fix(apps): Add extras prefix to source path

.githooks/pre-commit

@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Normalise staged manifests to their kubectl kustomize output, so what is
-# committed is exactly what Argo CD renders. Requires kubectl and yq.
-
-identity='[.apiVersion, .kind, .metadata.name // ""] | join("|")'
-
-git diff --cached --name-only --diff-filter=ACM -- '*.yaml' |
-  while IFS= read -r file; do
-    dir=$(dirname "$file")
-    name=$(basename "$file")
-    [ "$name" = kustomization.yaml ] && continue
-
-    # only normalise files the sibling kustomization lists as a resource, so
-    # patches and components are never replaced with build output
-    yq -r '.resources[]? // ""' "$dir/kustomization.yaml" 2>/dev/null |
-      grep -Fxq "$name" || continue
-
-    rendered=$(mktemp)
-    kubectl kustomize "$dir" |
-      yq eval-all "select(($identity) == \"$(yq eval-all "$identity" "$file" | head -1)\")" - >"$rendered"
-
-    if [ -s "$rendered" ] && ! diff -q "$file" "$rendered" >/dev/null; then
-      cat "$rendered" >"$file"
-      git add "$file"
-      echo "normalised $file"
-    fi
-    rm -f "$rendered"
-
-    # normalising may have reverted the change entirely
-    if git diff --cached --quiet -- "$file"; then
-      git reset -q HEAD -- "$file"
-    fi
-  done
-
-# nothing left staged — prevent an empty commit
-if git diff --cached --quiet; then
-  echo "pre-commit: no meaningful changes, aborting commit"
-  exit 1
-fi

applications/add-ons/cert-manager.yaml

@@ -1,17 +1,14 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
   name: cert-manager
   namespace: argocd
 spec:
-  destination:
-    namespace: cert-manager
-    server: https://kubernetes.default.svc
   project: default
   sources:
-    - chart: cert-manager
+    - repoURL: https://charts.jetstack.io
+      chart: cert-manager
+      targetRevision: v1.19.3
       helm:
         values: |
           crds:
@@ -21,11 +18,12 @@ spec:
             kind: ControllerConfiguration
             featureGates:
               ExperimentalGatewayAPISupport: true
-      repoURL: https://charts.jetstack.io
-      targetRevision: v1.21.1
-    - path: infra/cert-manager
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
+      path: extras/add-ons/cert-manager
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
   syncPolicy:
     automated:
       prune: true

applications/add-ons/cnpg.yaml

@@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cnpg
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://cloudnative-pg.github.io/charts
+      chart: cloudnative-pg
+      targetRevision: 0.28.2
+      helm:
+        values: |
+          replicaCount: 1
+          config:
+            clusterWide: true
+    - repoURL: https://cloudnative-pg.github.io/charts
+      chart: cluster
+      targetRevision: 0.6.1
+      helm:
+        values: |
+          cluster:
+            instances: 1
+            enablePDB: false
+            storage:
+              size: 500Mi
+          backups:
+            enabled: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/add-ons/sealed-secrets.yaml

@@ -1,19 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
   name: sealed-secrets
   namespace: argocd
 spec:
-  destination:
-    namespace: sealed-secrets
-    server: https://kubernetes.default.svc
   project: default
   source:
+    repoURL: https://bitnami-labs.github.io/sealed-secrets
     chart: sealed-secrets
-    repoURL: https://bitnami.github.io/sealed-secrets
-    targetRevision: 2.19.1
+    targetRevision: 2.18.5
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sealed-secrets
   syncPolicy:
     automated:
       prune: true

applications/add-ons/traefik.yaml

@@ -0,0 +1,48 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://traefik.github.io/charts
+    chart: traefik
+    targetRevision: v39.0.2
+    helm:
+      values: |
+        providers:
+          kubernetesGateway:
+            enabled: true
+          kubernetesIngress:
+            enabled: false
+        service:
+          type: ClusterIP
+          externalIPs:
+            - 192.168.2.5
+        gateway:
+          listeners:
+            web:
+              namespacePolicy:
+                from: All
+            websecure:
+              port: 8443
+              protocol: HTTPS
+              mode: Terminate
+              hostname: "*.whyredfire.dev"
+              namespacePolicy:
+                from: All
+              certificateRefs:
+                - kind: Secret
+                  name: wildcard-whyredfire-dev
+                  group: ""
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: traefik
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # add-ons
+  - add-ons/traefik.yaml
+  - add-ons/cert-manager.yaml
+  - add-ons/sealed-secrets.yaml
+  - add-ons/cnpg.yaml
+  # services
+  - services/app-argocd-repos.yaml
+  - services/app-autoregexbot.yaml
+  - services/app-betterslcm.yaml
+  - services/app-jellyfin.yaml
+  - services/app-legislative-summarization.yaml
+  - services/app-scriptscribe.yaml
+  - services/app-seaweedfs.yaml
+  - services/app-qbit.yaml
+  - services/app-stirling-pdf.yaml

applications/services/app-argocd-repos.yaml

@@ -1,19 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  name: argocd-dashboard
+  name: argocd-repos
   namespace: argocd
 spec:
-  destination:
-    namespace: argocd
-    server: https://kubernetes.default.svc
   project: default
   source:
-    path: infra/argocd-dashboard
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
+    path: extras/add-ons/argocd-repos
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
   syncPolicy:
     automated:
       prune: true

applications/services/app-autoregexbot.yaml

@@ -1,19 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
   name: telegram-autoregexbot
   namespace: argocd
 spec:
-  destination:
-    namespace: telegram-bot
-    server: https://kubernetes.default.svc
   project: default
   source:
-    path: k8s
     repoURL: https://github.com/santarl/telegram-autoregexbot
     targetRevision: main
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: telegram-bot
   syncPolicy:
     automated:
       prune: true

applications/services/app-betterslcm.yaml

@@ -1,19 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
   name: betterslcm
   namespace: argocd
 spec:
-  destination:
-    namespace: betterslcm
-    server: https://kubernetes.default.svc
   project: default
   source:
-    path: k8s
     repoURL: https://github.com/DK10WS/SLCM_APP.git
     targetRevision: web
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: betterslcm
   syncPolicy:
     automated:
       prune: true

applications/services/app-jellyfin.yaml

@@ -1,21 +1,16 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
   name: jellyfin
   namespace: argocd
 spec:
-  destination:
-    namespace: jellyfin
-    server: https://kubernetes.default.svc
   project: default
   sources:
-    - chart: jellyfin
+    - repoURL: https://jellyfin.github.io/jellyfin-helm
+      chart: jellyfin
+      targetRevision: "2.7.0"
       helm:
         values: |
-          image:
-            tag: "12.0"
           service:
             type: ClusterIP
             port: 8096
@@ -29,11 +24,12 @@ spec:
               enabled: true
               type: hostPath
               hostPath: /srv/media
-      repoURL: https://jellyfin.github.io/jellyfin-helm
-      targetRevision: 3.2.0
-    - path: apps/jellyfin
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main
+      path: extras/services/jellyfin
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: jellyfin
   syncPolicy:
     automated:
       prune: true

applications/services/app-legislative-summarization.yaml

@@ -1,19 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
   name: legislative-summarization
   namespace: argocd
 spec:
-  destination:
-    namespace: legislative-summarization
-    server: https://kubernetes.default.svc
   project: default
   source:
-    path: k8s
     repoURL: https://github.com/whyredfire/legislative-summarization
     targetRevision: main
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: legislative-summarization
   syncPolicy:
     automated:
       prune: true

applications/services/app-qbit.yaml

@@ -1,19 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
   name: qbit
   namespace: argocd
 spec:
-  destination:
-    namespace: qbit
-    server: https://kubernetes.default.svc
   project: default
   source:
-    path: apps/qbit
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops-private.git
     targetRevision: main
+    path: qbit
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: qbit
   syncPolicy:
     automated:
       prune: true

applications/services/app-scriptscribe.yaml

@@ -1,19 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
   name: scriptscribe
   namespace: argocd
 spec:
-  destination:
-    namespace: scriptscribe
-    server: https://kubernetes.default.svc
   project: default
   source:
-    path: k8s
     repoURL: https://github.com/whyredfire/scriptscribe
     targetRevision: main
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: scriptscribe
   syncPolicy:
     automated:
       prune: true

applications/services/app-seaweedfs.yaml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: seaweedfs
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://seaweedfs.github.io/seaweedfs/helm
+      chart: seaweedfs
+      targetRevision: 4.33.0
+      helm:
+        values: |
+          allInOne:
+            enabled: true
+          master:
+            enabled: false
+          volume:
+            enabled: false
+          filer:
+            enabled: false
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/services/seaweedfs
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: seaweedfs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

applications/services/app-stirling-pdf.yaml

@@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: stirling-pdf
+  namespace: argocd
+spec:
+  project: default
+  sources:
+    - repoURL: https://docs.stirlingpdf.com/Stirling-PDF-chart
+      chart: stirling-pdf-chart
+      targetRevision: "3.1.0"
+      helm:
+        values: |
+          fullnameOverride: stirling-pdf
+          persistence:
+            enabled: true
+            size: 512Mi
+          deployment:
+            extraVolumeMounts:
+              - name: storage-volume
+                mountPath: /configs
+          probes:
+            liveness:
+              initialDelaySeconds: 90
+            readiness:
+              initialDelaySeconds: 60
+    - repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
+      targetRevision: main
+      path: extras/services/stirling-pdf
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: stirling-pdf
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

apps/bentopdf/deployment.yaml

@@ -1,47 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bentopdf
-  namespace: bentopdf
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: bentopdf
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: bentopdf
-    spec:
-      containers:
-        - image: ghcr.io/alam00000/bentopdf-simple:latest@sha256:3d62b8f8eece5fe947026ac3925ff08fda245b3d6ba2c3916b94da91e0010c74
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          name: bentopdf
-          ports:
-            - containerPort: 8080
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          resources:
-            limits:
-              cpu: 100m
-              memory: 128Mi
-            requests:
-              cpu: 10m
-              memory: 32Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-      securityContext:
-        runAsGroup: 101
-        runAsNonRoot: true
-        runAsUser: 101
-        seccompProfile:
-          type: RuntimeDefault

apps/bentopdf/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - deployment.yaml
-  - service.yaml
-  - httproute.yaml

apps/bentopdf/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: bentopdf
-  namespace: bentopdf
-spec:
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: bentopdf

apps/garage-ui/httproute.yaml

@@ -1,37 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: garage-ui
-  namespace: garage
-spec:
-  hostnames:
-    - garage.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
-    - backendRefs:
-        - name: garage-ui
-          port: 80
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/garage-ui/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - middleware.yaml
-  - httproute.yaml

apps/garage-ui/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: garage
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/garage-ui/sealed-secret.yaml

@@ -1,14 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: garage-ui-secrets
-  namespace: garage
-spec:
-  encryptedData:
-    admin-password: AgCQeGAvd1QdDC8IUwNYqHJxRES1jfPbonYTyutCklms6tjebQw1pRKnbDWGRaFmgWg5jFRPYf6TAMRnZnA/1dKJMOrV9vGjqx++r+khWbe5oqvcoQInqVdbkfulHoP/Bf6jc2mj9znGqpW6E7e6Z94pwwYkpaY2CIYhfcs7PiaTh7HiFMmoNWlGmHBh+lIZ//WJblgpFdQRWR9j7CiIJOLC3OmAvGV+Uh5i15fdA9aTBLZaB1pWh/kqug/mmj6q5E3Bp7BlC7Pm20Dbyn85kfA9RjAM/AkWSycGcBgk+FaJKFVJnPzrHcx6CdkbUnczxGVrbs+C89pzCk8ysaOVSNDErW0rCWNaHrflRx6P1+OUamCWWafZdkWTGQ4m0I5pX5IQ40zIK1uE8Zzil8EJPynfs37fNzn54wVBmsaKpsFC/3y+d8UTVgf1shJF0cqPimWjCZPqvUZrimL/20tPhTSERaxtWSq14l39bQUc4sNZdaKc69IkI04geI9OPvE+XXQNYe86XPYlNJ/R5curg1RvQxAR59sb04RmZAfdSvcwYxpK1Ekchq/e9IK4ft6Ul70nE/oN43NE2Ck1+5/EOjucFmIQzZ49Jq2OIjHuBjA/p/BmwAhiZVwPObRJ0VoL9XDv7BVB+S/+RWnFjDW7J5YhWquZ2Y6XwspHhpjvHmH+LLSio/34VpWQgG/lSAhvSPuRkIp/XxhQwemti+3yQNeqfXtvpfKa1IgAg9ic/rbocQIUtQDaT4yYFi7cruTpx7U=
-    admin-token: AgDBYTHO2ZgJig+h3wIv1ru7VxEDKIq+SUjOygg39lVaF1bH0ADaWOdr1m6nP37LiBCyQSGtqilUGqXPV91VRiJJqFBXLTnYs0JbmXGekkfeImztAd7LL3yqKHThji/Bo+vD00PC3SAbpder2d6BJhOMez2XqFY2vPSY81earoiR+ajzuvHBC4PuwDjNYwnNq5BkGCF/D6EOenVfVJZdWHG4/oCciJzX+fwYQYw0sY8ur5cRxyY6wyWC2QH9YflDKbwFteiqnh8E1+B4mqSFiTcaM79FAU6rYxknXmw/BArNdbXvAxvYDyGKxQA1k6GwW9TWSg/CpKAmuJW2Xv1nMCqt3ZIJCTO/H1PIi24XouNBGc9n0VOWKNWZTI8CIZLRB+/LzLuT/vjhu4qA/LE6SkDXw1dTkgkkUChUKN4PrWfwTVIEgZwjPdewOZ9D9JT8TmPSZtGvVuDVOJl7+wBYGT4SkI9W2qU91h1VT+vmXO/7QyQ/kj2ny092GjT2aJTFAbtusAjV3dKZnfodXaCX/dQ3JnSuP2mWQGZ/2Gj5AB92FNvqeTkiqovS2hGgXjyOYp4JeXVPvBa1tWEo0Cy4FrqBLaycNIHuhGiWAhLrivXTX2YqyM3NfEmEuyzXu5M3E6eQhaF8uveDjqhxF1z07IUXU8zBCvHtC7vX2aYPfSKGWcpvGKa8NnkjamRY1qJbj1Jr15a9UBSM1TyWNGp3pxFHyy707FlayRDIdJOe0iYqQw/5qZQJBl1u4/1zbOldP3dPFtbGuhR257+wNWwKKfACorTsBg==
-    jwt-key.pem: AgBYRkRh01LSyyozE46odjgrHsZ6gI3ykVOdV7qMPEFt5lILq44BKFt3vVL+yAUz0brVPQeEjz7dg+xsurAKKMjvuxzkOqBsSFhWwBzy+f+GfTSZPBrBNPAX7jI05dUNbcu2UuxYMlgVq6VWa9lf0Gc8yvuEuD0nS2qmpj1ACL6awLBKnkVXL9c5mvoC97DRyk920rPTnERJGU5q7i+zue4sxufYJwJZAJLOmdpzavHfQ3lCcJr6FfboFmGnvD6SM85rXTtImyDY4tsXf4J1rRriYR1OQe91j4SSbvxDFskXYSQ4bTgjimat21SXLCImj/Pqh6LJz7wMd9aW95ju4jDE1q1og0ToIL0Nybl9ANhqlJgFtOfvQRnaJVQQw/2GitlDVejJHCYWsVsSxQtAhvrGdWDOrZ1eTzvsmBnGcWzDwtC1YN3u+Wd0qJBfoRIJLiinwLaJ7ponm5MSb9Qjkym99gXm6XUO0MlHS52pfVaai+OmyWE6B6nF9tf3YVXfjZcNVB1pFHCZZR6XcnIm+wi1EwxXR8NIeFgqiaIm+BwX9u6IMiQOHCVznHD5nc2wfSXpeeT75IX/HAzRWC2cc6a8vPsr+h4A4hqW+cOoMYb9gQQIa+F5X4LcWb6f/0HJHh1IO4vf+P2hVU/5CkpgGJk+x48KgkrX0CE+bafQQjNp8JTdis1gxSGEX0QUaVGl+x7exGhrKlW81ZZTovequibx1JhdNSXNbWZxQ2fXz7SdN+/AjYyEh1gNPI2Zx6RRJc5BlDSSt7TYwqy1NUcPfbJV7hbqV7oDUH8JrsoSk+xxB0WDE+Uh5P4MsQna6NWkWyFV4tvfK4QyMupQaxOAKOYV27DxBaTr
-  template:
-    metadata:
-      name: garage-ui-secrets
-      namespace: garage

apps/garage/httproute-s3.yaml

@@ -1,23 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: garage-s3
-  namespace: garage
-spec:
-  hostnames:
-    - s3.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: garage
-          port: 3900
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/garage/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - httproute-s3.yaml
-  - sealed-secret.yaml
-  - service-admin.yaml

apps/garage/sealed-secret.yaml

@@ -1,12 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: garage-secrets
-  namespace: garage
-spec:
-  encryptedData:
-    rpcSecret: AgDWvOoSUADQx+cExTUDmk6/BWR8a7U5HRGf+T38P24FrP4DJiKl3GJ3Ce9a3eF7SqO/1TXiaN80+c4NX0dMEmnaS8III2Zbaa7x/rOHP608Vh1z2Nnxly11X10okVy+Qym9O5/oA3cue2bu6K3eG8W38mn3hCA9kWC6g9OiAwjBTxJXYmsUFYbj69Iloo9moBBLEtztu8T9vYu8rGqcchKzzjnvcS91kiduq9rY9/ZvYC4zx469DgnV/di8cjGdU6JAtsoHwggDtCVf2hvkyOIHTyPM9Y/EVGCsOsIzhJnTdsyRGn4su3ruLmS8VqbKC22Q86pSHjwdlD5RoZJjYtMWr5Q5YAvFbnTH9/+d0r363BfxlNsVkINd5d2OwlPpagEQ9pg4oFnnk48tsVEoYz1RCy9x/bK3U4B0Jin6l0T2NJ3umXPriLxBQbODWVA9vcv6G1tQiiuOsbYCWigoxe3ACpuYQDV+XujfmEZr3pcIw0hwKXtUWHI079aUkICcMEbtE3gLc1dNVQpja1SimZOUlqf6pz3YLv6L1e2X+yR93p2rN6hc8IJh3KA8ZR1Ymbbq2LaOwdyla50uuhsOkE2TGDTGmf9NyXjGcUys5LgNpRruzXEm/KgUX4tP7iMjHu5HbnDe9oiv66qfuIORiR2P3lbOdx3s+XmPd/87afw6YHA896ccCRkGpGnFanbrR+Z7MRqCOZsSLnQd1JpjnWJJU/bzrSl4q+PUV1Bt+hvAf8wXUrDtES6MdpOKUe4XW8s3QbVHvCx1iOSzP+r59T4N
-  template:
-    metadata:
-      name: garage-secrets
-      namespace: garage

apps/garage/service-admin.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: garage-admin
-  namespace: garage
-spec:
-  ports:
-    - name: admin
-      port: 3903
-      targetPort: admin
-  selector:
-    app.kubernetes.io/instance: garage
-    app.kubernetes.io/name: garage

apps/jellyfin/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - httproute-local.yaml
-  - httproute.yaml

apps/qbit/deployment.yaml

@@ -1,126 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-  namespace: qbit
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: qbittorrent
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: qbittorrent
-    spec:
-      containers:
-        - env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: Etc/UTC
-            - name: WEBUI_PORT
-              value: "8080"
-            - name: TORRENTING_PORT
-              value: "6881"
-          image: lscr.io/linuxserver/qbittorrent:5.2.3_v2.0.15-ls478
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          name: qbittorrent
-          ports:
-            - containerPort: 8080
-              name: http
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            - mountPath: /downloads
-              name: downloads
-      dnsConfig:
-        nameservers:
-          - 127.0.0.1
-      dnsPolicy: None
-      initContainers:
-        - args:
-            - ip rule del table 51820; ip -6 rule del table 51820; exec /gluetun-entrypoint
-          command:
-            - /bin/sh
-            - -c
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: custom
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_IMPLEMENTATION
-              value: kernelspace
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_PRIVATE_KEY
-                  name: wireguard
-            - name: WIREGUARD_PUBLIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_PUBLIC_KEY
-                  name: wireguard
-            - name: WIREGUARD_ADDRESSES
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ADDRESSES
-                  name: wireguard
-            - name: WIREGUARD_ENDPOINT_IP
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ENDPOINT_IP
-                  name: wireguard
-            - name: WIREGUARD_ENDPOINT_PORT
-              valueFrom:
-                secretKeyRef:
-                  key: WIREGUARD_ENDPOINT_PORT
-                  name: wireguard
-            - name: WIREGUARD_MTU
-              value: "1280"
-            - name: WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL
-              value: 25s
-            - name: FIREWALL_INPUT_PORTS
-              value: "8080"
-            - name: HEALTH_VPN_DURATION_INITIAL
-              value: 30s
-            - name: TZ
-              value: Etc/UTC
-          image: qmcgaw/gluetun:v3.41.3
-          livenessProbe:
-            exec:
-              command:
-                - /gluetun-entrypoint
-                - healthcheck
-            periodSeconds: 30
-            timeoutSeconds: 10
-          name: gluetun
-          restartPolicy: Always
-          securityContext:
-            capabilities:
-              add:
-                - NET_ADMIN
-          startupProbe:
-            exec:
-              command:
-                - /gluetun-entrypoint
-                - healthcheck
-            failureThreshold: 30
-            periodSeconds: 5
-            timeoutSeconds: 5
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: qbit-config-pvc
-        - hostPath:
-            path: /srv/media
-          name: downloads

apps/qbit/httproute.yaml

@@ -1,37 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: qbittorrent
-  namespace: qbit
-spec:
-  hostnames:
-    - qbit.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: authentik-server
-          namespace: authentik
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /outpost.goauthentik.io
-    - backendRefs:
-        - name: qbittorrent
-          port: 8080
-      filters:
-        - extensionRef:
-            group: traefik.io
-            kind: Middleware
-            name: authentik
-          type: ExtensionRef
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/qbit/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - middleware.yaml
-  - httproute.yaml

apps/qbit/middleware.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: authentik
-  namespace: qbit
-spec:
-  forwardAuth:
-    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
-    authResponseHeaders:
-      - X-authentik-username
-      - X-authentik-groups
-      - X-authentik-email
-      - X-authentik-name
-      - X-authentik-uid
-    trustForwardHeader: true

apps/qbit/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbit-config-pvc
-  namespace: qbit
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 500Mi

apps/qbit/sealed-secret.yaml

@@ -1,17 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: wireguard
-  namespace: qbit
-spec:
-  encryptedData:
-    WIREGUARD_ADDRESSES: AgCUjKDTHlj+cDz5QmTdFrQ2uzgf2h7nHIB22Hiy8dNQoHPmpl42IS8pWMM3cC7/RQ620XX3Gvnjt7w3N+cRHsxZONCtBaocM/B4lBxgkrqoBuMISQ90oeqeL16ZWd6yDPmzgJLG0JfWPEuGkXsCkMHKg2cTQwZeIhoI0jiiUIKtY0q3YA19cSaf9gX0buQyu84hy6oi7Y2l0EXqwcbHJP2NEAWmxXuHF1nKtcSnAUlsHGCfomHLtSPoyoR0Ug3CER60oE18JIYmbt+iFL4Oalx4nKFoJbkD+dPLx/Do7kylySVqX5DAj1ivIQjyqZmcsyaigP01OU+poSM0D94mhMt8Dfi+ZOzDemoVDKtJlOYNfskk0hLdbLdGk6DzlONl7KBjduzbSk7BnFlr5bRNeKYFiDpg5I1y2FKROpmFCvV2pzqlLFl0C2BTwZU1dAj2Qk+ouUdhzzxEKqS2Q/CUUIftepqKIYzMJncFDbEjt5gAB0DJOt6FWiNG9TV3v+oSdzqn9UFPTIP1SO3IhyVoICDGmo829ki104ZnvjVciuPLH85l5rSdQI6qJuabLXylqTU8tmebTXDJZw/kBD+hw4ycCgD1kQssZM3djjy/RbMhY4zrpN345jelr9Z5kQsINcDBPfyCjCm/Eo6PM/fiuCkNP/KrKHI6C+NkyFHWk14ZeYODJI8GYakRO6SCRZ1G/SWJxA5DfZcuojweGD0G
-    WIREGUARD_ENDPOINT_IP: AgBKPD8cgNPVl7YTUsKkDRioPFCLNg+q+PGYiN5Qvw5nAvhh8tmUiV3JlkdtUHp/ggC8Fn+bLsNPRjjQoa02F8wZv1oxO1XeThNtxX49xlcLiFsw83wtL/pKQcNShml+HClsiCXN569g9NkcCY4R13tcSZPRbVs+oV95sGeUtfx/Ukh4g/URX1Z0aKzI2RE1ENMLQMXkVrrk7GJdqKBBsW76wHcTHw3DgcshMhlgcDwLiX4b+e5nAOzjlcwEKm6EBxXz2NuHP9PTkzfvK9QSSZJ7GLlac7eqFWj+xir8k1s1bIzB/suNMIzpo0bvOUjpxmoI54Xd4/hZ6fXkEF7lD1DwK7G/RV9+XNePPX+lGSJ9gQMIadmK3P6jHNnl/+RtqUk3mQ35r3Tl1Tmz3mhhK3/YalL6/8zWesNVYt6D4yQkFi3GFnc02Htl7/CyU+r5a3TwE3xUl/VNtkhHklrL8obF/cCORbFlYcwT2tbYl1av/3slJ8UsG+DXEX62+o6Tpt70Mzhcj61mQ2H/Emb5d7FPYlohogM1e37YY6lJhbjZeNHxxKvki8kusPa/eY8ZAdJcpd41/0rrL3uSOOZqqELNuTzqQKRhb6CDUGaoYFqSw9umDqwjdvfFQcYLQepn84HFILAlUfNF/InO6WrNh8jWGKx9SNsDfrJpY/RRyEJK8EoNIuelLdNP3phZhxUcQn/UBZ/M/UOzJZZ2xJPl
-    WIREGUARD_ENDPOINT_PORT: AgCOTc0MMWugdnF6Ou8mGgBGu5VD7zP6O3hGr+4YzW/UvCEARqwuoRXTKggUpFcZC0mNf1CdGCB1iRGCVWjnFJsw6zSudcJiWEVOtqLMfxxwZHhApiMtaHq4ERP4Hhu3jn/QwdwbYgk7rUoqsCRU2JelgPoYIhJh/2BtOz0z8PO+ktMIi5Qaj7m6O0zkxbzvqZaEbgkYsFCtQlaWqvghNk7GZB12KOOr0kU+Uu4vyi2ak7quoMjaQkMrRHOhhw0hk++FCXN9SNpDGyGBcqPtl/8ZRUyomLi76O3nsHX8QtXXj3yzDEwrdfwNzCwJXqI6HI4X2+/xSvnxI09wf5ei6D8gyJX8gkPQiqsXA4dsYvTUstf26Qlh/L6iQjB8RkXixBR1YwrIu/lLNO0FpFPqtLJu5jf1jMjZIn+oPl3GxAXcM+kRsX9YS5oJdD3rFFTz8HGthfOTSpaEgSnN2rF440vfIH8DKvTDH4cyR78C2Z8TWQ2hbDxXOX/NwxvPfidttyC3euLBc4Nkb/VX/DEU9W3QCB9yKuXw2KKSqnWHvIAReYLn5ex9czU+B+8IP2fJzTMDH7gOYqwtxuRMPu5bto0dn/120ZaLDBzGUHL38pBnMsYhssOGQlerpG32nT66IYdaZXTMD2UHsTwnNqu4/J98IY47n60wg3SVOVyZQ/dmS7Dfp8lPr/kE3+xNM8HWayCEKYxW
-    WIREGUARD_PRIVATE_KEY: AgAwJo1zxNRWXAinDWXvLajPWwHeWwAD8zOopE8Z8M5xAUDKWkTwZecR/ODI37bYQ22bb1+qjErBsqUHyT79adOmypY9DLW6YdY2YPkQwef33iXdgC1T7nV4pjI2TahiVab0z+5ot18A/FM9S7VHmRX4L+3ccO/oqcInNz5PFbsXp6U0dZZtiKWg7N5IzdT9dwDCknNFTv10URlHKE0Awff8jA34XGC8Ra/SvF3gSiaYjwd74HEBpnBMM5CsiveOyU1vCNxg93S12yrauC5jmD/ex5oEnJ4J1SziTUlB6e6ALpluA3AD91wuZ+wXeaJ0huNSz4g4sL6jm3OQykyiRx7jx/8FL3no0u3ydGPgYZ5MaEYXBtTk6ODFEhUZ7EGs9w8vip1SY/FijZYC3QT78R5WMim8gi1wf+TwmA8YRIDZW0CMhbtI32Ef2oDmb1Jzl58Igba8zQGTIqT7Htj6f4mpJk8gKSRIzkvLK6o+cynOpQzZBOZb+G7lZst4g+lILLjmfpFGJTVgogfEkuYV6ntuE3dGB2OmRGUW0vpDM4ZCkxYsjh/1kzSyOGVYtL0EHS689ehzUDUJLuJuvuwZIFUjOFCFofGP37rKCcSGouLNj+xWmcbCgx7si05rw8JMeAWE5YETaBbi55DDaUB98G97KM28OlPBDm8PtqdcBD4W2up34nowXdG0tZ38VsTV7xNyp+2A5saPQZ72wM1fQiUwGwoHRKdHB1ptF6u+0zr6tlQoiVE07BMQ8/ykAQ==
-    WIREGUARD_PUBLIC_KEY: AgBAElHBgsQNQ3l8CGLlKMmi9dMTLmgp4gseMgbEMW4sjOvhsAIeLGsuv+HuStvH+bfAp7U9Fh6pAlEZKPOdN5pbpoFjkTDC5VU8aKJcdO/+iZWURbULYBDyGK32Ss/0eCwIsdO7lFcSFy2T7XJFPn656lBx8gocBp9PMHRSoL2dELP9q8JyNr3nb84vZ8hwiBP3Gy8BITeeE4J7+DnF2SUg+4pc92gMOgmWL4LO25pI39Q1yKBw4tCOf4f4ETgmjRHv17WsFw2JZTgb1rmXFvvKWGzTPZbA1gajcRgTKY7DrzWFjFi/o84qjGC4feQ9vb5ZwnLN1MzU1yByQmxQiAOSCK+1SMrvUJ9dF2kE3zJw0fSGjU83iXcorpbe4YYFr4Y8k6mKSSthchYyQZp5FuB9N9J7vm4vv4kUbTGOtwHQFrKRNiB5PVVFqzUVYWs9CfFcodAu7JaCBHKzLj1X7xBLiQoWYpx7/LVTjoR/R9j/+bfblKlid+H322Oh4ReSuxVKfMmNiOGeueMOrGX+DhHtYFbGHmdc3aprjBkYanq71MV9kFRVAZd834IX4wWykQWWgmYtx+eZJs6DZRWhAaVbBQ9IY0vS4IjAInTpMN9yqNxJkZ+w1MJIeTG5S9NnB3xUjnOgSCow9r/IEVNFbT4CbsEXbMECQ3S0OIby8r3Zwt8J7NEphFYkLtsR+brtMLsWRHIw23mtSTZajLMaSHOG6fooZyNKYgYJGr0Spura2M6TjhW+f1csYKrkxA==
-    wgcf-account.toml: AgAaSo7eZz/CvAN1reUDhHzFWIcmQMopYloYitAYq5Zu6gXE+65ogq0Jr/S7WLTqdgL3KWWhSmlG+jpepC8cpomVrnPfydlw6or227dm0ND5XNEO1MwNOtzeGNS3q7ayB8NoC7qZVR33KqutGOZLbFawyTZUi4ItjW74SdvL/Ftd4VvqrG7hQtAd/2PP37mL0unw2DesL8hFUXTkvlzAdKHZGQMaYNcH73JWJwvlf95L6ncKdZXWEM0uJnjhAVE+sCpUEQK67mQcX4RrYairr1wwux2YYjwweAriXw7wzBDvOXnHqg3Ldmat0V7FMK0MeIzHhezy15AGLtYRonFcYzEznIl7P2FjjG4Yz0EAk0t1rJpQgV35NAybseQ8t/92+vPa7LaPcjUUKZ5Kx1a2SdihljtLEjzuIdvYN/tKPcselzehWWrbDl/qeQuwZABxj8z24moJmBqJcXpAigvX4XlDcWp0jHWQxbLDozKtYHKUEPmhAklVaDuVr+bY2jOxU4Nki3ybLYpi834CsifcSc7RAaruJIlnITZUR2VG7PMIoTObqfeYnSyZKabHadWHHdkoyYsJmSiWjadvlvBXtW+RTHVU8UsD8GdVS9wBpA6ZcRsegFiEAoMzdyZQNRabYjUeAxpA/lOtt/PH1FnIV588Of/lhypBdUF4rRYcCvVT0gFQjoe7ITsvEf/P+fLb3TO47fQtBqOmKqoD21yhtb8Y4GQ21XVmB1gJT+/oYjny9/YL5CuhJif0XoarJZHtvTb5Ubs716PRSmSvAoXI6jBMKVSssWtfMIedL03X+RAxyT3jvL/W/SEuN5D5a2RpjIswAIN5LQ3b9f7F/JgDIQKdIHUEm+Z430lS83RDsMpJ13SmRVoXzbAededT7r08DHu++sOvDfHeMy+lTD0aTaskbPWY5PLve7g7PWat9q+NMepgRC3z26JCw/08O4SGX/fUhxg709F5A8hf/LUSTNGRlQ==
-  template:
-    metadata:
-      name: wireguard
-      namespace: qbit

apps/qbit/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent
-  namespace: qbit
-spec:
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: qbittorrent

apps/redoost/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml

apps/redoost/sealed-secret.yaml

@@ -1,14 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: redoost-s3
-  namespace: redoost
-spec:
-  encryptedData:
-    REDOOST_S3_ACCESS_KEY_ID: AgC0A+pQKuYKMLfMPRAtL6a3PBEkwgghd7IbH8ZGhgU086s23NvbOBM5sHHkApqOiQ9z2LarAfvvKpBdxlQTjInxhqdJ1lW/zkWHokHhSn/L4ule/efU18a5gXsxNXN0Mon9PZrS9wKAFR9ZNiEDFa2/L4iUtCesUR/MneUFqqqibxiUgt2R8sMmRIzP9O0b8T7vnw1EkgyO4HWpWlLrGPnBryWA4OEj9CGLrTT7Z8u3Z2J5m43dELfmzdAH4gM3RQPXAzAMY+QyxnhtGA6x52OTcD8XxqB1lW/dWzTq+zCjnmRR5HbpWjeuM6ojlFJZoBLxYRRMZowMEKFX4egKUvGEDmSKOX5Z+Hn5n11dyRFhpKrMU9vy+utLvVtDM/rr5NqK1Bna0u40VdUUwpdoqAWUevw9yLld2QzOg06hjqQwpqVER7E1VTDKjVXveacaN7si+63abaw649eAaFhTitMEE9ORHZ7Fz3YZB5zdqnEQWZwzczJhhvqzNxP0pg1/JCEVrKYVfHCtuDoJ0BCeiuFPWU8lKYhYoxRzm6biWhdevM4o5CobnCedH/O+TDq6iPDDgC9iBNHIQjwfUAjjq44OXfl7X9+J3Q7xm7BYMD+/8LvycbBauFtOnkj32fyuUKF/EvoQF/AIQ3TX6rC/CkbIMT+m+mcAx75CB6hfpBFOMRKgpTT7WNR1zs6YrSEzNNQq95KvTIMVYEEKm+gjrnpv9mkCkCmSJPCWsw==
-    REDOOST_S3_SECRET_ACCESS_KEY: AgCp8zFoy+Clr5qY/57jfSwYT44a2jwTFzHgOPoYfE6LXXtis40QjrteEjyc9oE4dE2IlR3wY85twCcqMEbJW24mkTbQf5E4B4V5XaUTi2XhMkrms1tfwaKJzYJiPfoS5u/WyrMN7LK/pqryEVGODKh/57PNoEDK/N/ab7w1iKfxGQQVuwDSCdsT3RtrinzKXKHUFsR4f3wpOAO9nh/53atgZ9MMs+6DFLmkdXvIfjgJ/PqCrtxKx3hTXFNhrwbDIUJFF/wF9SUy6C2CyHCycdeU5HJFSahCIRMZvFAhDrl0Ubsi/MFgWsQouj2q6VEK8VAWDttCJaiSf9g/KhELneKCYC7qo7e4PzhHhAHUGO5fILWxd7HySj4CxSiCDiF3kIqVUXo/sqlbgBNMvPb+NNqo19g27jcFZPh/AZZkuBSxsdmEYfgg1RAcYmwPGUxksRcj36yknYjX4pMxJNqVGDH1nLsplOa5b8h+evxMnjK6oNduRP96zHd+Qo4sC2ThBF3Ar8STJpbbJ+KgdW1HnHo38JYd0J8q/pcVq5xY3+VX8Gy8JSrb9wdFMZnb+iWmyL/GNwLIqqbZw1zcKF7Rru78fl8Y5VWDnrpbjn1buqDxwyFkDhcxX9WISoAPKXP9K2Cs5UOIKwu50cOAyA+cMOMsYbTnkvAuDMZ5aBPp80j0TQLu4luPPvKG1RumhYxGthmEpwQaPyXuJfhOBbuVrsiNlaCKe+d3Jv9l3Y4PVlTBJg7ZD7YpfLoyvt1Y9ELAI5qiUjZ4Ru5TxX2lIqZOoZ/G
-  template:
-    metadata:
-      name: redoost-s3
-      namespace: redoost
-    type: Opaque

apps/rustbin/deployment.yaml

@@ -1,60 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rustbin
-  namespace: rustbin
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: rustbin
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: rustbin
-    spec:
-      containers:
-        - env:
-            - name: DATABASE_URL
-              value: sqlite:///data/rustbin.db?mode=rwc
-          image: ghcr.io/whyredfire/rustbin:sha-75418bf
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          name: rustbin
-          ports:
-            - containerPort: 3000
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          resources:
-            limits:
-              cpu: 500m
-              memory: 256Mi
-            requests:
-              cpu: 10m
-              memory: 64Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-          volumeMounts:
-            - mountPath: /data
-              name: data
-      securityContext:
-        fsGroup: 65532
-        runAsGroup: 65532
-        runAsNonRoot: true
-        runAsUser: 65532
-        seccompProfile:
-          type: RuntimeDefault
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: rustbin-data

apps/rustbin/httproute.yaml

@@ -1,23 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: rustbin
-  namespace: rustbin
-spec:
-  hostnames:
-    - bin.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: rustbin
-          port: 3000
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/rustbin/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - httproute.yaml

apps/rustbin/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: rustbin-data
-  namespace: rustbin
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

apps/rustbin/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: rustbin
-  namespace: rustbin
-spec:
-  ports:
-    - name: http
-      port: 3000
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: rustbin

apps/splitpro/cluster.yaml

@@ -1,33 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: splitpro-db
-  namespace: splitpro
-spec:
-  bootstrap:
-    initdb:
-      database: splitpro
-      owner: splitpro
-      postInitApplicationSQL:
-        - CREATE EXTENSION IF NOT EXISTS pg_cron;
-        - GRANT USAGE ON SCHEMA cron TO splitpro;
-        - GRANT REFERENCES ON cron.job TO splitpro;
-        - GRANT EXECUTE ON FUNCTION cron.alter_job(bigint, text, text, text, text, boolean) TO splitpro;
-  enablePDB: false
-  imageName: ghcr.io/whyredfire/postgres-cnpg:18-sha-62e724e
-  instances: 1
-  postgresql:
-    parameters:
-      cron.database_name: splitpro
-      cron.timezone: UTC
-      cron.use_background_workers: "on"
-    shared_preload_libraries:
-      - pg_cron
-  resources:
-    limits:
-      memory: 512Mi
-    requests:
-      cpu: 50m
-      memory: 128Mi
-  storage:
-    size: 1Gi

apps/splitpro/deployment.yaml

@@ -1,108 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: splitpro
-  namespace: splitpro
-spec:
-  replicas: 1
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: splitpro
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: splitpro
-    spec:
-      automountServiceAccountToken: false
-      containers:
-        - env:
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  key: uri
-                  name: splitpro-db-app
-            - name: DEFAULT_HOMEPAGE
-              value: /balances
-            - name: HOSTNAME
-              value: 0.0.0.0
-            - name: INVITE_ONLY
-              value: "false"
-            - name: NEXTAUTH_URL
-              value: https://split.whyredfire.dev
-            - name: NEXTAUTH_URL_INTERNAL
-              value: http://localhost:3000
-          envFrom:
-            - secretRef:
-                name: splitpro
-          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
-          livenessProbe:
-            httpGet:
-              path: /api/auth/providers
-              port: http
-          name: splitpro
-          ports:
-            - containerPort: 3000
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /api/auth/providers
-              port: http
-          resources:
-            limits:
-              cpu: "1"
-              memory: 1Gi
-            requests:
-              cpu: 50m
-              memory: 256Mi
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-          startupProbe:
-            failureThreshold: 60
-            httpGet:
-              path: /api/auth/providers
-              port: http
-            periodSeconds: 5
-          volumeMounts:
-            - mountPath: /app/uploads
-              name: uploads
-            - mountPath: /app/.next/cache
-              name: cache
-            - mountPath: /tmp
-              name: tmp
-      initContainers:
-        - command:
-            - sh
-            - -c
-            - until nc -z -w 2 splitpro-db-rw 5432; do echo waiting for database; sleep 2; done
-          image: ghcr.io/whyredfire/splitpro:529739ab7f506ce258f6d09596ed8bb0833c20c1
-          name: wait-for-db
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-      securityContext:
-        fsGroup: 1000
-        runAsGroup: 1000
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      volumes:
-        - emptyDir:
-            sizeLimit: 256Mi
-          name: cache
-        - emptyDir:
-            sizeLimit: 256Mi
-          name: tmp
-        - name: uploads
-          persistentVolumeClaim:
-            claimName: splitpro-uploads

apps/splitpro/httproute.yaml

@@ -1,23 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: splitpro
-  namespace: splitpro
-spec:
-  hostnames:
-    - split.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: splitpro
-          port: 3000
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/splitpro/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - cluster.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - httproute.yaml

apps/splitpro/pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: splitpro-uploads
-  namespace: splitpro
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi

apps/splitpro/sealed-secret.yaml

@@ -1,14 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: splitpro
-  namespace: splitpro
-spec:
-  encryptedData:
-    GOOGLE_CLIENT_ID: AgDRctXaM2WUp9CYS1HQaxq1F6qJ6wyuV5PRK1hhSYCGCpZwId6mT/M+YCGiPnvAqR2W0L0cJ199ytZ5aV7UBrgbLG6XK7jN1txxpdWTSq0pONPj2jOrUvqdToA/6hUCsQBW6oqshbhjV/H53PxmKzR/t2zTQ0xoI64FK81INBsyaCY1gzdZQWYZCkmDhBUrvzfprcI6ayTvOtMhJkXMFU/TNielxjQtmRKnjz1wqyKZkvie7ZS2oEzU7R+VuuoMQVyL/N1pcu8rd5/WaJxJNgtG0oTFtJMQMCKvV80nXRWTXaTCGtpd4Ior+COgUW1ruzxU7HvrOMeQk/pwRPtVuANA5XUgwABWJH+RMmSDTsmqFlqaIYluE4swYGeR2dvEVWv4PN7YjBuJzYrWOCntp571JLw9jJ8ffCCEETQiEYc65ZMochp1rayZaHFJXAoorS/AbOK5fBYpdwM7R9KYl9tGxYzNcqzihezqb2hZuIIyEQnCtKPJl68TywiDXcUiftwlIhf56v2Us9nYaHRsIVstot1FhkrO2DqYrRxJ9/k8wPeJjPFCqrpx56y9bqRiyq4R4tfAKv/iHTZ2d8hVUZ1Pr/bc2pqwjxtjzBlGBXrAC4xSQWf463wk5IvY2dthRq0LZsXd7c8zV8QN9ZGwtWgWulNB/VXIsv0LoI7lmujWbCAGcis8helOo1wRgYE/NVeD/SEpJGEPkzx9XRuplj+00WsjOYmsbfvtQIcOOJbEtM3d6vqLd+SeFswSg1z01YFX6gagPhHCbDqfy0+DFkkM3QVsAPxKrBwT
-    GOOGLE_CLIENT_SECRET: AgAkBnqzqC9srhWzQA/q7ZfMpgfTy+J0on856vHPrIS8oe5P30vciaGlgkQdf1oMLA5ovHaSq6x9AEqv7HRzoeSrdUSjswZce1akAcXU+wA0mQGzVsmaTpCERAJ7GXWmSgsvIQNQXF5N6BLiZliueDiMIy3sZYAcoffrZ5l22mWOSBlHCXXZqZoP+F4Y4tQrlO28NjlWGo1UBf83JZ6TZMtK7IOuYoMDsZo/NlE1x0zj3beMm1VLvHJXRn1plU06IwlIKH0xEed2izff4FQ7f4Q3Dqmtbz6PhTdVqy4HQvhIrkAl/6IwQCZdTWHRdgv6fXQWs+ZftoeRMHFXI0xB3YfbLoqO8Q2kDqgxSOM8Xixdbabq1v8u0EVZCNRryb+XuWwG46xWNPVF2Nl1SIaeLxWQhFGEXTUf9IqYH9fQ1kpqIlj5IgEa1MUWsx1eE+vik1shT20woU7Lj21Zcu3RZob92qMVNZHheB2Lzkcw+dP1BwRIwXTiLXfdyDDHXlajnkvkkrrcwO62K4zEIIS/LyoLt2vdk63mfXKSz343pnpOsN2hEqJSTkCx3CFhB4JBSybSFrBtljcCDjK95dvsTQq8qZKEqLFZEQjRWXxsiR9aoNo2MCmPA+dDfvsJ7/GZ8mnjyNdLw+UCxrTiyXMI0pAgezZZZf96KPGUL+LnRbJiTHxxsfk+q2/nMZeU+ftZdV0F7zrCUQhkyJZwhYk2XsblyHiKsPCvLHtKbhIXVpwnLdXPgw==
-    NEXTAUTH_SECRET: AgCdNnXbHEuOlg1UnJii5eGJVfBZh5nWaybBODJJK3FbyhYPuj2KhGfNB/ld529FpddAEDv1IGWwKAOaSCkhSv1Nh1P2NZj37jpgbsHx8vw1omLLSkWqtRf1m4AhHhEwQoY49dlAk4AxSkjk5IckH8PbbRWFXx8Ns8kAGrJLrp6i7EbxrkI3U+hbEz93sQwRJo8XOeYCEodr7JPKoYHwy5roAwB0PmFL56bZFfuCa9yEje4BFxdQMrm0grSDMotTDH3nTF6irq5HSOEgqnL7Tt3kHW+Uaz5mvUZcCxAMUoB9q2mjTjm8fiprybVfMmCsib3epcZGrn0DiPZhihePkrfL6vTaz0pm1Nr7qkbtXFVY3RWgZjFpmDyAl/of7ddh9VYQVmqVAhfI610Czqqyou0zFuvlOXGlp1ljp7FNiwo+r02WxYoJ1leikB+CCnVxd/ErELA0AVneGUcWzoKG6r+OlDzsfV/gp2LXanAq2jKyeZ09ARhkLs3PHzkoGDaOF1Dr+3ZCidrfV+GRcnr73P7QEQNO6R+tEmL+idKiLr4uI56zrFg/Vb5Yxk/jMr2Hrfw7ai/nV2A+eqgXFQammCEZlDyCS8GPX8ULervbG/n4JmXXMUtGB9esM40cfTlsNhhv7sBC2P8QkOI00wvgdiwcPkOE+1i33Sxd1Vt20d8EP6TMfwhofQz2zYdYQEWYmBgiG+zX7mwwh3awuA5uH+ooA5vFe/aHPvMYM2rbTYDihEISJt1b6cbCiE8+Iw==
-  template:
-    metadata:
-      name: splitpro
-      namespace: splitpro

