: 8443
-                protocol: HTTPS
-                mode: Terminate
-                hostname: "*.pixelos.net"
-                namespacePolicy:
-                  from: All
-                certificateRefs:
-                  - kind: Secret
-                    name: wildcard-pixelos-net
-                    group: ""
           resources:
             limits:
               cpu: 1000m

argocd-apps/apps/applications-repo-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: applications-repo
-  namespace: argocd
-spec:
-  encryptedData:
-    sshPrivateKey: AgDIXYZfl1u4KR4YgGx8XHpiM1MXnvv39MJV07StKwk2LCsCamL31HDzaA34L5VV5wsnLEgx1CR7i9WMEd6lUyuQWG4YGI4JUgcYV8clMpu/Ih64io2rWs7TTLs1FUqrkLvGwx6aCVFYNQMOnDpY5+RJ63WC8JTM/z0rr16F/47d1BKrW0WVaEZcyy+AT1wG8Y+R7qNDxqND9W7X3+sQfBP+nI2WiTplDe3vbk6WTolKpofME+x6u70j2JpP2rfIhnttNv88qiM9CNssHqxQ4TlH1BNrI2SdnLwX6bWLvCqVKrj8TAh18yZzrkYy1wwI+4ZKCcTSUNsKgtwrrj/BmPEmQsxJ241e/uZzRyuT+VdOls2gtdpc1gz/sxlgRNALZd/BQcYq/XV3pe07STujqXoZgNjC92vRrVY6wPdycCmKHrGSyhN34KdqTi9lfrYc0MtI0c0T0BgXt+ButNKfSHt/2m4SZ8HGne22b3pIltsJP58R8XtomTbHa9VFfTWfiEhuKpwWzM/UsDo7PYhd+TdZFkTj9zfUrR1JluJLuFknUp3hpsU1F1HSyXLGtVmdKb+nD/7n4RTP3zGWNZfCRG3PqsAgR2TBwPKo+7RTq5B1BPqNXjoEWaI3P+divrkZT1PooqHuLEWJOr+68azSy04AnlhBzI06w/FZIgMSjV4adqizFlVBR5BTQgQULDSISYlMRoQz2Z1HUXr9JbqEZBHTwmcSgNilagKYM7dE5mLNXswys4IvlG+SxzDHgTCQH+7ZRS3n2prIZRWqHHhh1EcE7FChvN13HnzwY5PtHi8AQje6dRxCxliQ/nRrjhRQRM+4XQj4bI6wT+kSCjM71hTe/Zg7WguNoyc8Jt105X2YApFTCu6AIBNi5vGIqWXfAofoDvrBM2Flu0kVnbwOCrShh3SXuO/wr8mAdZC1DfbRNFnPNog0Iav4t2iju25YEk1a0SczpyjqVyJRU0IaZx21Ean0B/EweNCC3qt5++mVveuxSfOLJOnX/0mOkwNeJS/6jxiCU4IijDwUEW4FLMiz5yOXM3ktnNdPkauD9IP7py/kmdjgXSjwBr0mSRmzyQe8QaYUIsX15pZoiIdDcrCX8pf5ftzzxxB145SBajQW9YmAIh4DrtrGCpGYTWjd9AVEUYEIh3P0lxN/KtXQdsZvYK5/Gjb2MAeoFXlaussHTWNlULHEo7PDgIyE0oeeXN9qcbU/EJ4H47z9JOTFhVqLWdYECv1ueamHVAZ5CVQDQdQWBqVlOwX2ltM2g84GCiLMIng7WopZtDujMp1bwT3zzTblYXfx0gk6Gp1nNlGOHw==
-    type: AgA4zCPMAfGwpRf7SNkANByWaxs64jB7YKBTbb5Q1y+UF1u+/tEuYYAFySGRRffLPxjXWutwkcCJvzCaJn4v0KaUCT05HAyRPILgE9aNxa3NIAz80hkTBPDInakvrUq6AysKKHl5TvMsd6YCI40EM2aVrUYcEAwaNycFMaYQNXrfJeJdrSBjgLPqWLudos2e9U1yC8vqrfaCDnTCQitgxfVkD7YNhtfpKWUnMOdO2GDx+yOfom4KxUWSwnfvbXOgA+xmCYqpJ96TCEg6Jar5xcGsZuEluS8cMrbw+tSUqfsGYpmA4Q9KllloFTmNZrUi49R5MgE9dU5i7+WmOX6RbbSfI2scVACvnzYA7yKQMXI58ngwtTB/yYM24/ylV+6ltl2n8XDXSMJ7qZ8h4QJ0IOPAuehQTYy+SQLaVKYdfKzUoSi2mA+CHH948Ul6KbNiCbhv4AptlV4amg1PDITz4YmtOWh0rO9PxQFN92FY6dScoDSyACon1nniE9p2k/fF9AsagDoBLl+h66mreHH8KlzjlmsVTuq2Wdn9sCZKw0EfyH8u78Th8Kj7/tpAEKmjvt81YM6miZGgOT71Vg/ttluLqetud98rz/G7wLPKsonFGvrBCVvmJ+cSYs6jp/HNAY5pN30A0515vRutXDeo7Q0UUoOwxGdFRd//lptKZus/WrvyzBqKmGzArn9CLjWqpLA0Jtg=
-    url: AgBjKOHHrbW6YouHDudb2TOBBqQnvsK1FAZG+matWvjJcdCDzEHaX5libU103q9dAMzrEizYrRcy0TxPVn8frwblRcdOvRXL4RDzSaLxS5vnWW/pfCjk9O3imwG987jy1qiRgsiqXNDhaiNor0KCak/9oYiNjhwVzqmQJW3A6lyjwjYZO+1piNeQGn5oO1mIBJnz/dNw6lrtevSG5B785h9Jpo3n2UUbvFgOcPT4lOOxpWBETAvIo5o5fy4AdfKwHCBfm/GpAsXWyNV3bop6h117NVsXc+ysigjC0NIjCobf03J5EA9H1f/byuSyiUDsI1LVAtw+0YlUSvAXGYwVnnCLqxJDkIkrXlVtF18+kR9ktavm1Xkq2eIeL32yJ/v+WTcT9ilOhwEdfHin89l5Qhv4/VJL2CWlpllpZnHvgyD8RjeI0liW4v3HKZkiHbXmthNNrdCinJQJWpsvZBGC41NHYtFXd18i/iu29MwZ6Z7+dR/i5QHF/PxH3OH4ZB58Khuy7Y2BbKNK/KBVjV3Hm4hzHXtbEawPI4SOSyhgqTeD3eh2O5Xs7PQFkgbZzO2vOIRtRxO3F5oJOdGUhjWCLpi+gqcQhHsVodM+hYkVFsYMGBbGHKdGBX78e2q3QHBNSpyDLyoR5TOw6BzQG+C+oqlbcMwF+fkMzPT6nRbKmKtEdFqFZAW2Y6RA3jYf5Fn870wayZ/Hj5j8vhpcR6LW5DKamFkcGSZ7+ugAHEo9Tsx8xMfMaFqU1KeTUOI=
-  template:
-    metadata:
-      labels:
-        argocd.argoproj.io/secret-type: repository
-      name: applications-repo
-      namespace: argocd