apps/splitpro/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: splitpro
-  namespace: splitpro
-spec:
-  ports:
-    - name: http
-      port: 3000
-      targetPort: http
-  selector:
-    app.kubernetes.io/name: splitpro

argocd-apps/add-ons/anubis-operator.yaml

@@ -1,28 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  name: anubis-operator
-  namespace: argocd
-spec:
-  destination:
-    namespace: anubis-operator-system
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    kustomize:
-      images:
-        - public-registry.brunobernard.dev/techarohq/anubis-operator=ghcr.io/eznix86/anubis-kubernetes-operator:0.4.4
-    path: config/default
-    repoURL: https://github.com/eznix86/anubis-kubernetes-operator.git
-    targetRevision: v0.4.4
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/authentik.yaml

@@ -1,55 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: authentik
-  namespace: argocd
-spec:
-  destination:
-    namespace: authentik
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: authentik
-      helm:
-        values: |
-          authentik:
-            error_reporting:
-              enabled: false
-            postgresql:
-              host: postgres-rw.postgres.svc.cluster.local
-              name: authentik
-              user: authentik
-          global:
-            envFrom:
-              - secretRef:
-                  name: authentik-secrets
-          blueprints:
-            configMaps:
-              - authentik-blueprints
-          server:
-            resources:
-              limits:
-                memory: 1Gi
-              requests:
-                cpu: 100m
-                memory: 512Mi
-          worker:
-            resources:
-              limits:
-                memory: 1Gi
-              requests:
-                cpu: 50m
-                memory: 384Mi
-      repoURL: https://charts.goauthentik.io
-      targetRevision: 2026.8.3
-    - path: infra/authentik
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

argocd-apps/add-ons/cnpg.yaml

@@ -1,28 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-  name: cnpg
-  namespace: argocd
-spec:
-  destination:
-    namespace: cnpg-system
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    chart: cloudnative-pg
-    helm:
-      values: |
-        replicaCount: 1
-        config:
-          clusterWide: true
-    repoURL: https://cloudnative-pg.github.io/charts
-    targetRevision: 0.29.0
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/add-ons/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - argocd-dashboard.yaml
-  - authentik.yaml
-  - cert-manager.yaml
-  - cnpg.yaml
-  - postgres.yaml
-  - sealed-secrets.yaml
-  - traefik.yaml

argocd-apps/add-ons/postgres.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  name: postgres
-  namespace: argocd
-spec:
-  destination:
-    namespace: postgres
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: infra/postgres
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

argocd-apps/add-ons/traefik.yaml

@@ -1,67 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: traefik
-  namespace: argocd
-spec:
-  destination:
-    namespace: traefik
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: traefik
-      helm:
-        values: |
-          ingressClass:
-            enabled: false
-          providers:
-            kubernetesGateway:
-              enabled: true
-            kubernetesIngress:
-              enabled: false
-          service:
-            spec:
-              type: ClusterIP
-              externalIPs:
-                - 192.168.2.5
-          gateway:
-            listeners:
-              web:
-                namespacePolicy:
-                  from: All
-              websecure:
-                port: 8443
-                protocol: HTTPS
-                mode: Terminate
-                hostname: "*.whyredfire.dev"
-                namespacePolicy:
-                  from: All
-                certificateRefs:
-                  - kind: Secret
-                    name: wildcard-whyredfire-dev
-                    group: ""
-              websecure-dpdns:
-                port: 8443
-                protocol: HTTPS
-                mode: Terminate
-                hostname: "*.whyredfire.dpdns.org"
-                namespacePolicy:
-                  from: All
-                certificateRefs:
-                  - kind: Secret
-                    name: wildcard-whyredfire-dpdns-org
-                    group: ""
-      repoURL: https://traefik.github.io/charts
-      targetRevision: 41.6.0
-    - path: infra/traefik
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - add-ons
-  - services

argocd-apps/services/bentopdf.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  name: bentopdf
-  namespace: argocd
-spec:
-  destination:
-    namespace: bentopdf
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: apps/bentopdf
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

argocd-apps/services/garage-ui.yaml

@@ -1,44 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "4"
-  name: garage-ui
-  namespace: argocd
-spec:
-  destination:
-    namespace: garage
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - chart: garage-ui
-      repoURL: https://helm.noste.dev/
-      targetRevision: 0.12.1
-      helm:
-        values: |
-          config:
-            server:
-              domain: garage.whyredfire.dev
-              protocol: https
-              root_url: https://garage.whyredfire.dev
-            garage:
-              admin_endpoint: http://garage-admin:3903
-              existingSecret:
-                name: garage-ui-secrets
-            auth:
-              admin:
-                enabled: false
-              jwt_private_key_secret:
-                name: garage-ui-secrets
-            cors:
-              enabled: false
-    - path: apps/garage-ui
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/services/garage.yaml

@@ -1,90 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  name: garage
-  namespace: argocd
-spec:
-  destination:
-    namespace: garage
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - repoURL: https://git.deuxfleurs.fr/Deuxfleurs/garage.git
-      targetRevision: v2.4.1
-      path: script/helm/garage
-      helm:
-        values: |
-          garage:
-            singleNode: true
-            existingRpcSecret: garage-secrets
-            noClusterRole: true
-            # No discovery is needed for a single node.
-            garageTomlString: |
-              metadata_dir = "/mnt/meta"
-              data_dir = "/mnt/data"
-              db_engine = "sqlite"
-              metadata_fsync = true
-              data_fsync = true
-              replication_factor = 1
-              rpc_bind_addr = "127.0.0.1:3901"
-              rpc_public_addr = "127.0.0.1:3901"
-              rpc_secret = "__RPC_SECRET_REPLACE__"
-
-              [s3_api]
-              s3_region = "garage"
-              api_bind_addr = "0.0.0.0:3900"
-
-              [s3_web]
-              bind_addr = "0.0.0.0:3902"
-              # Required; a bucket's full name also works as the Host
-              root_domain = ".web.garage.internal"
-              index = "index.html"
-
-              [admin]
-              api_bind_addr = "0.0.0.0:3903"
-              metrics_require_token = true
-          image:
-            repository: dxflrs/garage
-          initImage:
-            tag: "1.37.0"
-          persistence:
-            meta:
-              storageClass: local-path
-              size: 1Gi
-            data:
-              storageClass: local-path
-              size: 9Gi
-          podSecurityContext:
-            seccompProfile:
-              type: RuntimeDefault
-          securityContext:
-            allowPrivilegeEscalation: false
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: admin
-            timeoutSeconds: 3
-          livenessProbe:
-            tcpSocket:
-              port: s3-api
-            initialDelaySeconds: 60
-            periodSeconds: 20
-            timeoutSeconds: 3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              memory: 1Gi
-    - path: apps/garage
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true

argocd-apps/services/kustomization.yaml

@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - bentopdf.yaml
-  - betterslcm.yaml
-  - garage.yaml
-  - garage-ui.yaml
-  - jellyfin.yaml
-  - legislative-summarization.yaml
-  - qbit.yaml
-  - redoost.yaml
-  - rustbin.yaml
-  - scriptscribe.yaml

argocd-apps/services/redoost.yaml

@@ -1,63 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  name: redoost
-  namespace: argocd
-spec:
-  destination:
-    namespace: redoost
-    server: https://kubernetes.default.svc
-  project: default
-  sources:
-    - repoURL: https://github.com/whyredfire/redoost.git
-      targetRevision: main
-      path: chart
-      helm:
-        values: |
-          appOrigin: https://redoost.whyredfire.dev
-          sitesOrigin: https://whyredfire.dpdns.org
-          httpRoute:
-            annotations:
-              argocd.argoproj.io/sync-wave: "2"
-            app:
-              parentRefs:
-                - kind: Gateway
-                  name: traefik-gateway
-                  namespace: traefik
-                  sectionName: websecure
-            sites:
-              parentRefs:
-                - kind: Gateway
-                  name: traefik-gateway
-                  namespace: traefik
-                  sectionName: websecure-dpdns
-          s3:
-            endpoint: http://garage.garage.svc.cluster.local:3900
-            publicEndpoint: https://s3.whyredfire.dev
-            websiteUpstream: garage.garage.svc.cluster.local:3902
-            bucket: redoost-sites
-            existingSecret: redoost-s3
-          networkPolicy:
-            enabled: true
-            gateway:
-              - namespaceSelector:
-                  matchLabels:
-                    kubernetes.io/metadata.name: traefik
-            s3:
-              - namespaceSelector:
-                  matchLabels:
-                    kubernetes.io/metadata.name: garage
-                podSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: garage
-    - path: apps/redoost
-      repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-      targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

argocd-apps/services/rustbin.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  name: rustbin
-  namespace: argocd
-spec:
-  destination:
-    namespace: rustbin
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: apps/rustbin
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

argocd-apps/services/splitpro.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-  name: splitpro
-  namespace: argocd
-spec:
-  destination:
-    namespace: splitpro
-    server: https://kubernetes.default.svc
-  project: default
-  source:
-    path: apps/splitpro
-    repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
-    targetRevision: main
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

bootstrap/argocd-cm-admin-disabled-patch.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cm
-data:
-  admin.enabled: "false"

bootstrap/argocd-cm-application-health-patch.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cm
-data:
-  resource.customizations.health.argoproj.io_Application: |
-    hs = {}
-    hs.status = "Progressing"
-    hs.message = ""
-    if obj.status ~= nil then
-      if obj.status.health ~= nil then
-        hs.status = obj.status.health.status
-        if obj.status.health.message ~= nil then
-          hs.message = obj.status.health.message
-        end
-      end
-    end
-    return hs

bootstrap/argocd-cm-oidc-patch.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cm
-data:
-  oidc.config: |
-    name: Authentik
-    issuer: https://auth.whyredfire.dev/application/o/argocd/
-    clientID: argocd
-    clientSecret: $argocd-oidc:clientSecret
-    enablePKCEAuthentication: true
-    requestedScopes:
-      - openid
-      - profile
-      - email

bootstrap/argocd-cm-url-patch.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cm
-data:
-  url: https://argo.whyredfire.dev

bootstrap/argocd-cmd-params-cm-server-insecure-patch.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cmd-params-cm
-data:
-  server.insecure: "true"

bootstrap/argocd-cmd-params-cm-server-side-diff-patch.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-cmd-params-cm
-data:
-  controller.diff.server.side: "true"

bootstrap/argocd-rbac-cm-patch.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-rbac-cm
-data:
-  policy.csv: |
-    g, admins, role:admin
-  policy.default: ""
-  scopes: "[groups]"

bootstrap/argocd-root-app/root-app.yaml

@@ -4,14 +4,14 @@ metadata:
   name: root-app
   namespace: argocd
 spec:
-  destination:
-    namespace: argocd
-    server: https://kubernetes.default.svc
   project: default
   source:
-    path: argocd-apps
     repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
     targetRevision: main
+    path: applications
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
   syncPolicy:
     automated:
       prune: true

bootstrap/argocd-server-clusterip-patch.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: argocd-server
-spec:
-  type: ClusterIP

bootstrap/argocd-server-nodeport-patch.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: argocd-server
+spec:
+  type: NodePort
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+      targetPort: 8080
+      nodePort: 30443

bootstrap/kustomization.yaml

@@ -2,38 +2,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: argocd
 resources:
-  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.2/manifests/install.yaml
+  - https://raw.githubusercontent.com/argoproj/argo-cd/v3.2.6/manifests/install.yaml
   - argocd-root-app
 patches:
   - target:
       kind: Service
       name: argocd-server
-    path: argocd-server-clusterip-patch.yaml
-  - target:
-      kind: ConfigMap
-      name: argocd-cm
-    path: argocd-cm-application-health-patch.yaml
-  - target:
-      kind: ConfigMap
-      name: argocd-cm
-    path: argocd-cm-url-patch.yaml
-  - target:
-      kind: ConfigMap
-      name: argocd-cm
-    path: argocd-cm-oidc-patch.yaml
-  - target:
-      kind: ConfigMap
-      name: argocd-cm
-    path: argocd-cm-admin-disabled-patch.yaml
-  - target:
-      kind: ConfigMap
-      name: argocd-rbac-cm
-    path: argocd-rbac-cm-patch.yaml
-  - target:
-      kind: ConfigMap
-      name: argocd-cmd-params-cm
-    path: argocd-cmd-params-cm-server-side-diff-patch.yaml
-  - target:
-      kind: ConfigMap
-      name: argocd-cmd-params-cm
-    path: argocd-cmd-params-cm-server-insecure-patch.yaml
+    path: argocd-server-nodeport-patch.yaml

extras/add-ons/argocd-repos/repo-sealed-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: repo-gitops-private
+  namespace: argocd
+spec:
+  encryptedData:
+    password: AgCYFWUZmqWTYbutOvQr0GJ87zvVwW/GYanXC4Qdlqo1nkYC0u/ve88UonB0UklJPfMq59/jefbrl80fg4JUMLJMBnNUiIfUIJ2gN07n5P1UqQGTFwo8iHFD4XwKlCfSD75wQXBhccWO1zS1lVZEIzbUdom7rI45bG2Q+u5NQBC/bs3NxrrzYqrHFsbE2jEeu0hG33JOoikvLOwih96Xxgadrvbdw/WpY2bbqM/BSA35u8fzeDF4ZZ98x7LPzflP04DxKJZLh5U3H1//RjWaKeNkDwp/dtNm63NPJrh7+rD+EOHu4undBwNHIW4vrv4bRQeP4xBERNFquiwwmQsi2Wwd4kpD+kgbGhezYMDgk8FOBwS04DJJJpvYdJdGTZoCwML1C+iwMoKhwk7WFvg4vkW3DBpRh+w9Otdq4odsklqgwp1o8OXL1hcd/iQqp8TiuwUFlmJhTs841xvqRMuCBQ0SnAwQ/u9kEsY6C6r/EvdaOciRoEWa0pMk3zvkaCrSkoAElYtXh30MhGfd1rbWT09Xvh/ACRjarBvLHUa7fPSc9Po9t+6eRuFR1cqT2jwUtHMuAqFA4XDC+oHkLsz8WD8qm4K9dwfOXME1rT2OoByaSdlSDsV6uKWRlMxxrzBGzihUBp1TSI8X+ux90hp5vQ30BKqGCC0Y3aRHprndDcHvdP4ASJ6++uu3ZkD6cY/he87w21ETl9+zxo8=
+    type: AgBWyIT44g9RaY/2dyznsXqQ3lVS0q/zJ5MeQhqkREsCn37U8ZxUrVqrmYq+RJU+cPVDWSl2tnmnfjvzV6+SEroVPAaTduRSFYxP6X4xsFuarJ21GSOAvt4Zc1ODZXYxCKfEAB+K7djc+g4+WOp/RihxKue9sevsM2krxnBXouNn7gXOog2Vd7mHbenuuGNVzV6ROJU7tw3uzZ/KETqr+5Jr1bKf64URkcN1njxb9lJHmK+VJbWPLcIbaGCfel07QqX0+EQXjIMwvpHoiWF25dJfPtbADlF/UIjWRXRRh5pCoppXpte39S4nrkkyOKCe2l7IctYF6+pvg5xNOmPeYnqIxpgZwWlWg2TcI5pn4aTxyXA+COJs5VQYgGDxPyNmm2lqh77hzHFceTxlFjtS5u5UQBzjagClXg2lYi2YRcnMTLUHDJyisT9Gr7bpgRK1BU19yxMg5f+vhzL5GmPMtOE6r9dZXwbi5660Okrn7x1MEgHb7poiXbG920yEC3mqVB6+1HLzoY5603b44VafDCTh2AtslSEW8n4Dt1gBm8DAOcDvq1e3NMn8Aq7cyGF5L7x0WwXLjgjr26nf6XiyZ9NAOD2upyJDCZvvVqcFypqOFsFOyhZXU86vuRW35tNqq6N3ppL2OFmm84ies04InHGTJHS3ps8KCyXWow1PgGhn/spB73JSjW4nsUztQPThOQ2c2JY=
+    url: AgDV+GO2ccs/uj87TNXbhSA18Y8amZiqmasZcijd/Zpjv8LPw94f9PORC1v9DhautblXF+Y39MnBjQm3pYLEbIU7FBDpx/Kkk34+F/tTfJqmQOcvGjEZLs73I7kvvy9Uy2Wme/uJt4PpR3UyJEAwJKNudC2NAJz2gfS7lsk+6AUpc+Z6MBoETdUQuaYlk/cxliWnPbJx8EYOS0TEaLezZ27w1OeN2kYEtnZ+qRd/+6g68MpM6UeoL53kOwNOcXN67+IdPE17zD05I0SPIKJy760Ukw/S1sphUpfQgOueHpmgpQanzJWZDCyudLpgnWS/cVWmZY0tDcgmiWCVJwYVFML8Qse3oXWRixIIunhMSS8jFk8Sa/v0agY8SOeIEWIx7n6G6jGkBLK5QZ8Y689UqsfsuKy3aUxno3gqzz4WibjdwAJfNsWCb3P6ZH2AfeTw7gz9HD/AiMRGuSTlzZpGS4acyltwbkKKz1WwLZF/qXtL0hi7QrYIPK82hKF7s458s0KQG2lE+bWOUG0WGjMWys6FwEbe5p3OTT2ea45+OyL0BlFQFkXHeIlxpq86Iz2KVxy4age5SghpSBn3+S3NM4voo9QDIeLXF++EOLCQXRXHgp4vOnb/nAVkbfQ6cvs2HBVg4lSYaNlBlznkPORiUNvXuu2JKHeKzXEJWhwIvmXrnac629MEaCCONEiBaTAy3B08WjSzvWUkxXYuBrRvrcm/JOP8K2yNgtJTRGGbH9SbMTJ8RoqgMC+GjokIFvlButxh0MeXlQLk0huV
+    username: AgBB0XO+j5xoMAgvbIKEf0/ghe9rPwoTnzZvm4lbakuCc4BEKl1Zm5bkNQilEBpxl/TsfnxdhhGnNvF9DXbIJjoEfEU8wzX5LpBMXt5qWC1Oquul4qvEHw6kMCu3oJ7hQ54yBVIhM5W9n1c6UWhJ6ttwZJ/ymqGLFWh1r/3KhoiInfU2EkPJ7bte085rUuyT524mwH9pfGEwte6VjuHPXBQt22i4fP+BBT3pV443PISshGfQC28bpt8vMi83kE/ICkwg21AQUImvfcHXojUJE5dks4mbrA49532R4uDVseVxCrW5fCtevQmgHbkyOke3FQG1AspXx7gdLldKVeW7QBgDP6O9DuEZgNzrxY6T4jf2dNUi1y5W00A4hJVMvIyBy4wENGIj1JJto6D1pRbYPzugKzUhb529UHS6Oxy3H2GqoE5L+mTbrQ2Nm8OhLeaSXUqQtJreZg9GYDZ3sjTe5tlqmcRisM43D5Aw/vV9wu40pRB0OTKM6nIHw1emg/Bq7ZAlZ9S8OpJYitO4SU9J1sOjnI1K3O1QLWB3buGoMnH/1k+Tt7rvYajWyqBM4ODV9O3yN1G9zEEXxzK7sz84JPGAevNJo7fiu8YdaMXhxVywhN43q6PpPQqTdqwQ0muJ5FqJbAzmOiDSQtF18OfpORrKJXVOwD/iFUS4V/6WKqn9HDAc1Dff1CgqJ8IOqxO43Jj4gpvkH2Owzdyf
+  template:
+    metadata:
+      labels:
+        argocd.argoproj.io/secret-type: repository
+      name: repo-gitops-private
+      namespace: argocd

extras/add-ons/cert-manager/cluster-issuer.yaml

@@ -1,18 +1,16 @@
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
   name: letsencrypt-prod
 spec:
   acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
     email: [email protected]
     privateKeySecretRef:
       name: letsencrypt-prod
-    server: https://acme-v02.api.letsencrypt.org/directory
     solvers:
       - dns01:
           cloudflare:
             apiTokenSecretRef:
-              key: api-token
               name: cloudflare-api-token
+              key: api-token

extras/add-ons/cert-manager/wildcard-whyredfire-dev.yaml

@@ -4,11 +4,11 @@ metadata:
   name: wildcard-whyredfire-dev
   namespace: traefik
 spec:
-  dnsNames:
-    - '*.whyredfire.dev'
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
+  secretName: wildcard-whyredfire-dev
   privateKey:
     rotationPolicy: Always
-  secretName: wildcard-whyredfire-dev
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - "*.whyredfire.dev"

extras/services/jellyfin/httproute-local.yaml

@@ -1,23 +1,21 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
   name: jellyfin-local
   namespace: jellyfin
 spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      kind: Gateway
+      sectionName: websecure
   hostnames:
     - jellyfin-local.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
   rules:
-    - backendRefs:
-        - name: jellyfin
-          port: 8096
-      matches:
+    - matches:
         - path:
             type: PathPrefix
             value: /
+      backendRefs:
+        - name: jellyfin
+          port: 8096

extras/services/jellyfin/httproute.yaml

@@ -1,23 +1,21 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
   name: jellyfin
   namespace: jellyfin
 spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      kind: Gateway
+      sectionName: websecure
   hostnames:
     - jellyfin.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
   rules:
-    - backendRefs:
-        - name: jellyfin
-          port: 8096
-      matches:
+    - matches:
         - path:
             type: PathPrefix
             value: /
+      backendRefs:
+        - name: jellyfin
+          port: 8096

extras/services/seaweedfs/httproute-filer.yaml

@@ -0,0 +1,25 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: seaweedfs-filer
+  namespace: seaweedfs
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  hostnames:
+    - seaweedfs.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: seaweedfs-all-in-one
+          port: 8888
+          weight: 1

extras/services/seaweedfs/httproute-master.yaml

@@ -0,0 +1,25 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: seaweedfs-master
+  namespace: seaweedfs
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  hostnames:
+    - seaweedfs-master.whyredfire.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: seaweedfs-all-in-one
+          port: 9333
+          weight: 1

extras/services/stirling-pdf/httproute.yaml

@@ -1,23 +1,22 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: bentopdf
-  namespace: bentopdf
+  name: stirling-pdf
+  namespace: stirling-pdf
 spec:
-  hostnames:
-    - pdf.whyredfire.dev
   parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
+    - name: traefik-gateway
       namespace: traefik
+      kind: Gateway
       sectionName: websecure
+  hostnames:
+    - stirling-pdf.whyredfire.dev
   rules:
-    - backendRefs:
-        - name: bentopdf
-          port: 8080
-      matches:
+    - matches:
         - path:
             type: PathPrefix
             value: /
+      backendRefs:
+        - name: stirling-pdf
+          port: 8080
+

infra/argocd-dashboard/httproute.yaml

@@ -1,23 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: argocd-dashboard
-  namespace: argocd
-spec:
-  hostnames:
-    - argo.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    - backendRefs:
-        - name: argocd-server
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

infra/argocd-dashboard/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - httproute.yaml
-  - oidc-sealedsecret.yaml

infra/argocd-dashboard/oidc-sealedsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: argocd-oidc
-  namespace: argocd
-spec:
-  encryptedData:
-    clientSecret: AgAuadGZNylY8/lomfIg8PybwBtfZ20BXDfNacgIMMdRanRgRnLhMghaZfcQbcGuKRaAIya/aIqbUKkQwat2elypOp374wvDHilnaQ0DQ4qCBGZlPLMSzyEoz+sSuB3c0YHLcj48DIF9b5b24jsysS9mllTQCeEBNsuXiEjEuSBUpu6EbR5ztRPnEi8OnuJYTMJtnMVX0iPEqEK4DsR/c7ActayVBG+sGDK/ZyACxyLg8cuhJ2p7SyxqCwqtaS4NaKC6d4WK+3LEQcAd65PWeSKbR7zv77EcUQ8yzaM3yDXIZMmgLMzynfPgyll9aLr31n2UOaNU2uZPT6JtlnPARU1WuzQHcRCdJBjuKneDahE2D3m7sClxUCNXTgXfZqsWl6/gSvZrREukQyJgIz6mmmN3rUjYRn0lG+0CU6o1uDFGHyn9GEmzTPT4zt/U0YD7LjwdR+tWHBUmzQCPbe2DcPQLb+OwyY0M9RC52btfJVyErjMXN7TP8ut1Gmf6p0phr9ebVH9hNAPWcfbWkNG4r8c4gzHDca9ULPrwjz1oJsNeHf6ZXu3Zu26xnFsLswSQqWSSpBrHA9F5bl3U3/ScNErD+wrP6lH6dqcGGJVpMMUhDDNBKkSsu8zL8M97x5MYZPwAI+EfNF5ijdzqZbgEU0iTjJv5fHX1i+rGhbzkfqvuI3ti/8CkcSB/dEAYQXwfmSrtPJISX1zEWhqzgIfIDuPk2BmD+rKmWL906+aff7M/Ns32wZlvN3eCPVjO9w80mkn6OJY11re0Si0eg4ksUZDH
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/part-of: argocd
-      name: argocd-oidc
-      namespace: argocd

infra/authentik/blueprints.yaml

@@ -1,69 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-blueprints
-  namespace: authentik
-data:
-  google-login.yaml: |
-    version: 1
-    metadata:
-      name: Google login
-    entries:
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: default/flow-default-source-authentication.yaml
-          required: true
-      - model: authentik_core.group
-        id: admins
-        identifiers:
-          name: admins
-        attrs:
-          is_superuser: true
-      - model: authentik_core.user
-        identifiers:
-          username: whyredfire
-        attrs:
-          email: [email protected]
-          groups:
-            - !KeyOf admins
-          name: Karan Parashar
-      - model: authentik_sources_oauth.oauthsource
-        id: google
-        identifiers:
-          slug: google
-        attrs:
-          authentication_flow: !Find [authentik_flows.flow, [slug, default-source-authentication]]
-          consumer_key: !Env GOOGLE_CLIENT_ID
-          consumer_secret: !Env GOOGLE_CLIENT_SECRET
-          name: Google
-          promoted: true
-          provider_type: google
-          user_matching_mode: email_link
-      - model: authentik_stages_identification.identificationstage
-        id: google-identification
-        identifiers:
-          name: google-identification
-        attrs:
-          sources:
-            - !KeyOf google
-          user_fields: []
-      - model: authentik_flows.flow
-        id: google-flow
-        identifiers:
-          slug: google-login
-        attrs:
-          authentication: require_unauthenticated
-          designation: authentication
-          name: Google login
-          title: Welcome!
-      - model: authentik_flows.flowstagebinding
-        identifiers:
-          order: 10
-          stage: !KeyOf google-identification
-          target: !KeyOf google-flow
-      - model: authentik_brands.brand
-        identifiers:
-          domain: authentik-default
-        attrs:
-          flow_authentication: !KeyOf google-flow

infra/authentik/httproute.yaml

@@ -1,37 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-  name: authentik
-  namespace: authentik
-spec:
-  hostnames:
-    - auth.whyredfire.dev
-  parentRefs:
-    - kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure
-  rules:
-    # The ArgoCD Android app posts to the token endpoint without its trailing slash
-    - backendRefs:
-        - name: authentik-server
-          port: 80
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              replaceFullPath: /application/o/token/
-              type: ReplaceFullPath
-      matches:
-        - path:
-            type: Exact
-            value: /application/o/token
-    - backendRefs:
-        - name: authentik-server
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

infra/authentik/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - sealed-secret.yaml
-  - blueprints.yaml
-  - httproute.yaml
-  - referencegrant.yaml

infra/authentik/referencegrant.yaml

@@ -1,17 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: ReferenceGrant
-metadata:
-  name: outpost
-  namespace: authentik
-spec:
-  from:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: garage
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: qbit
-  to:
-    - group: ""
-      kind: Service
-      name: authentik-server

infra/authentik/sealed-secret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: authentik-secrets
-  namespace: authentik
-spec:
-  encryptedData:
-    AUTHENTIK_BOOTSTRAP_PASSWORD: AgAPgYcs6IXUWk3VUgoPNQXwP43kEKP26OAJmu7dA4vTRhmWwmJXN8ybRhX7jS2YPwGWxAWflxiM3x7F3jUohOpqN37et4zFCoUq43mQ3blbTMV4zhsuyMx0JIqhsafzlVWiKqmqIykVq8yJQ6886FkIS0u14i//YTcs0QMS7gum6pDEhehAg+FhwiNgm92iVCyhoh+3rL549akXe53UJNKwVzuWavEHZFTKJNmFa2g9YzYcJgNf46f7maPbfSg09E27XC9L7KNxxiodU2h0D50La8LMEX+X0fAbLtrXPf9MsJjcfNvy0kXqy/AB+A5zL/Yh4uVztWikE27evDvfeoWc9svCTIbBzwx1EtR/nC71IvN61ADpFGbTXA44jSOtPg6nNtOAq8AEqIp0p3uNbQK17cEfbmDtq8husTYF1i6e+VFVGIltPiGdRSZb92xtLGkf63YfdYXSy+xaiIJ/8ki4vgw91KY0l5/9sS1BqWR312UUEAtOGt7M4cydVEWToc1AdYj3RDBgPjmqoddiR66EMzhCFz5sxlU/rji7j4DAOFA4gqAV5JAZO1HehNFp2GajTi36d0XLe06/Z+IbEmSeTlPTGZOvxTweYcWexplzp/ob/MwAaMouPRcmae4/VTlu9Lex1bMYugc6bD8B7V+gmM/MhY7heQl+mSyBV0CO6JsZwC1tipzcJfaiBzUF8sZ7Ast3v+7omsjFo/CXqxbPNZrolipiEjE9IT3n3r2m7gpIkv+A/ie77iJF8k6zFRM=
-    AUTHENTIK_POSTGRESQL__PASSWORD: AgAoQ04gX1QOUI5kfNMNy07pnaqDTp4X6LDlQBBwSs13SVGZCJAL61hQymOaL/U2cCyc0N5nr7FCswHcqBE8t1esKlK/NB+BL9aWfO7uPonhdzsc2iKBONZYickCyyD+8Hgu/McQDPVo6vMQ51/82WL2ZKfwJEfTKmo1OfJ/I2Tls2KmczzlkNrCC9M5moObXl+PJlKJuxAkeXJc61MSn/vvsvksG5O0AKtXHmTk8E1t7krAbOqKy9CbVwHJAwH/NIhiOgJr/KziceWhHHQiEwC631ZpM+fZWiUSKETwpnLWSl7s8SvsEUNA9s/W2w24tpqSKrHOZtS6J0sT84FsV9U9T5MaZtZT9NG3FmNehxQpIlet6BSyJh+JMq5LjzA8ANvVvlXs4jhJyTcotLf/m1ZJbetVjFGJjvxUbVuxObpMentVrAeLO8cZqk1iTzqPdkrEeV38DN2E9oJSyQeRP6sZTnDd9xweou8nwMZWidyIDorTKSwvggje2YDXefc8+aOVVCN7pBOwKisEuPH35Ov/A2RDzmE3mQRC3EDuHJ+3dZbVawIawV0ZUIL52X+ongbllOtHABUfODY7tTC/VQMk07d3/zG5q7bCE2D+R0XE4oQJy2h2wYHiYUoGYM5JKC2me4TIx6Y+haksl2mqfC/yal3FLWMBdK4eC9VyXugO25l4yLVOcKa/QMhImHB6lbyNLGDuafnIanMkraWo73EqqXpF3IIqfzfgkj4aOO3Cbuu6BeQ4bNmmam+cWLqq1QQ=
-    AUTHENTIK_SECRET_KEY: AgAHHDs8mbJRc45DFgap2VUZn/F+m59hm9u2lebuJv70HSBxLLsHEn8nXLGUO3b2ScyPt1Qi2wbmRDENTjOHOYHtAQAjwV25r6RUiZ5TosRH2KhGx5N6gceorYQyk18l2CkKv4ObXjeGLJA0EqMarmFWiT24SFZdtIrOvWygLxg4XGful2h1Fw5uXK9PiUHgptrp/G5M5Htv0bvtD6m/FrgOlK6C6tK1D4vLL3VLX3/SceqNWVDIJmJao5JKO4IZTQxN8TN5k9K2CGrtOUhjCn4vLbYQKTPhiiidoQaipQ9FR+4KJMO0y8FbIy+3q7C/UZPyOTOu/2zI4t5h4TJY1+477A80GTLpE0aCBDpmFwgZY728wbTW4NyfIm15u0Um7OXhnJkXC1EqDbvlK4HYHiSDUjGChvlfMEY+D1datDlF1fEuIaeXtTqowpz3uy9qIEa0f1emS2J8TjIrKH3oW3mfmrJKSiySnCX1704ZPlwOJfnF5Z2vM6Oqo/mWHa6PSwPPRxSxEKVtSqD4KynzrUmx3GkrUs+7tntepA3yQoiDjyUyE71FwhJXO4sE3XcRGDUf4rB8CFO4+NgTbBAqFzNKYG32GIDhGjbMxBAJQMNXZhVcKceiaXf7G8LuaOEw39BkdtiFCdK3uXl9xaQPuStRsOYYQR2Dt0vt3AvDGjAW+McauCbYUD3rcAtVMo+rxEbejrotojWnb1OpGX0JqD5gHC68qlqY6BYkDbWpYojoKWJHuHlYxHIm8k7ghSq6npw94R526bxripNtcNq4Lh1NeM55LKruOEGr7n0dFcyAmQ==
-    GOOGLE_CLIENT_ID: AgCV2Rwe/bHbkQ3nkkIs4EFTbsEqQWRaWlXa/fHzkDyNKpd0CTOgqVb6Rd2KYyvoT9iDR0xt/8reLPd9e7B3G3V1oVFV7G1XiErBmzvxr6591+tXzo8JLVpIy0363R87idi2xIKGVii+G5aJvxxhua8IRsNfi4SRtoqpDzjgNbFtm5UDhhlCzcRKkm0zHgLw83d4Uwszu9X9II2A4FuMPD6KvsTFrgHevR1v3OerKl5kvTlUx0O3XEg5mnNUVk46J+D9wfg58bIlgUhMV8NtfKa8I5zmRKhCJySks1zlCgIudCLX7wPYupFgt0nrZjJGx7a546ntPdMVE4IJ+VhlQ94gjdWsVFm07espaQLph9T4CZDKxb6TwyNswhfFxH1Z9auyFf3Cfk2wx5GChNOL0mZ8Zrzcw008c8IUShF8je8JZ60teBffbBNao7XN6JM6a4ac5aKnNwFch9IJUU1qkvcJaZk5hAkeGO9uHrICb6lkr5Rj7t4h9l4mvgfIKXP5YCCKZ+yqrSI8Jpkch/cB0Sphgp7m7QXgGwmWRgdKEk1rP7ioIfoF66mLsfgvOkc+1ySvPgW/rCLbHwzMqJn1Fkk/afbRoWp/guFj1cOY9MrEQIn8ftugeV/0xWiL+y5RyJm7QZc1z5fSj/NTrVCZV0LhBHttPZzoGGWEqjLYQnyJ8p38lK7EU6Pmk4WrEMj7mmdYHEijyPhab+b7guOc+ULbPT7k7sBHXbKrTTUJa09jIqSS4jl2PNrzPCPDIvRpG/cMgNklhNPfvpDQcLdVRA7bsf7navZvDsQ=
-    GOOGLE_CLIENT_SECRET: AgDNFpqV5LGekTMvOBtPE9c6ZVPtT6wN+nCFRhZnvBKIz4I7U9jzisEN7yhc4ud22XJXpS5oR8hN4H+V6Js/bCZMDJefYcdstmHku14kUvoLRUtwPV9tdjiihmb57VLTnT1s1OzbnOqZPwXoCAmGAPLDgZrghBi0id21GgjU41jCHDJCcH1j9RHhE20JwsVG2uz9Tcp6MVYh94aq53V4//bvFXz4xQgVlN8c1jJ/W4rrNM9vmYdMwKyB5509oVWJigowsRlji0FXurR8ovz1AXpMuGj6hUGxLp0uHsqz7FV/0lsd4B2BR9cVRChAR8zDCiiKb4TH2Kmn676/Z+gtJ8vcOQg/WDT1ENzOr6dyndCLVxJvJuvl1EqinzhSqJjUy11HxqULApKKbX1iRJIAIGb6dpeKVoHDKg5xtcWGwaD6epG/tz20agkWBMCFNq5aS80npz28W5GeOQ8aF4X/rpjuEHVLrN+n0pgyS4wjwniB6UJMYRIYk45r0ICUtqyFjOiNzpU70NsPmEjDyItW1EVo+6tb0lRmOI5apm/9yayZXjFISwTAFPdBMrQL+ij4AGw4HMWMmN0aqDO+Kd1c9Jg6wUKluN2Lb6CaxehWeSJiz2wTEhEz8KBkInfezgSekNkw4wjJiBEZ4/M3G6Y/C61ekuVFarRc87cY+S3SomVZDGQcPysfQlieMVpHlfXq/CSDgHhZV3Q+S/wqpy5ZcfsyaU+v4PmvyEc12MZxQ1RGngVJow==
-  template:
-    metadata:
-      name: authentik-secrets
-      namespace: authentik

infra/cert-manager/cloudflare-api-token-sealed-secret.yaml

@@ -1,13 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: cloudflare-api-token
-  namespace: cert-manager
-spec:
-  encryptedData:
-    api-token: AgCqVfWKc3TVZOWN2kWfWcEe+5pf5lRMOzcQUjgI7Wd4/0cDogagn0fF3MR1+tcm4kaxXyn0GzZLoOT4mWetg/BoGYY6X4DYy6fsyFzpvpY8mtdwiTrYtzdORSz1qw2U3yerB1st//Cy90D+sw8V13MGDh0vD0OEtYG4Xf1foRTR5KClzHmy16gjp64d4dbFWLO1oa99drQkCGRPhHcDzcrT0bFOutjN52p8AVcjBlzDMpP2k/Wo9wT4MiDv+clrXwOVyvARk5DrN9KY+iRiB0NkBvHaVNkQ9M62sIUJ9asBwIWZCY/aV4xGEvx9LYxAWvzIqmXBy+DOlOo3gOavQCOBI7Gdz015V1oIsViLQXG3j+5m0PSbguCNCXQhF9zmgqoJgiEpC2aFcU9oCZ/JS/DTiD8Xq60JSyY8bQE/yMX3vHAnXm5HOe14WJ60GkjGXPsBWWjmtAeBltAUW1WJfkTnHm/aPBflpZBkuJgkCpL2iMERETi0e4UfOuvf06cN3testuFfR9sIn6aD9mMY4B9e+6TLbjFF5uSf/W9/aMhLLTG8Mh5pZneGDndfRm6IG3Lj506xLOo3CAOA9BYF7MiShrgtuLmDH/pd8YCRTxsboYigQ2LrobpaQnkKYjHqLWNJi/I1rXefmEXK1mR8zZKJzBIsz4NG9TTary9v34yL22n9L+RtWJhrsFDXQqz7C860J7ifa28VJObo1QZN9bzsWoTPzUjK/Yw1GvrVUVUAsNyzbCgUjFUbrydoPmpx4ntmj6fSxQ==
-  template:
-    metadata:
-      name: cloudflare-api-token
-      namespace: cert-manager
-    type: Opaque

infra/cert-manager/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cloudflare-api-token-sealed-secret.yaml
-  - cluster-issuer.yaml

infra/postgres/authentik-database.yaml

@@ -1,11 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: authentik
-  namespace: postgres
-spec:
-  cluster:
-    name: postgres
-  databaseReclaimPolicy: retain
-  name: authentik
-  owner: authentik

infra/postgres/authentik-db-sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: authentik-db
-  namespace: postgres
-spec:
-  encryptedData:
-    password: AgALpscM7BiDoZuUSlAI39CZYz3DvSaHQwzOpZEKp4tqfEYQ1r2DALOAbi4l3+6LzsMo63RNv3SYlhxFcbjjrDMiiaaB47iKDEmbSW/LQTJibiaoy67rgTs8T3I4awQbHeylwJQr5nS0BN6MeYh87PCmqFc3Orc5kCokSL9j7gVwOqNkq27RMJkghulUxAEONQrixFOiCHTFWCD/IybR1olUUacz7nKxCTLmcqDfzimGlF92VBbFaUzZH5W+0yd59zNqjhnmslIRiqli/ZVB2Z5ECuqr4YmrSmaCQvR5mzRmNjpmAeqCF/byFjfanPM6ZZ4NM2x7flqu8sULzZfBdXWmhIy03jPFFDBIvznHHW6y0K2r8kqewkoUsKgJEgZcsEvwe/F/gode3ukI02LuD2dKMNjeDaf8A4xaRx6h9U9cDiggmpHPW2HjO3kLp6ViEGPlGm3JuisnqncsBgfIh1T8ZMpmuM0WgAe6E3hFHnR6vbWYfSIi6nrEcpfLL+F2bBGYdUFBfjflaxXzhPnGDJ29GEBuyJcHPVRTqBhybS9rl+77dhCbPEsC5GN9MdCdS3uVWyKN+xIV1f/cJNsUFhDyU2rbkbFAebJurjPbKi92HPDaEq6OK3kunN9nNEZ9rE7d6ouw/gQ5Uq3CmaNDiVDorFfaW5DHVbRnm3MLdbLoUuN1AlU96/cDuSqDZjfLB69iB/+nt8TQLHopwQxj9AajfMyF+y9c2XvYZWvZGaCE1fTEfpIJ2fV1McnwbFi0uHk=
-    username: AgA9pxBlPvKPAX/NaHHFSN1ypRxKmd8CNcs92+l3JpDar81IYWaQPG0p99wYxrBp0414GIhojpkWks7+lVDSgmVzw9T+JQzow54lRxe7dHFOzfAQx1oQyGp8AkiGtjAIdUx9kgYhM01xQUDYtFDe3XnhVUkvjQNARctWyX+o/vyYTnK5BMHZB6viQOWrifNUmPQQRFnB9oEPGVqysYlJ2+o1sMyJYXOiTEMVkuk0rFp8AE2WGeyfR0pFwhSyn2g7bbFvUoQbECiG4y83AKmpmX4p25bAlzsIxb1kgUpYlqZXGMqLuQaVBJsBs3u7sDUjQZFRfz3rH2OLfNGZcCGT3c9Ueg05eRpAyWHP1kHWmkK2Yl4kPcyx54bBk2yv2h4lW7DmlsG6jE6bzKPtMTJOiJdkqkNSkerd062ktWYrpAg6iuGWB1A7Et+J07JaWd6xfANRknvH/D+CEQHuRM5qEtM8HVLuTlKSxX464d0nNKUw0rrSokWJWT5olroc+VjaHyXdF6LEYmgNXxtUwa95q6k8J78ZLidx7SawbFC5d5ErFbkq+6xOPWeKzcDExtcMd9UF1Ti90Ybp5ncyxoQLXCWhSV9SxjeS+f6H8Cs7JM39kxeOfLvvxw9qz2rSW6qbimh5KaXmO8KK3BFtrui+k5tlnv6qJaRbtMUV+p7WyK36wBk1fUMR0lfK8FRuWfnUuslP2wk17vlkvto=
-  template:
-    metadata:
-      labels:
-        cnpg.io/reload: "true"
-      name: authentik-db
-      namespace: postgres
-    type: kubernetes.io/basic-auth

infra/postgres/cluster.yaml

@@ -1,29 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: postgres
-  namespace: postgres
-spec:
-  enablePDB: false
-  imageName: ghcr.io/cloudnative-pg/postgresql:18
-  instances: 1
-  managed:
-    roles:
-      - ensure: present
-        login: true
-        name: authentik
-        passwordSecret:
-          name: authentik-db
-  postgresql:
-    # Each app role may only connect to the database of the same name.
-    pg_hba:
-      - host sameuser all all scram-sha-256
-      - host all all all reject
-  resources:
-    limits:
-      memory: 1Gi
-    requests:
-      cpu: 100m
-      memory: 256Mi
-  storage:
-    size: 5Gi

infra/postgres/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cluster.yaml
-  - authentik-db-sealedsecret.yaml
-  - authentik-database.yaml

infra/traefik/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - wildcard-whyredfire-dev.yaml
-  - wildcard-whyredfire-dpdns-org.yaml

infra/traefik/wildcard-whyredfire-dpdns-org.yaml

@@ -1,14 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-whyredfire-dpdns-org
-  namespace: traefik
-spec:
-  dnsNames:
-    - '*.whyredfire.dpdns.org'
-  issuerRef:
-    kind: ClusterIssuer
-    name: letsencrypt-prod
-  privateKey:
-    rotationPolicy: Always
-  secretName: wildcard-whyredfire-dpdns-org