argocd-apps/apps/holyarrs.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
-    argocd.argoproj.io/sync-wave: "3"
-  name: holyarrs
-  namespace: argocd
-spec:
-  destination:
-    namespace: holyarrs
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: apps/holyarrs
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/apps/kustomization.yaml

@@ -1,15 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - applications-repo-sealedsecret.yaml
   - bentopdf.yaml
   - betterslcm.yaml
   - garage.yaml
   - garage-ui.yaml
-  - holyarrs.yaml
   - jellyfin.yaml
   - pgweb.yaml
-  - pixelos-applications.yaml
   - qbit.yaml
   - redoost.yaml
   - rustbin.yaml

argocd-apps/apps/pixelos-applications.yaml

@@ -1,24 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/client-side-apply-migration-manager: argocd-controller
-    argocd.argoproj.io/sync-wave: "3"
-  name: pixelos-applications
-  namespace: argocd
-spec:
-  destination:
-    namespace: pixelos
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: k8s
-    repoURL: [email protected]:PixelOS-CI/applications.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/apps/redoost.yaml

@@ -18,12 +18,6 @@ spec:
       helm:
         values: |
           appOrigin: https://redoost.whyredfire.dev
-          api:
-            image:
-              tag: latest
-          frontend:
-            image:
-              tag: latest
           sitesOrigin: https://whyredfire.dpdns.org
           httpRoute:
             annotations: