add crowdsec deployment

Reviewed-on: #210

.gitignore

@@ -1,2 +1,6 @@
+# Kubernetes secrets
 *.secret.yaml
-charts/
+main.key
+
+# Helm Chart files
+charts/

README.md

@@ -1,22 +1,47 @@
 # Kluster setup and IaaC using argoCD
 
 
-
-### Key to authorize against `git.kluster.moll.re` (ssh)
-```
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE+4SlRIV9wOKYZbBrPuW18K6GGjnDEviCYQvGQuKOm0 remy@ArchSpectre
-```
-
 ### Initial setup
-On a running (and sealed-secrets installed) k3s instance run:
+#### Requirements:
+- A running k3s instance
+- `sealedsecrets` deployed
+
+#### Installing argo and the app-of-apps
 ```
 kubectl apply -k infrastructure/argocd
 ```
-This will install argocd and CRDs in a dedicated namespace along with the app-of-apps configured under `kluster-deployments/`.
+This will install argocd and its CRDs in a dedicated namespace. The app-of-apps is configured under `kluster-deployments/` and deployed as well. This will bootstrap all other apps, as described in `./kluster-deployments`.
 
 The app-of-apps will bootstrap a fully featured cluster with the following components
 - postgres instance with backups
 - backup of all nfs PVCs using restic
 - traefik (along with metallb as a publicly accessible reverse proxy)
 - an nfs-provisioner creating PVCs on-demand
-- a range of selfhosted apps
+- gitea
+- a range of selfhosted apps:
+    - nextcloud
+    - jellyfin
+    - adguard-home
+    - homarr
+    - homeassistant
+    - immich
+    - ...
+
+#### Recap
+- install sealedsecrets see [README](./infrastructure/sealedsecrets/README.md)
+    ```bash
+    kubectl apply -k infrastructure/sealedsecrets
+    kubectl apply -f infrastructure/sealedsecrets/main.key
+    kubectl delete pod -n kube-system -l name=sealed-secrets-controller
+    ```
+- install argocd
+    ```bash
+    kubectl apply -k infrastructure/argocd
+    ```
+- wait...
+
+
+### Adding an application
+todo
+
+

apps/adguard/configmap.yaml

@@ -2,59 +2,51 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: adguard-home-config
-  namespace: adguard
 data:
   AdGuardHome.yaml: |-
-    bind_host: 0.0.0.0
-    bind_port: 3000
-    beta_bind_port: 0
+    http:
+      pprof:
+        port: 6060
+        enabled: false
+      address: 0.0.0.0:3000
+      session_ttl: 720h
     users: []
     auth_attempts: 5
     block_auth_min: 15
     http_proxy: ""
     language: ""
-    debug_pprof: false
-    web_session_ttl: 720
+    theme: auto
     dns:
       bind_hosts:
-      - 0.0.0.0
+        - 0.0.0.0
       port: 53
-      statistics_interval: 1
-      querylog_enabled: true
-      querylog_file_enabled: true
-      querylog_interval: 2160h
-      querylog_size_memory: 1000
       anonymize_client_ip: false
-      protection_enabled: true
-      blocking_mode: default
-      blocking_ipv4: ""
-      blocking_ipv6: ""
-      blocked_response_ttl: 10
-      parental_block_host: family-block.dns.adguard.com
-      safebrowsing_block_host: standard-block.dns.adguard.com
       ratelimit: 20
+      ratelimit_subnet_len_ipv4: 24
+      ratelimit_subnet_len_ipv6: 56
       ratelimit_whitelist: []
       refuse_any: true
       upstream_dns:
-      - https://dns10.quad9.net/dns-query
+        - https://dns10.quad9.net/dns-query
       upstream_dns_file: ""
       bootstrap_dns:
-      - 9.9.9.10
-      - 149.112.112.10
-      - 2620:fe::10
-      - 2620:fe::fe:10
+        - 9.9.9.10
+        - 149.112.112.10
+        - 2620:fe::10
+        - 2620:fe::fe:10
+      fallback_dns: []
       all_servers: false
       fastest_addr: false
       fastest_timeout: 1s
       allowed_clients: []
       disallowed_clients: []
       blocked_hosts:
-      - version.bind
-      - id.server
-      - hostname.bind
+        - version.bind
+        - id.server
+        - hostname.bind
       trusted_proxies:
-      - 127.0.0.0/8
-      - ::1/128
+        - 127.0.0.0/8
+        - ::1/128
       cache_size: 4194304
       cache_ttl_min: 0
       cache_ttl_max: 0
@@ -62,25 +54,24 @@ data:
       bogus_nxdomain: []
       aaaa_disabled: false
       enable_dnssec: false
-      edns_client_subnet: false
+      edns_client_subnet:
+        custom_ip: ""
+        enabled: false
+        use_custom: false
       max_goroutines: 300
+      handle_ddr: true
       ipset: []
-      filtering_enabled: true
-      filters_update_interval: 24
-      parental_enabled: false
-      safesearch_enabled: false
-      safebrowsing_enabled: false
-      safebrowsing_cache_size: 1048576
-      safesearch_cache_size: 1048576
-      parental_cache_size: 1048576
-      cache_time: 30
-      rewrites: []
-      blocked_services: []
+      ipset_file: ""
+      bootstrap_prefer_ipv6: false
       upstream_timeout: 10s
       private_networks: []
       use_private_ptr_resolvers: true
       local_ptr_upstreams:
-      - 192.168.1.1
+        - 192.168.1.1
+      use_dns64: false
+      dns64_prefixes: []
+      serve_http3: false
+      use_http3_upstreams: false
     tls:
       enabled: false
       server_name: ""
@@ -91,24 +82,34 @@ data:
       port_dnscrypt: 0
       dnscrypt_config_file: ""
       allow_unencrypted_doh: false
-      strict_sni_check: false
       certificate_chain: ""
       private_key: ""
       certificate_path: ""
       private_key_path: ""
+      strict_sni_check: false
+    querylog:
+      ignored: []
+      interval: 2160h
+      size_memory: 1000
+      enabled: true
+      file_enabled: true
+    statistics:
+      ignored: []
+      interval: 24h
+      enabled: true
     filters:
-    - enabled: true
-      url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
-      name: AdGuard DNS filter
-      id: 1
-    - enabled: true
-      url: https://adaway.org/hosts.txt
-      name: AdAway Default Blocklist
-      id: 2
-    - enabled: true
-      url: https://someonewhocares.org/hosts/zero/hosts
-      name: Dan Pollock's List
-      id: 1684963532
+      - enabled: true
+        url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
+        name: AdGuard DNS filter
+        id: 1
+      - enabled: true
+        url: https://adaway.org/hosts.txt
+        name: AdAway Default Blocklist
+        id: 2
+      - enabled: true
+        url: https://someonewhocares.org/hosts/zero/hosts
+        name: Dan Pollock's List
+        id: 1684963532
     whitelist_filters: []
     user_rules: []
     dhcp:
@@ -128,6 +129,36 @@ data:
         lease_duration: 86400
         ra_slaac_only: false
         ra_allow_slaac: false
+    filtering:
+      blocking_ipv4: ""
+      blocking_ipv6: ""
+      blocked_services:
+        schedule:
+          time_zone: UTC
+        ids: []
+      protection_disabled_until: null
+      safe_search:
+        enabled: false
+        bing: true
+        duckduckgo: true
+        google: true
+        pixabay: true
+        yandex: true
+        youtube: true
+      blocking_mode: default
+      parental_block_host: family-block.dns.adguard.com
+      safebrowsing_block_host: standard-block.dns.adguard.com
+      rewrites: []
+      safebrowsing_cache_size: 1048576
+      safesearch_cache_size: 1048576
+      parental_cache_size: 1048576
+      cache_time: 30
+      filters_update_interval: 24
+      blocked_response_ttl: 10
+      filtering_enabled: true
+      parental_enabled: true
+      safebrowsing_enabled: false
+      protection_enabled: true
     clients:
       runtime_sources:
         whois: true
@@ -136,15 +167,16 @@ data:
         dhcp: true
         hosts: true
       persistent: []
-    log_compress: false
-    log_localtime: false
-    log_max_backups: 0
-    log_max_size: 100
-    log_max_age: 3
-    log_file: ""
-    verbose: false
+    log:
+      file: ""
+      max_backups: 0
+      max_size: 100
+      max_age: 3
+      compress: false
+      local_time: false
+      verbose: false
     os:
       group: ""
       user: ""
       rlimit_nofile: 0
-    schema_version: 14
+    schema_version: 27

apps/adguard/deployment.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: adguard-home
-  namespace: adguard
 spec:
   replicas: 1
   revisionHistoryLimit: 3
@@ -19,16 +18,23 @@ spec:
         app.kubernetes.io/name: adguard-home
     spec:
       containers:
-      - args:
-        - --config
-        - /opt/adguardhome/conf/AdGuardHome.yaml
-        - --work-dir
-        - /opt/adguardhome/work
-        - --no-check-update
+      - command:
+        - "sh"
+        - "-c"
+        - >
+          cp /config/AdGuardHome.yaml /opt/adguardhome/conf/AdGuardHome.yaml &&
+          sleep 5 &&
+          /opt/adguardhome/AdGuardHome --no-check-update --config /opt/adguardhome/conf/AdGuardHome.yaml
+      # - args:
+      #   - --config
+      #   - /opt/adguardhome/conf/AdGuardHome.yaml
+      #   - --work-dir
+      #   - /opt/adguardhome/work
+      #   - --no-check-update
         env:
         - name: TZ
           value: Europe/Berlin
-        image: adguard/adguardhome:v0.107.41
+        image: adguard/adguardhome
         imagePullPolicy: IfNotPresent
         livenessProbe:
           failureThreshold: 3
@@ -66,8 +72,9 @@ spec:
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
         volumeMounts:
-        - mountPath: /opt/adguardhome/conf/
+        - mountPath: /config/AdGuardHome.yaml
           name: adguard-home-config
+          subPath: AdGuardHome.yaml
       dnsPolicy: ClusterFirst
 
       restartPolicy: Always

apps/adguard/ingress.yaml

@@ -1,15 +1,14 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
   name: adguard-tls-ingress
-  namespace: adguard
 spec:
   entryPoints:
     - dnsovertls
   routes:
     - match: HostSNI(`adguard.kluster.moll.re`)
       services:
-        - name: adguard-adguard-home-dns-tcp
+        - name: adguard-home-dns-tcp
           port: 53
   tls:
     certResolver: default-tls

apps/adguard/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - namespace.yaml
+  - configmap.yaml
+  - ingress.yaml
+  - service.yaml
+  - deployment.yaml
+
+images:
+  - name: adguard/adguardhome
+    newName: adguard/adguardhome
+    newTag: v0.107.53
+
+namespace: adguard
+

apps/adguard/namespace.yaml

@@ -1,5 +1,4 @@
-# namespace.yaml
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: nfs-provisioner
+  name: placeholder

apps/adguard/service.yaml

@@ -1,8 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: adguard-home
-  namespace: adguard
+  name: adguard-home-web
 spec:
   ports:
   - name: http
@@ -22,10 +21,11 @@ metadata:
     metallb.universe.tf/allow-shared-ip: adguard-svc
 
   name: adguard-home-dns-tcp
-  namespace: adguard
 spec:
   allocateLoadBalancerNodePorts: true
   loadBalancerIP: 192.168.3.2
+  externalTrafficPolicy: Local
+
   ports:
   - name: dns-tcp
     nodePort: 31306
@@ -45,10 +45,10 @@ metadata:
     metallb.universe.tf/allow-shared-ip: adguard-svc
 
   name: adguard-home-dns-udp
-  namespace: adguard
 spec:
   allocateLoadBalancerNodePorts: true
   loadBalancerIP: 192.168.3.2
+  externalTrafficPolicy: Local
   ports:
   - name: dns-udp
     nodePort: 30547
@@ -58,4 +58,4 @@ spec:
   selector:
     app.kubernetes.io/instance: adguard
     app.kubernetes.io/name: adguard-home
-  type: LoadBalancer
+  type: LoadBalancer

apps/adguard/values.yaml

@@ -1,365 +0,0 @@
-#
-# IMPORTANT NOTE
-#
-# This chart inherits from our common library chart. You can check the default values/options here:
-# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml
-#
-
-controller:
-  # -- Number of pods to load balance between
-  replicas: 1
-
-initContainers:
-# -- Configures an initContainer that copies the configmap to the AdGuardHome conf directory
-# It does NOT overwrite when the file already exists.
-# @default -- See values.yaml
-  copy-configmap:
-    image: busybox
-    imagePullPolicy: IfNotPresent
-    command:
-    - "sh"
-    - "-c"
-    - |
-      if [ ! -f /opt/adguardhome/conf/AdGuardHome.yaml ]; then
-        mkdir -p /opt/adguardhome/conf
-        cp /tmp/AdGuardHome.yaml /opt/adguardhome/conf/AdGuardHome.yaml
-      fi
-    volumeMounts:
-    - name: adguard-home-config
-      mountPath: /tmp/AdGuardHome.yaml
-      subPath: AdGuardHome.yaml
-    - name: config
-      mountPath: /opt/adguardhome/conf
-    securityContext:
-      runAsUser: 0
-
-image:
-  # -- image repository
-  repository: adguard/adguardhome
-  # @default -- chart.appVersion
-  tag:
-  # -- image pull policy
-  pullPolicy: IfNotPresent
-
-# -- environment variables.
-# @default -- See below
-env:
-  # -- Set the container timezone
-  TZ: Europe/Berlin
-
-# -- arguments passed to the adguard-home command line.
-args:
-- "--config"
-- "/opt/adguardhome/conf/AdGuardHome.yaml"
-- "--work-dir"
-- "/opt/adguardhome/work"
-- "--no-check-update"
-
-# -- Configures service settings for the chart.
-# @default -- See values.yaml
-service:
-  main:
-    primary: true
-    ports:
-      http:
-        port: 3000
-  dns-tcp:
-    enabled: true
-    type: LoadBalancer
-    loadBalancerIP: 192.168.3.2
-    annotations: 
-      metallb.universe.tf/allow-shared-ip: adguard-svc
-
-    ports:
-      dns-tcp:
-        enabled: true
-        port: 53
-        protocol: TCP
-        targetPort: 53
-
-  dns-udp:
-    enabled: true
-    type: LoadBalancer
-    loadBalancerIP: 192.168.3.2
-    annotations: 
-      metallb.universe.tf/allow-shared-ip: adguard-svc
-
-    ports:
-      dns-udp:
-        enabled: true
-        port: 53
-        protocol: UDP
-        targetPort: 53
-  
-  dns-tls-udp:
-    enabled: true
-    type: LoadBalancer
-    loadBalancerIP: 192.168.3.5
-    annotations: 
-      metallb.universe.tf/allow-shared-ip: adguard-svc
-
-    ports:
-      dns-tls-udp:
-        enabled: true
-        port: 853
-        protocol: UDP
-        targetPort: 853
-
-  dns-tls-tcp:
-    enabled: true
-    type: LoadBalancer
-    loadBalancerIP: 192.168.3.5
-    annotations: 
-      metallb.universe.tf/allow-shared-ip: adguard-svc
-
-    ports:
-      dns-tls-tcp:
-        enabled: true
-        port: 853
-        protocol: TCP
-        targetPort: 853
-
-    
-
-
-# -- Configure persistence settings for the chart under this key.
-# @default -- See values.yaml
-persistence:
-  config:
-    enabled: true
-    mountPath: /opt/adguardhome/conf
-  data:
-    enabled: false
-    mountPath: /opt/adguardhome/work
-
-# config -- AdGuard Home cojnfiguration. For a full list of options see https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration.
-# @default -- See values.yaml
-config: |
-  bind_host: 0.0.0.0
-  bind_port: 3000
-  beta_bind_port: 0
-  users: []
-  auth_attempts: 5
-  block_auth_min: 15
-  http_proxy: ""
-  language: ""
-  debug_pprof: false
-  web_session_ttl: 720
-  dns:
-    bind_hosts:
-    - 0.0.0.0
-    port: 53
-    statistics_interval: 1
-    querylog_enabled: true
-    querylog_file_enabled: true
-    querylog_interval: 2160h
-    querylog_size_memory: 1000
-    anonymize_client_ip: false
-    protection_enabled: true
-    blocking_mode: default
-    blocking_ipv4: ""
-    blocking_ipv6: ""
-    blocked_response_ttl: 10
-    parental_block_host: family-block.dns.adguard.com
-    safebrowsing_block_host: standard-block.dns.adguard.com
-    ratelimit: 20
-    ratelimit_whitelist: []
-    refuse_any: true
-    upstream_dns:
-    - https://dns10.quad9.net/dns-query
-    upstream_dns_file: ""
-    bootstrap_dns:
-    - 9.9.9.10
-    - 149.112.112.10
-    - 2620:fe::10
-    - 2620:fe::fe:10
-    all_servers: false
-    fastest_addr: false
-    fastest_timeout: 1s
-    allowed_clients: []
-    disallowed_clients: []
-    blocked_hosts:
-    - version.bind
-    - id.server
-    - hostname.bind
-    trusted_proxies:
-    - 127.0.0.0/8
-    - ::1/128
-    cache_size: 4194304
-    cache_ttl_min: 0
-    cache_ttl_max: 0
-    cache_optimistic: false
-    bogus_nxdomain: []
-    aaaa_disabled: false
-    enable_dnssec: false
-    edns_client_subnet: false
-    max_goroutines: 300
-    ipset: []
-    filtering_enabled: true
-    filters_update_interval: 24
-    parental_enabled: false
-    safesearch_enabled: false
-    safebrowsing_enabled: false
-    safebrowsing_cache_size: 1048576
-    safesearch_cache_size: 1048576
-    parental_cache_size: 1048576
-    cache_time: 30
-    rewrites: []
-    blocked_services: []
-    upstream_timeout: 10s
-    private_networks: []
-    use_private_ptr_resolvers: true
-    local_ptr_upstreams:
-    - 192.168.1.1
-  tls:
-    enabled: true
-    server_name: "dns.moll.re"
-    force_https: false
-    port_https: 443
-    port_dns_over_tls: 853
-    port_dns_over_quic: 853
-    port_dnscrypt: 0
-    dnscrypt_config_file: ""
-    allow_unencrypted_doh: false
-    strict_sni_check: false
-    certificate_chain: |-
-      -----BEGIN CERTIFICATE-----
-      MIIFyzCCA7OgAwIBAgIUEvyI5bCa56vvyQgTbLyR7+c7vQMwDQYJKoZIhvcNAQEL
-      BQAwdTELMAkGA1UEBhMCREUxCzAJBgNVBAgMAkJXMREwDwYDVQQHDAhGcmVpYnVy
-      ZzENMAsGA1UECgwEUmVteTEKMAgGA1UECwwBTTEQMA4GA1UEAwwHbW9sbC5yZTEZ
-      MBcGCSqGSIb3DQEJARYKbWVAbW9sbC5yZTAeFw0yMzA3MTUxNzQ0MTVaFw0yNDA3
-      MTQxNzQ0MTVaMHUxCzAJBgNVBAYTAkRFMQswCQYDVQQIDAJCVzERMA8GA1UEBwwI
-      RnJlaWJ1cmcxDTALBgNVBAoMBFJlbXkxCjAIBgNVBAsMAU0xEDAOBgNVBAMMB21v
-      bGwucmUxGTAXBgkqhkiG9w0BCQEWCm1lQG1vbGwucmUwggIiMA0GCSqGSIb3DQEB
-      AQUAA4ICDwAwggIKAoICAQDpS0Xtii0VITKFr9XFLcWchI6//I7iMeKkYi7uEq60
-      1YZQ8/Zppg1M15BhD8ZEQ0JZ42ufi0p4B0LYMGHYF+2kKsbFxcEPQTUeXCLcjYVA
-      ueZ+GTh+FrUrSQvHSevUbVXytAwiqAN/eAvXBMdOKisPUM9Cmk/KHA+W+anw4Uxq
-      ZvHq5GG9Z0IksTHI2oEMp/8cZ8lRXzHmOUYQGveBX6PBPvcttP8GwCU6vsPVSphZ
-      7XF2LPqeMnBGgmOz51QTRpS7NBHMsSDR20VgSTjI+F8nJnQsGO5Iq9IpQzlDlAsL
-      jgPOT3W/pdeZD1mX/c9EpYEKf/0ubEBiWc+kJqkrdmsUX6cZ06qEUa08yCMSzkao
-      mHrMzw22kjICG9h+0sZvTetPvpYZsBqQRejDS/cu+buAaDNchGNhl1YPp8iAlKUT
-      YB4gbcNqceCGUmbQX06B/OwJiYIoN5ghh2wmqNrFXYltfALBVhWFtU2DTAS9k399
-      W2hd4u77uJngK0WLoKQuV/wi81dbk0kAI7eRUI1H/Y4hC1MCI5M6zewrJ7QgOYBi
-      qkYydYQGFu1ToDt6maDVBX05PcoBPwbUfrmZBjR5kzBawvH6reDuANkEXfJ0+2hA
-      JBAxXPKyQVc9Y87nDATvkl7qWOKjfJairKAd03lvJlesr6+7GwMMnE/6h91QF4Vq
-      OQIDAQABo1MwUTAdBgNVHQ4EFgQUunr29QozKy+AlTrq+PAoSjPFOQIwHwYDVR0j
-      BBgwFoAUunr29QozKy+AlTrq+PAoSjPFOQIwDwYDVR0TAQH/BAUwAwEB/zANBgkq
-      hkiG9w0BAQsFAAOCAgEAPeczDC1OScGZ6UVjFUF+BqI1Am9TwUNVD2cRnbXvQ2g7
-      nU8vYSfWx00bhRTpuDEG997HkCCvaUYIArbGtgplB+bCk6GMnQQfnRWIyFz/cy+Y
-      yuftUY0PufXzCe33J2Q0SQCNKdEvOsfiPCkyrgMSlomoIDPhs4wQ8SOE0Lnl4fNw
-      i1uVDd6pTxwwfpfsvN5lBwXN+RDr1Awe07f9SJmYklqQAIP5Kthq7QJsN1QHvmtW
-      JL7AYlltDTUYvE2kBnQKjkNYv9Qj4PGUvipVlCKA4cEVAZXHam01RqPXEFj5I9B4
-      Q9S+oT7htoXWuz9kAwsSCZVEW1QBzRL7UNIckMWsc1jRSiCT5Nc/sOtPyIc9in+i
-      J/XGPjSBvQZrnitLhR4qByG/dY+istQkcEERjElwhzucEyNkgtENJfJEevdJsrBf
-      oGaaK5ljemYsk1e+QHB3FWmNbIysKBMn44bHgu7DeQediLCjvwdasjVorDW1mv5Z
-      8Aoe075vxTmHGSjfMPiAzJnYMy0zCT1VcR+AtPKUtr11z2xgOrAqZqlTaR/ud6ce
-      B11n3oIs5Kwarvhwx2Qw7XvcGOa2PBGZW4kcoDRn9GNFcP5K2AAuRJD9FLTbr8ZO
-      6a0bv0KUksQYX+U/r3+qSn87TXyIJ1IbKY2jQYu/+KEpeyFnviXw+IoM/YHDqdw=
-      -----END CERTIFICATE-----
-    private_key: |-
-      -----BEGIN PRIVATE KEY-----
-      MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDpS0Xtii0VITKF
-      r9XFLcWchI6//I7iMeKkYi7uEq601YZQ8/Zppg1M15BhD8ZEQ0JZ42ufi0p4B0LY
-      MGHYF+2kKsbFxcEPQTUeXCLcjYVAueZ+GTh+FrUrSQvHSevUbVXytAwiqAN/eAvX
-      BMdOKisPUM9Cmk/KHA+W+anw4UxqZvHq5GG9Z0IksTHI2oEMp/8cZ8lRXzHmOUYQ
-      GveBX6PBPvcttP8GwCU6vsPVSphZ7XF2LPqeMnBGgmOz51QTRpS7NBHMsSDR20Vg
-      STjI+F8nJnQsGO5Iq9IpQzlDlAsLjgPOT3W/pdeZD1mX/c9EpYEKf/0ubEBiWc+k
-      JqkrdmsUX6cZ06qEUa08yCMSzkaomHrMzw22kjICG9h+0sZvTetPvpYZsBqQRejD
-      S/cu+buAaDNchGNhl1YPp8iAlKUTYB4gbcNqceCGUmbQX06B/OwJiYIoN5ghh2wm
-      qNrFXYltfALBVhWFtU2DTAS9k399W2hd4u77uJngK0WLoKQuV/wi81dbk0kAI7eR
-      UI1H/Y4hC1MCI5M6zewrJ7QgOYBiqkYydYQGFu1ToDt6maDVBX05PcoBPwbUfrmZ
-      BjR5kzBawvH6reDuANkEXfJ0+2hAJBAxXPKyQVc9Y87nDATvkl7qWOKjfJairKAd
-      03lvJlesr6+7GwMMnE/6h91QF4VqOQIDAQABAoICAFXdtDe5X12DEf7dmJ9R+QVi
-      Ts5ADXEYrlQVpTNQIgiB/MVn/d6l1Qhe4Q+wiCeQ3+eIypB26qph9crvh9vK9tcx
-      PWcGocfVFtF9VQF7fzuzELCB5OaXwgfUA2dPAGN3+KXzefH5iAwPKcByzE6rO50P
-      /7ECbfK0QFKvwspbik4xZMIxW/4j9tbddzb3oX8AiGeylYkDMjEMDIsZ+dYe1v1m
-      CQFEOIeKCknkc9zZ71hOCjBWXsoCQ4vYKw1IzAuqM0zx3clKuoszGwZU/PcPX6pf
-      v2uJo46Q2zH/waBraWNP2nvBiFPJHSEDYtUMAJFCH0w3jn7bLhlk+AVxi1tpYwBx
-      SOFQKmKbJgTWpmX7o8bhyNmSg6gLTquKKYuOeUsJTe4SERnhKNVen/mf1BdV5S1A
-      iLj9mg5tFL1O+f8wl8q0QA5aM3o1G/YMlG28Na6X8l89BiDvfdG4YALzeJs5k1yn
-      VnpZElikhx63HQjaLE+u4nSBwr0s79Hnq4Xge+rEPCRVpHhfZ1T/Ka3NwqcflcM7
-      GvvRnXfLLyfS3DOQg9BCwE94hzJgh7V4BqEQInzkAR3/wF83xTT0LaWLBsJXTsWr
-      rHcdPxpMVXNUfelBmA3Blu1d07lDw8kMzYXzCJ4AE9gjdgN9ltwjg7ZDQ3w6Tnc1
-      09aLmIUeRx6r7vs8pBMPAoIBAQD3epVeC4Urpmop21Jzop7nqvQqmHwDvUPIHKWZ
-      a1e9YmHfNR6Vibzw8jqjd7IJMd5mzlcot+bTjfFGxfZ/KidE5MB8rvwS0MVQnamZ
-      dnl1OX9c/+G4jW8xCzNQlkAXT2xcaMPO/ged6smdtZkvvnjfyX0L78fbKG+4fsc8
-      PoIB5gXjApVVN4ujeaKUud2jr2uHueQqI8taZlhlIojxc1w/a9r0iiLK+sY/HvWH
-      gERxDFWQjg8kkFGXC3KFOz0UJiolDus9sK9cLcDI4IavOotVaxEoz778u9644+GM
-      wfRJCN8OBT3RQjPy77L1VOCjrbd1TtknDDG+kAN4ZLLEPCO/AoIBAQDxU6gqjGDy
-      SC1mSgl8x6ODkmCs2a9UvZeg9/KA/UzTGCLeSgftPwgCeGV6d6dpqFxsvqhVDVtp
-      pkqFa2+X0rsIG4JFl6qZTbXpJIqbdkTeWjjimg809fTqZnSJSchUiuIWzqvGlOSL
-      cM5c7+WNteLVHjldiNT0+jReXPtxAJD9jIV3LubmWZ5qs3tYXKGgQvCItLo6REYE
-      SKUZAsX/T6O6HAypv89AcS+UZxc2pq4htFRJY5XarLbs8BuDJAYWm3chMwwGIDEx
-      J7cCXWWWQkU7W1GOckU4oo6FPGzjREPwyeiYcvias2/nm4tOc5t0gRJHIR8W6tQF
-      5An7lLSHe5AHAoIBAADiNSpSzDTtsS9ZEyBKklqtZ5XHWZoB0P4j7AtyMKwCb+sG
-      G4fZKA2ML91pjf8uaGbhkboZff9/YD8qccjec6lxT6aiUVAX4rx486QSojhi7it8
-      1md8SctZCOPexXfP1sk1ro1MpuZPckzX2yYqfe/+ni2uu33y1QNJoJh8eKZdFeRL
-      nBDj0+HPi18QktQEylN/vGrSGeXGu8YQq4CBMvEfB3ccDye+YXrUN3g2YwgsTRnp
-      B/DPexsY9V24am1p/XiIZxqfSOEBYNDWzGRPxzOU4EjPBRWN7ium1KVWA/NGztUT
-      +7aFj/3sES2DEhJDioYms+vJxVuy0/BYG7NLq60CggEAZCxZre+/flK/paot7gHg
-      ugjU4GssAH0Cp+rEWw7KCQYH00XfrHdxl7TqSr/IWm9sjidGMKfuvhgs7tz94YOz
-      51Wj6cdfJWvAixqD/qxFQhcpbcaNcWp3U6Vb0nEyGwXbe6QmYbQEem1E/AcIvp41
-      nkmBfnYCD/6cJl9qcCnQBa+C50osxomE3L3MAY3R+XhP6C887lrQxY5yGcOw9J3W
-      VLa3+u6H1TQmj++LD0B5H7x/EEeqOK9g71Fr2i/l5xR5iuppn1FVmhXmPbEPLiQs
-      IMtzOzHr0eqIRn4ipOP9X8IwLrfqwiyh0v4aAWKzsNSzBZuWEClCAX/7NNcxaNu9
-      mQKCAQEA3dk8ScY8bVPgFg2x7oqujVZbrNizhw2+BXYuH6HRVINPDYzIapur9uiw
-      I+STHoUod8aRNvwDLfhkI+MabmEbt/eDsBpRrJYYLi2uTed5gIiLqPS8MPuKr++7
-      UwJz4OPZu1xOjbFapvKvPSbPhS254tozQyi5Xbl8W268SCQhF+hEb+AT5JTcoPlI
-      ZNN5hp0Ooq6EouX8heyeG7le9V2G+HFHR9aWniD9kRRirO+oqWTXcG+9zHRhkdbF
-      4vRGwZ8+mj/0fKAHlFpeDRiKNbma7rTNDyEDR9jQ+GOC1QmOYeiei6FDKYEPcHxh
-      UBWqdlD+gUjtzQvD3yMo7JN9DIO5Eg==
-      -----END PRIVATE KEY-----
-    certificate_path: ""
-    private_key_path: ""
-  filters:
-  - enabled: true
-    url: https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt
-    name: AdGuard DNS filter
-    id: 1
-  - enabled: true
-    url: https://adaway.org/hosts.txt
-    name: AdAway Default Blocklist
-    id: 2
-  - enabled: true
-    url: https://someonewhocares.org/hosts/zero/hosts
-    name: Dan Pollock's List
-    id: 1684963532
-  whitelist_filters: []
-  user_rules: []
-  dhcp:
-    enabled: false
-    interface_name: ""
-    local_domain_name: lan
-    dhcpv4:
-      gateway_ip: ""
-      subnet_mask: ""
-      range_start: ""
-      range_end: ""
-      lease_duration: 86400
-      icmp_timeout_msec: 1000
-      options: []
-    dhcpv6:
-      range_start: ""
-      lease_duration: 86400
-      ra_slaac_only: false
-      ra_allow_slaac: false
-  clients:
-    runtime_sources:
-      whois: true
-      arp: true
-      rdns: true
-      dhcp: true
-      hosts: true
-    persistent: []
-  log_compress: false
-  log_localtime: false
-  log_max_backups: 0
-  log_max_size: 100
-  log_max_age: 3
-  log_file: ""
-  verbose: false
-  os:
-    group: ""
-    user: ""
-    rlimit_nofile: 0
-  schema_version: 14

apps/audiobookshelf/deployment.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: audiobookshelf
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: audiobookshelf
+  template:
+    metadata:
+      labels:
+        app: audiobookshelf
+    spec:
+      containers:
+        - name: audiobookshelf
+          image: audiobookshelf
+          ports:
+            - containerPort: 80
+            
+          env:
+          - name: TZ
+            value: Europe/Berlin
+          - name: CONFIG_PATH
+            value: /data/config
+          - name: METADATA_PATH
+            value: /data/metadata
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "200Mi"
+            limits:
+              cpu: "2"
+              memory: "1Gi"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: audiobookshelf-data
+

apps/audiobookshelf/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: audiobookshelf-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`audiobookshelf.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: audiobookshelf-web
+      port: 80
+
+  tls:
+    certResolver: default-tls 

apps/audiobookshelf/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+
+namespace: audiobookshelf
+
+images:
+  - name: audiobookshelf
+    newName: ghcr.io/advplyr/audiobookshelf
+    newTag: "2.15.0"

apps/audiobookshelf/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/audiobookshelf/pvc.yaml

@@ -1,11 +1,9 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
-
 metadata:
-  name: postgres-backup-claim
-
+  name: audiobookshelf-data
 spec:
-  storageClassName: nfs-client
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:

apps/audiobookshelf/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: audiobookshelf-web
+spec:
+  selector:
+    app: audiobookshelf
+  ports:
+  - port: 80
+    targetPort: 80

apps/files/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: ocis-statefulset
+spec:
+  selector:
+    matchLabels:
+      app: ocis
+  serviceName: ocis-web
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: ocis
+    spec:
+      containers:
+      - name: ocis
+        image: ocis
+        resources:
+          limits:
+            memory: "1Gi"
+            cpu: "1000m"
+        env:
+        - name: OCIS_INSECURE
+          value: "true"
+        - name: OCIS_URL
+          value: "https://ocis.kluster.moll.re"
+        - name: OCIS_LOG_LEVEL
+          value: "debug"
+        ports:
+        - containerPort: 9200
+        volumeMounts:
+        - name: config
+          mountPath: /etc/ocis
+        # - name: ocis-config-file
+        #   mountPath: /etc/ocis/config.yaml
+        - name: data
+          mountPath: /var/lib/ocis
+      volumes:
+      # - name: ocis-config
+      #   persistentVolumeClaim:
+      #     claimName: ocis-config
+      - name: config
+        secret:
+          secretName: ocis-config
+      - name: data
+        persistentVolumeClaim:
+          claimName: ocis

apps/files/ingress.yaml

@@ -0,0 +1,18 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ocis-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`ocis.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: ocis-web
+      port: 9200
+      scheme: https
+
+  tls:
+    certResolver: default-tls 

apps/files/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: 
+  - namespace.yaml
+  - ingress.yaml
+  - service.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - ocis-config.sealedsecret.yaml
+
+namespace: files
+
+images:
+  - name: ocis
+    newName: owncloud/ocis
+    newTag: "5.0.8"

apps/files/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/files/pvc.yaml

@@ -1,13 +1,11 @@
-```
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: test-claim
+  name: ocis
 spec:
-  storageClassName: nfs-client
+  storageClassName: "nfs-client"
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
   resources:
     requests:
-      storage: 1Mi
-```
+      storage: 150Gi

apps/files/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ocis-web
+spec:
+  selector:
+    app: ocis
+  ports:
+  - port: 9200
+    targetPort: 9200

apps/finance/actualbudget.deployment.yaml

@@ -1,12 +1,10 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  namespace: finance
   name: actualbudget
   labels:
     app: actualbudget
 spec:
-# deployment running a single container
   selector:
     matchLabels:
       app: actualbudget
@@ -18,83 +16,19 @@ spec:
     spec:
       containers:
         - name: actualbudget
-          image: actualbudget/actual-server:latest
+          image: actualbudget
           imagePullPolicy: Always
           env:
             - name: TZ
               value: Europe/Berlin
           volumeMounts:
-            - name: actualbudget-data-nfs
+            - name: data
               mountPath: /data
           ports:
             - containerPort: 5006
               name: http
               protocol: TCP
       volumes:
-        - name: actualbudget-data-nfs
+        - name: data
           persistentVolumeClaim:
-            claimName: actualbudget-data-nfs
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: finance
-  name: "actualbudget-data-nfs"
-spec:
-  # storageClassName: fast
-  capacity:
-    storage: "5Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/actualbudget
-    server: 192.168.1.157
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: finance
-  name: "actualbudget-data-nfs"
-spec:
-  storageClassName: "fast"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "5Gi"
-  # selector:
-  #   matchLabels:
-  #     directory: "journal-data"
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  namespace: finance
-  name: actualbudget
-spec:
-  selector:
-    app: actualbudget
-  ports:
-    - protocol: TCP
-      port: 5006
-      targetPort: 5006
-  type: ClusterIP
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  namespace: finance
-  name: actualbudget
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`actualbudget.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: actualbudget
-      port: 5006
-  tls:
-    certResolver: default-tls
+            claimName: data

apps/finance/actualbudget.ingress.yaml

@@ -0,0 +1,15 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: actualbudget
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`actualbudget.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: actualbudget
+      port: 5006
+  tls:
+    certResolver: default-tls

apps/finance/actualbudget.pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: "data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "5Gi"

apps/finance/actualbudget.service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: actualbudget
+spec:
+  selector:
+    app: actualbudget
+  ports:
+    - protocol: TCP
+      port: 5006
+      targetPort: 5006
+  type: ClusterIP

apps/finance/firefly-importer.deployment.yaml

@@ -1,66 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: firefly-importer
-  name: firefly-importer
-  namespace: finance
-spec:
-  selector:
-    matchLabels:
-      app: firefly-importer
-  template:
-    metadata:
-      labels:
-        app: firefly-importer
-    spec:
-      containers:
-      - image: fireflyiii/data-importer:latest
-        imagePullPolicy: Always
-        name: firefly-importer
-        resources: {}
-        ports:
-        - containerPort: 8080
-        env:
-          - name: FIREFLY_III_ACCESS_TOKEN
-            value: redacted
-          - name: FIREFLY_III_URL
-            value: firefly-http:8080
-          # - name: APP_URL
-          #   value: https://finance.kluster.moll.re
-          - name: TRUSTED_PROXIES
-            value: "**"
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: firefly-importer-http
-  namespace: finance
-  labels:
-    app: firefly-importer-http
-
-spec:
-  type: ClusterIP
-  ports:
-  - port: 8080
-    # name: http
-  selector:
-    app: firefly-importer
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: firefly-importer-ingress
-  namespace: finance
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`importer.finance.kluster.moll.re`)
-      kind: Rule
-      services:
-        - name: firefly-importer-http
-          port: 8080
-  tls:
-    certResolver: default-tls

apps/finance/firefly.deployment.yaml

@@ -1,79 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: firefly
-  name: firefly
-  namespace: finance
-spec:
-  selector:
-    matchLabels:
-      app: firefly
-  template:
-    metadata:
-      labels:
-        app: firefly
-    spec:
-      containers:
-      - image: fireflyiii/core:latest
-        imagePullPolicy: Always
-        name: firefly
-        resources: {}
-        ports:
-        - containerPort: 8080
-        env:
-          - name: APP_ENV
-            value: "local"
-          - name: APP_KEY
-            value: iKejRAlgwx2Y/fxdosXjABbNxNzEuJdl
-          - name: DB_CONNECTION
-            value: sqlite
-          - name: APP_URL
-            value: https://finance.kluster.moll.re
-          - name: TRUSTED_PROXIES
-            value: "**"
-        volumeMounts:
-        - mountPath: /var/www/html/storage/database
-          name: firefly-database
-
-
-      volumes:
-      - name: firefly-database
-        persistentVolumeClaim:
-          claimName: firefly-database-nfs
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: firefly-http
-  namespace: finance
-  labels:
-    app: firefly-http
-
-spec:
-  type: ClusterIP
-  ports:
-  - port: 8080
-    # name: http
-  selector:
-    app: firefly
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: firefly-ingress
-  namespace: finance
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`finance.kluster.moll.re`)
-      kind: Rule
-      services:
-        - name: firefly-http
-          port: 8080
-  tls:
-    certResolver: default-tls
-
-

apps/finance/firefly.pvc.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: finance
-  name: firefly-database-nfs
-  labels:
-    directory: firefly
-spec:
-  # storageClassName: fast
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadOnlyMany
-  capacity:
-    storage: "1G"
-
-  nfs:
-    path: /firefly # inside nfs part.
-    server: 10.43.239.43 # assigned to nfs-server service. Won't change as long as service is not redeployed
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: finance
-  name: firefly-database-nfs
-spec:
-  resources:
-    requests:
-      storage: "1G"
-  # storageClassName: fast
-  accessModes:
-    - ReadOnlyMany
-  volumeName: firefly-database-nfs
-

apps/finance/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: finance
+
+resources:
+  - namespace.yaml
+  - actualbudget.pvc.yaml
+  - actualbudget.deployment.yaml
+  - actualbudget.service.yaml
+  - actualbudget.ingress.yaml
+
+images:
+  - name: actualbudget
+    newName: actualbudget/actual-server
+    newTag: 24.10.1

apps/finance/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/gitea/drone-kube-runner.deployment.yaml

@@ -1,89 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: drone-runner
-  namespace: gitea
----
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  namespace: gitea
-  name: drone-runner
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - secrets
-  verbs:
-  - create
-  - delete
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - pods/log
-  verbs:
-  - get
-  - create
-  - delete
-  - list
-  - watch
-  - update
-
----
-
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: drone-runner
-  namespace: gitea
-subjects:
-- kind: ServiceAccount
-  name: drone-runner
-  namespace: gitea
-roleRef:
-  kind: Role
-  name: drone-runner
-  apiGroup: rbac.authorization.k8s.io
-
----
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: gitea
-  name: drone-runner
-  labels:
-    app.kubernetes.io/name: drone-runner
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: drone-runner
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: drone-runner
-    spec:
-      serviceAccountName: drone-runner
-      containers:
-      - name: runner
-        image: drone/drone-runner-kube:latest
-        ports:
-        - containerPort: 3000
-        env:
-        - name: DRONE_RPC_HOST
-          value: drone-server:80
-        - name: DRONE_RPC_PROTO
-          value: http
-        - name: DRONE_RPC_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: drone-server-secret
-              key: rpc_secret
-        - name: DRONE_NAMESPACE_DEFAULT
-          value: gitea
-        # - name: DRONE_NAMESPACE_RULES
-        #   value: "drone-runner:*"
-        - name: DRONE_SERVICE_ACCOUNT_DEFAULT
-          value: drone-runner

apps/gitea/drone-server.deployment.yaml

@@ -1,129 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: drone-server
-  namespace: gitea
-  labels:
-    app: drone-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: drone-server
-  template:
-    metadata:
-      labels:
-        app: drone-server
-    spec:
-      containers:
-      - name: drone
-        image: drone/drone:latest
-        env:
-          - name: DRONE_SERVER_PORT # because the deployment is called drone-server, override this var again!
-            value: ":80"
-          - name: DRONE_GITEA_SERVER
-            value: https://git.kluster.moll.re
-          - name: DRONE_GITEA_CLIENT_ID
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: client_id
-          - name: DRONE_GITEA_CLIENT_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: client_secret
-          - name: DRONE_RPC_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-server-secret
-                key: rpc_secret
-          - name: DRONE_SERVER_HOST
-            value: drone.kluster.moll.re
-          - name: DRONE_SERVER_PROTO
-            value: https
-        resources:
-          requests:
-            memory: "1Gi"
-            cpu: 1.5
-        volumeMounts:
-        - mountPath: /data
-          name: drone-data-nfs
-      volumes:
-      - name: drone-data-nfs
-        persistentVolumeClaim:
-          claimName: drone-data-nfs
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: drone-server
-  namespace: gitea
-  labels:
-    app: drone-server
-
-spec:
-  type: ClusterIP
-  ports:
-  - port: 80
-    name: http
-  selector:
-    app: drone-server
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: drone-server-ingress
-  namespace: gitea
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`drone.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: drone-server
-      port: 80
-  tls:
-    certResolver: default-tls
-
-
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: gitea
-  name: drone-data-nfs
-  labels:
-    directory: drone
-spec:
-  # storageClassName: fast
-  capacity:
-    storage: "1Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/drone
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: gitea
-  name: drone-data-nfs
-spec:
-  # storageClassName: fast
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
-  selector:
-    matchLabels:
-      directory: drone
-
-
-

apps/gitea/drone-servers.sealedsecret.yaml

@@ -1,23 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "drone-server-secret",
-    "namespace": "gitea",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "drone-server-secret",
-        "namespace": "gitea",
-        "creationTimestamp": null
-      }
-    },
-    "encryptedData": {
-      "client_id": "AgA53a7kGJ6zZcx2ooTvTNwxaW2FvfzHJnxg6co54+HXinTJKsc4+GJ1PtdIbsZ7Dgu/sLi/4X90fT+PT2sgEx9jIilmHPdJeRtwV1UID3Y46A7cJlfcAKwNOFzp2PWvBvizbNp7tbJwxeAYnVX8GfN6fi700QxBGqAI3u8qQvLpU6UGW2RM96gCXI7s1QhE1Le6TgoESy5HX95pB7csDRNSwVE02OWfDHKEjH8QD8UvBB9xct6uwDfu7KrsJiNJvWMP6arvpfhy/X+UtCTFmj5wmFYL7oc6vSiCkq+QyHgQTEHTmGpEjEGKcQxPQaus3KhbhcxQBYLMEMYRlLPH0AEAA4dzbSpoVXM3LuIe9FppgrTCknK1uRB8wyrHUeInWO8mG7UraV6m5PUS+UYODMvfjwY3PyiGhTSf6LgMlhMl8e+2rb+OsWphT8Pbeom33PucrYaRFr9RpQkJSwE6HU3JEh25YLfIJ7caqRND8C/p8kD679C8UMcNpBN8WS4Cswn5jzmwbeJNM5DGp9yQVZNx7Bv3dHzx9i3ShjJ6QQnR/zWJZ/dWLy6weGYmdZMMXRAO8CCdruvcX5YyeieXZfchSIlZ/GqqBHptdcLpwLiZsfmyTWeBvk5pMAsZaKJ1tfWpQ84s4epzMoieTfhTueGXmeRKX+DJBBcriU+5YoqNxpU1lPL+LoInorJSKN7c3ouFx78N3GDOCq7mlWI94lY0bIs5zhrfUN137ITCcED62AJ7vks=",
-      "client_secret": "AgDQXU7x6RLhE9Hc+goeR2+3rW316SLLLA8tfqx3tsykL+vxhRkY5UCEaak3Rgei0k14jB/Rmme+/O/D1/5tc/i885+sGn0yjU7Jo4L5nkIssUOHlmRSGkRJDb9ABPauFXAjap9KLix9bd8ewI7R0lS3tOK9ZhThYhcfDUqV9qkkbSHzwNptkH7gYWt9qzG/rqqqpFP+PCtjzKVve4LCBgaxetcnh1t+d5oh7VAFnSI9Bt1G/DRzi+K3YZ+YG5+XKevBp06GMiLUMiv/eUvmOfAB/KO79LnNVbOcRsAHfnqLbXgNjFzspr5xDiGMC/ma1245LavywqXDp0S9jjNEe48i51PPQMwHWV8XEovsM6LHcteluNogt+VkL4mOnmP+sba/V3NO51rt1WXl+ca+U4kBq4dLMsdpWUKemz9BlIRC4etEXjwKJ5DznT7u6GUTrXx2RCm1j0OYWM++P10SdyD6tGjKnZf88a33Wrwm8Y7c47JrPTlP4PqLq9gzvD310uVfs1vGYGULaToGy+D/th8qiWWlu7BIfwqlIj8lruVnOhQ4GeEZmUAsqYf8JfsBwuDc0Y+8qbwjFrr2z+5x+2XBL8KGZVopyme45SHijlBZs7YsJqTBsg5oW09grM8/oO731GtzSYmpat2VZlaILuTjALqo/cu//kxwmqh7UX+jnTJ/2N3bKKSAfHWbHDeHeS2XJ+eKaI4onNYW9J70EfAP3vOpU+zmQ8rOzJuJjRt0HarLwzc5CXb1Xhlgsaoj7zKXPQMnqIDngg==",
-      "rpc_secret": "AgAcJNCFtOhK28vnLredkTgsVpnMPwaXss5NT5ysc0IbVid2vWRk2CTjBZc5DzjxxLwI1Ok88MFXHP08ZGCYy4rIbwoi7Ei1OEevGWfaI4n5CvAxr4ZamQHSfIX9dVAm9BSSx2M/mDtCKqVEGJEzyHCedrxf6LXM/YTNgjD43BuCZZMu35mRsHItpYFZQSttlHiUvR8y2YKrhV2P7fiWRD3cCVao8ldzKfGuvRfal8ByGoxpsYLj2D9CdtPvRF/TQsWUJJWwzbI9DmbW1MMI4/b26Jfa5TBvHxS1MQxFJpSXuMIengO+b0bi7WaR36y/FrKSNxIrQDHI7XCb00yYaSfj3RkSBVoAD0a2p8vNupHCqsKBoaWd8tMv/wGP8wbBk4DgGeQiTIvfhbQZU/Q2/LVDDficjXVn3IuKP/cqgGVf6lUh5YsUSs8qwpMil7XySiHvaZn+iFAnsXoejd4S2e/pbRvyaxP1aa7TCxnINjpU7IrnUEUiI4glQmAte3MqZWLXcc0Uk3Qz9PP0cD+V8qCOryrPMP2kTAI8LT/K4DgcEMAEGes4Vx1l0oBMF0xJvhM2kZXcEcf0NzuQJvYTgZpQF5xp0TchezLshmEUSIkII9NvAvn+iEYJeHsJUDijjmBloSYe4+QTgdYh6FakVUwYI5U4ztDNrvgqhWjExfbn8HxaFzsNTsuzGoYs+jwXH8Wk2z1Q1oQjDdO5YTjmdqvkSTdin/5CiuCDHaQX6a4gNQ=="
-    }
-  }
-}

apps/gitea/gitea.pvc.yaml

@@ -1,62 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: gitea
-  name: gitea-data-nfs
-spec:
-  # storageClassName: fast
-  capacity:
-    storage: "10Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/gitea/data
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: gitea
-  name: gitea-data-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "10Gi"
-  volumeName: gitea-data-nfs
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: gitea
-  name: gitea-postgresql-data-nfs
-spec:
-  # storageClassName: fast
-  capacity:
-    storage: "5Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/gitea/postgres
-    server: 192.168.1.157
-
----
-
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: gitea
-  name: gitea-postgresql-data-nfs
-spec:
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "5Gi"
-  volumeName: gitea-postgresql-data-nfs

apps/gitea/gitea.values.yaml

@@ -1,497 +0,0 @@
-# Default values for gitea.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-## @section Global
-#
-## @param global.imageRegistry global image registry override
-## @param global.imagePullSecrets global image pull secrets override; can be extended by `imagePullSecrets`
-## @param global.storageClass global storage class override
-## @param global.hostAliases global hostAliases which will be added to the pod's hosts files
-global:
-  imageRegistry: ""
-  ## E.g.
-  ## imagePullSecrets:
-  ##   - myRegistryKeySecretName
-  ##
-  imagePullSecrets: []
-  storageClass: ""
-  hostAliases: []
-  # - ip: 192.168.137.2
-  #   hostnames:
-  #   - example.com
-
-## @param replicaCount number of replicas for the statefulset
-replicaCount: 1
-
-## @param clusterDomain cluster domain
-clusterDomain: cluster.local
-
-## @section Image
-## @param image.registry image registry, e.g. gcr.io,docker.io
-## @param image.repository Image to start for this pod
-## @param image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml.
-## @param image.pullPolicy Image pull policy
-## @param image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher
-image:
-  registry: ""
-  repository: gitea/gitea
-  # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
-  pullPolicy: Always
-  rootless: false # only possible when running 1.14 or later
-
-## @param imagePullSecrets Secret to use for pulling the image
-imagePullSecrets: []
-
-## @section Security
-# Security context is only usable with rootless image due to image design
-## @param podSecurityContext.fsGroup Set the shared file system group for all containers in the pod.
-podSecurityContext:
-  fsGroup: 1000
-
-## @param containerSecurityContext Security context
-containerSecurityContext: {}
-#   allowPrivilegeEscalation: false
-#   capabilities:
-#     drop:
-#       - ALL
-#   # Add the SYS_CHROOT capability for root and rootless images if you intend to
-#   # run pods on nodes that use the container runtime cri-o. Otherwise, you will
-#   # get an error message from the SSH server that it is not possible to read from
-#   # the repository.
-#   # https://gitea.com/gitea/helm-chart/issues/161
-#     add:
-#       - SYS_CHROOT
-#   privileged: false
-#   readOnlyRootFilesystem: true
-#   runAsGroup: 1000
-#   runAsNonRoot: true
-#   runAsUser: 1000
-
-## @deprecated The securityContext variable has been split two:
-## - containerSecurityContext
-## - podSecurityContext.
-## @param securityContext Run init and Gitea containers as a specific securityContext
-securityContext: {}
-
-## @section Service
-service:
-  ## @param service.http.type Kubernetes service type for web traffic
-  ## @param service.http.port Port number for web traffic
-  ## @param service.http.clusterIP ClusterIP setting for http autosetup for statefulset is None
-  ## @param service.http.loadBalancerIP LoadBalancer IP setting
-  ## @param service.http.nodePort NodePort for http service
-  ## @param service.http.externalTrafficPolicy If `service.http.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation
-  ## @param service.http.externalIPs External IPs for service
-  ## @param service.http.ipFamilyPolicy HTTP service dual-stack policy
-  ## @param service.http.ipFamilies HTTP service dual-stack familiy selection,for dual-stack parameters see official kubernetes [dual-stack concept documentation](https://kubernetes.io/docs/concepts/services-networking/dual-stack/).
-  ## @param service.http.loadBalancerSourceRanges Source range filter for http loadbalancer
-  ## @param service.http.annotations HTTP service annotations
-  http:
-    type: ClusterIP
-    port: 3000
-    clusterIP: None
-    nodePort:
-    externalTrafficPolicy:
-    externalIPs:
-    ipFamilyPolicy:
-    ipFamilies:
-    loadBalancerSourceRanges: []
-    annotations: {}
-  ## @param service.ssh.type Kubernetes service type for ssh traffic
-  ## @param service.ssh.port Port number for ssh traffic
-  ## @param service.ssh.clusterIP ClusterIP setting for ssh autosetup for statefulset is None
-  ## @param service.ssh.loadBalancerIP LoadBalancer IP setting
-  ## @param service.ssh.nodePort NodePort for ssh service
-  ## @param service.ssh.externalTrafficPolicy If `service.ssh.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation
-  ## @param service.ssh.externalIPs External IPs for service
-  ## @param service.ssh.ipFamilyPolicy SSH service dual-stack policy
-  ## @param service.ssh.ipFamilies SSH service dual-stack familiy selection,for dual-stack parameters see official kubernetes [dual-stack concept documentation](https://kubernetes.io/docs/concepts/services-networking/dual-stack/).
-  ## @param service.ssh.hostPort HostPort for ssh service
-  ## @param service.ssh.loadBalancerSourceRanges Source range filter for ssh loadbalancer
-  ## @param service.ssh.annotations SSH service annotations
-  ssh:
-    type: LoadBalancer
-    port: 2222
-    loadBalancerIP: 192.168.3.3
-    nodePort:
-    externalTrafficPolicy:
-    externalIPs:
-    ipFamilyPolicy:
-    ipFamilies:
-    hostPort:
-    loadBalancerSourceRanges: []
-    annotations: {}
-
-## @section Ingress
-## @param ingress.enabled Enable ingress
-## @param ingress.className Ingress class name
-## @param ingress.annotations Ingress annotations
-## @param ingress.hosts[0].host Default Ingress host
-## @param ingress.hosts[0].paths[0].path Default Ingress path
-## @param ingress.hosts[0].paths[0].pathType Ingress path type
-## @param ingress.tls Ingress tls settings
-## @extra ingress.apiVersion Specify APIVersion of ingress object. Mostly would only be used for argocd.
-ingress:
-  enabled: false
-  # className: nginx
-  className:
-  annotations:
-    {}
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  hosts:
-    - host: git.example.com
-      paths:
-        - path: /
-          pathType: Prefix
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - git.example.com
-  # Mostly for argocd or any other CI that uses `helm template | kubectl apply` or similar
-  # If helm doesn't correctly detect your ingress API version you can set it here.
-  # apiVersion: networking.k8s.io/v1
-
-## @section StatefulSet
-#
-## @param resources Kubernetes resources
-resources:
-  {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
-
-## Use an alternate scheduler, e.g. "stork".
-## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
-##
-## @param schedulerName Use an alternate scheduler, e.g. "stork"
-schedulerName: ""
-
-## @param nodeSelector NodeSelector for the statefulset
-nodeSelector: {}
-
-## @param tolerations Tolerations for the statefulset
-tolerations: []
-
-## @param affinity Affinity for the statefulset
-affinity: {}
-
-## @param dnsConfig dnsConfig for the statefulset
-dnsConfig: {}
-
-## @param priorityClassName priorityClassName for the statefulset
-priorityClassName: ""
-
-## @param statefulset.env  Additional environment variables to pass to containers
-## @param statefulset.terminationGracePeriodSeconds How long to wait until forcefully kill the pod
-## @param statefulset.labels Labels for the statefulset
-## @param statefulset.annotations Annotations for the Gitea StatefulSet to be created
-statefulset:
-  env:
-    []
-    # - name: VARIABLE
-    #   value: my-value
-  terminationGracePeriodSeconds: 60
-  labels: {}
-  annotations: {}
-
-## @section Persistence
-#
-## @param persistence.enabled Enable persistent storage
-## @param persistence.existingClaim Use an existing claim to store repository information
-## @param persistence.size Size for persistence to store repo information
-## @param persistence.accessModes AccessMode for persistence
-## @param persistence.labels Labels for the persistence volume claim to be created
-## @param persistence.annotations Annotations for the persistence volume claim to be created
-## @param persistence.storageClass Name of the storage class to use
-## @param persistence.subPath Subdirectory of the volume to mount at
-persistence:
-  enabled: true
-  existingClaim: gitea-data-nfs
-
-  size: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  labels: {}
-  annotations: {}
-  storageClass:
-  subPath:
-
-## @param extraVolumes Additional volumes to mount to the Gitea statefulset
-extraVolumes: []
-# - name: postgres-ssl-vol
-#   secret:
-#     secretName: gitea-postgres-ssl
-
-## @param extraContainerVolumeMounts Mounts that are only mapped into the Gitea runtime/main container, to e.g. override custom templates.
-extraContainerVolumeMounts: []
-
-## @param extraInitVolumeMounts Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration.
-extraInitVolumeMounts: []
-
-## @deprecated The extraVolumeMounts variable has been split two:
-## - extraContainerVolumeMounts
-## - extraInitVolumeMounts
-## As an example, can be used to mount a client cert when connecting to an external Postgres server.
-## @param extraVolumeMounts **DEPRECATED** Additional volume mounts for init containers and the Gitea main container
-extraVolumeMounts: []
-# - name: postgres-ssl-vol
-#   readOnly: true
-#   mountPath: "/pg-ssl"
-
-## @section Init
-## @param initPreScript Bash shell script copied verbatim to the start of the init-container.
-initPreScript: ""
-#
-# initPreScript: |
-#   mkdir -p /data/git/.postgresql
-#   cp /pg-ssl/* /data/git/.postgresql/
-#   chown -R git:git /data/git/.postgresql/
-#   chmod 400 /data/git/.postgresql/postgresql.key
-
-## @param initContainers.resources.limits initContainers.limits Kubernetes resource limits for init containers
-## @param initContainers.resources.requests.cpu initContainers.requests.cpu Kubernetes cpu resource limits for init containers
-## @param initContainers.resources.requests.memory initContainers.requests.memory Kubernetes memory resource limits for init containers
-initContainers:
-  resources:
-    limits: {}
-    requests:
-      cpu: 100m
-      memory: 128Mi
-
-# Configure commit/action signing prerequisites
-## @section Signing
-#
-## @param signing.enabled Enable commit/action signing
-## @param signing.gpgHome GPG home directory
-## @param signing.privateKey Inline private gpg key for signed Gitea actions
-## @param signing.existingSecret Use an existing secret to store the value of `signing.privateKey`
-signing:
-  enabled: false
-  gpgHome: /data/git/.gnupg
-  privateKey: ""
-  # privateKey: |-
-  #   -----BEGIN PGP PRIVATE KEY BLOCK-----
-  #   ...
-  #   -----END PGP PRIVATE KEY BLOCK-----
-  existingSecret: ""
-
-## @section Gitea
-#
-gitea:
-  ## @param gitea.admin.username Username for the Gitea admin user
-  ## @param gitea.admin.existingSecret Use an existing secret to store admin user credentials
-  ## @param gitea.admin.password Password for the Gitea admin user
-  ## @param gitea.admin.email Email for the Gitea admin user
-  admin:
-    # existingSecret: gitea-admin-secret
-    existingSecret:
-    username: gitea_admin
-    password: r8sA8CPHD9!bt6d
-    email: "gitea@local.domain"
-
-  ## @param gitea.metrics.enabled Enable Gitea metrics
-  ## @param gitea.metrics.serviceMonitor.enabled Enable Gitea metrics service monitor
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: false
-      #  additionalLabels:
-      #    prometheus-release: prom1
-
-  ## @param gitea.ldap LDAP configuration
-  ldap:
-    []
-    # - name: "LDAP 1"
-    #  existingSecret:
-    #  securityProtocol:
-    #  host:
-    #  port:
-    #  userSearchBase:
-    #  userFilter:
-    #  adminFilter:
-    #  emailAttribute:
-    #  bindDn:
-    #  bindPassword:
-    #  usernameAttribute:
-    #  publicSSHKeyAttribute:
-
-  # Either specify inline `key` and `secret` or refer to them via `existingSecret`
-  ## @param gitea.oauth OAuth configuration
-  oauth:
-    []
-    # - name: 'OAuth 1'
-    #   provider:
-    #   key:
-    #   secret:
-    #   existingSecret:
-    #   autoDiscoverUrl:
-    #   useCustomUrls:
-    #   customAuthUrl:
-    #   customTokenUrl:
-    #   customProfileUrl:
-    #   customEmailUrl:
-
-  ## @param gitea.config  Configuration for the Gitea server,ref: [config-cheat-sheet](https://docs.gitea.io/en-us/config-cheat-sheet/)
-  config:
-    APP_NAME: "Remy's personal git hosting"
-    server:
-      DOMAIN: git.kluster.moll.re
-      ROOT_URL: https://git.kluster.moll.re
-      SSH_LISTEN_PORT: 2222
-    actions:
-      ENABLED: true
-
-
-  ## @param gitea.additionalConfigSources Additional configuration from secret or configmap
-  additionalConfigSources: []
-  #   - secret:
-  #       secretName: gitea-app-ini-oauth
-  #   - configMap:
-  #       name: gitea-app-ini-plaintext
-
-  ## @param gitea.additionalConfigFromEnvs Additional configuration sources from environment variables
-  additionalConfigFromEnvs: []
-
-  ## @param gitea.podAnnotations Annotations for the Gitea pod
-  podAnnotations: {}
-
-  ## @param gitea.ssh.logLevel Configure OpenSSH's log level. Only available for root-based Gitea image.
-  ssh:
-    logLevel: "INFO"
-
-  ## @section LivenessProbe
-  #
-  ## @param gitea.livenessProbe.enabled Enable liveness probe
-  ## @param gitea.livenessProbe.tcpSocket.port Port to probe for liveness
-  ## @param gitea.livenessProbe.initialDelaySeconds Initial delay before liveness probe is initiated
-  ## @param gitea.livenessProbe.timeoutSeconds Timeout for liveness probe
-  ## @param gitea.livenessProbe.periodSeconds Period for liveness probe
-  ## @param gitea.livenessProbe.successThreshold Success threshold for liveness probe
-  ## @param gitea.livenessProbe.failureThreshold Failure threshold for liveness probe
-  # Modify the liveness probe for your needs or completely disable it by commenting out.
-  livenessProbe:
-    enabled: true
-    tcpSocket:
-      port: http
-    initialDelaySeconds: 200
-    timeoutSeconds: 1
-    periodSeconds: 10
-    successThreshold: 1
-    failureThreshold: 10
-
-  ## @section ReadinessProbe
-  #
-  ## @param gitea.readinessProbe.enabled Enable readiness probe
-  ## @param gitea.readinessProbe.tcpSocket.port Port to probe for readiness
-  ## @param gitea.readinessProbe.initialDelaySeconds Initial delay before readiness probe is initiated
-  ## @param gitea.readinessProbe.timeoutSeconds Timeout for readiness probe
-  ## @param gitea.readinessProbe.periodSeconds Period for readiness probe
-  ## @param gitea.readinessProbe.successThreshold Success threshold for readiness probe
-  ## @param gitea.readinessProbe.failureThreshold Failure threshold for readiness probe
-  # Modify the readiness probe for your needs or completely disable it by commenting out.
-  readinessProbe:
-    enabled: true
-    tcpSocket:
-      port: http
-    initialDelaySeconds: 5
-    timeoutSeconds: 1
-    periodSeconds: 10
-    successThreshold: 1
-    failureThreshold: 3
-
-  # # Uncomment the startup probe to enable and modify it for your needs.
-  ## @section StartupProbe
-  #
-  ## @param gitea.startupProbe.enabled Enable startup probe
-  ## @param gitea.startupProbe.tcpSocket.port Port to probe for startup
-  ## @param gitea.startupProbe.initialDelaySeconds Initial delay before startup probe is initiated
-  ## @param gitea.startupProbe.timeoutSeconds Timeout for startup probe
-  ## @param gitea.startupProbe.periodSeconds Period for startup probe
-  ## @param gitea.startupProbe.successThreshold Success threshold for startup probe
-  ## @param gitea.startupProbe.failureThreshold Failure threshold for startup probe
-  startupProbe:
-    enabled: false
-    tcpSocket:
-      port: http
-    initialDelaySeconds: 60
-    timeoutSeconds: 1
-    periodSeconds: 10
-    successThreshold: 1
-    failureThreshold: 10
-
-## @section Memcached
-#
-## @param memcached.enabled Memcached is loaded as a dependency from [Bitnami](https://github.com/bitnami/charts/tree/master/bitnami/memcached) if enabled in the values. Complete Configuration can be taken from their website.
-## ref: https://hub.docker.com/r/bitnami/memcached/tags/
-## @param memcached.service.ports.memcached Port for Memcached
-memcached:
-  enabled: true
-  # image:
-  #   registry: docker.io
-  #   repository: bitnami/memcached
-  #   tag: ""
-  #   digest: ""
-  #   pullPolicy: IfNotPresent
-  #   pullSecrets: []
-  service:
-    ports:
-      memcached: 11211
-
-## @section PostgreSQL
-#
-## @param postgresql.enabled Enable PostgreSQL
-## @param postgresql.global.postgresql.auth.password Password for the `gitea` user (overrides `auth.password`)
-## @param postgresql.global.postgresql.auth.database Name for a custom database to create (overrides `auth.database`)
-## @param postgresql.global.postgresql.auth.username Name for a custom user to create (overrides `auth.username`)
-## @param postgresql.global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`)
-## @param postgresql.primary.persistence.size PVC Storage Request for PostgreSQL volume
-postgresql:
-  enabled: true
-  image:
-    tag: 11
-  # diagnosticMode:
-  #   enabled: true
-  # containerSecurityContext:
-  #   runAsUser: 0
-  global:
-    postgresql:
-      auth:
-        password: gitea
-        database: gitea
-        username: gitea
-      service:
-        ports:
-          postgresql: 5432
-  primary:
-    persistence:
-      size: 10Gi
-      existingClaim: gitea-postgresql-data-nfs
-      mountPath: /bitnami/postgresql/data
-
-
-# By default, removed or moved settings that still remain in a user defined values.yaml will cause Helm to fail running the install/update.
-# Set it to false to skip this basic validation check.
-## @section Advanced
-## @param checkDeprecation Set it to false to skip this basic validation check.
-## @param test.enabled Set it to false to disable test-connection Pod.
-## @param test.image.name Image name for the wget container used in the test-connection Pod.
-## @param test.image.tag Image tag for the wget container used in the test-connection Pod.
-checkDeprecation: true
-test:
-  enabled: true
-  image:
-    name: busybox
-    tag: latest
-
-## @param extraDeploy Array of extra objects to deploy with the release
-##
-extraDeploy: []

apps/homeassistant/deployment.yaml

@@ -1,4 +1,3 @@
-
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -15,14 +14,14 @@ spec:
     spec:
       containers:
         - name: homeassistant
-          image: homeassistant/home-assistant:2023.11
+          image: homeassistant/home-assistant
           ports:
             - containerPort: 8123
           env:
           - name: TZ
             value: Europe/Berlin
           volumeMounts:
-            - name: config
+            - name: config-dir
               mountPath: /config
           resources:
             requests:
@@ -32,6 +31,7 @@ spec:
               cpu: "2"
               memory: "1Gi"
       volumes:
-        - name: config
+        - name: config-dir
           persistentVolumeClaim:
-            claimName: homeassistant-nfs
+            claimName: config
+

apps/homeassistant/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: homeassistant-ingress
@@ -6,7 +6,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`home.kluster.moll.re`)
+    - match: Host(`home.kluster.moll.re`) && !Path(`/api/prometheus`)
       middlewares:
         - name: homeassistant-websocket
       kind: Rule
@@ -15,9 +15,8 @@ spec:
           port: 8123
   tls:
     certResolver: default-tls
-
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: homeassistant-websocket
@@ -27,6 +26,3 @@ spec:
       X-Forwarded-Proto: "https"
       # enable websockets
       Upgrade: "websocket"
-
-
-

apps/homeassistant/kustomization.yaml

@@ -1,18 +1,18 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources: 
-- namespace.yaml
-- ingress.yaml
-- pvc.yaml
-- service.yaml
-- deployment.yaml
 
 namespace: homeassistant
 
+resources: 
+  - namespace.yaml
+  - ingress.yaml
+  - pvc.yaml
+  - service.yaml
+  - deployment.yaml
+  - servicemonitor.yaml
 
-# helmCharts:
-#   - name: home-assistant
-#     releaseName: homeassistant
-#     version: 13.4.2
-#     valuesFile: values.yaml
-#     repo: https://k8s-at-home.com/charts/
+
+images:
+  - name: homeassistant/home-assistant
+    newName: homeassistant/home-assistant
+    newTag: "2024.10"

apps/homeassistant/pvc.yaml

@@ -1,28 +1,11 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: homeassistant-nfs
-spec:
-  # storageClassName: slow
-  capacity:
-    storage: "1Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /kluster/homeassistant
-    server: 192.168.1.157
----
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: homeassistant-nfs
+  name: config
 spec:
-  storageClassName: ""
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
       storage: "1Gi"
-  volumeName: homeassistant-nfs

apps/homeassistant/service.yaml

@@ -2,9 +2,12 @@ apiVersion: v1
 kind: Service
 metadata:
   name: homeassistant-web
+  labels:
+    app: homeassistant
 spec:
   selector:
     app: homeassistant
   ports:
   - port: 8123
-    targetPort: 8123
+    targetPort: 8123
+    name: http

apps/homeassistant/servicemonitor.yaml

@@ -0,0 +1,13 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: homeassistant-servicemonitor
+  labels:
+    app: homeassistant
+spec:
+  selector:
+    matchLabels:
+      app: homeassistant
+  endpoints:
+    - port: http
+      path: /api/prometheus

apps/homeassistant/values.yaml

@@ -1,136 +0,0 @@
-#
-# IMPORTANT NOTE
-#
-# This chart inherits from our common library chart. You can check the default values/options here:
-# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml
-#
-
-image:
-  # -- image repository
-  repository: homeassistant/home-assistant
-  # -- image tag
-  tag: "2023.10"
-  # -- image pull policy
-  pullPolicy: IfNotPresent
-
-# -- environment variables.
-# @default -- See below
-env:
-  # -- Set the container timezone
-  TZ: Europe/Berlin
-
-# -- Configures service settings for the chart. Normally this does not need to be modified.
-# @default -- See values.yaml
-service:
-  main:
-    ports:
-      http:
-        port: 8123
-
-ingress:
-  # -- Enable and configure ingress settings for the chart under this key.
-  # @default -- See values.yaml
-  main:
-    enabled: false
-
-# -- Enable devices to be discoverable
-# hostNetwork: true
-
-# -- When hostNetwork is true set dnsPolicy to ClusterFirstWithHostNet
-# dnsPolicy: ClusterFirstWithHostNet
-
-securityContext:
-  # -- (bool) Privileged securityContext may be required if USB devics are accessed directly through the host machine
-  privileged:  # true
-
-
-resources:
-  requests:
-    cpu: "100m"
-    memory: "200Mi"
-  limits:
-    cpu: "2"
-    memory: "1Gi"
-
-# -- Configure persistence settings for the chart under this key.
-# @default -- See values.yaml
-persistence:
-  config:
-    enabled: true
-    existingClaim: homeassistant-nfs
-
-  # -- Configure a hostPathMount to mount a USB device in the container.
-  # @default -- See values.yaml
-  usb:
-    enabled: false
-    type: hostPath
-    hostPath: /path/to/device
-
-# -- Enable and configure mariadb database subchart under this key.
-#    For more options see [mariadb chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/mariadb)
-# @default -- See values.yaml
-mariadb:
-  enabled: false
-  architecture: standalone
-  auth:
-    database: home-assistant
-    username: home-assistant
-    password: home-assistant-pass
-    rootPassword: home-assistantrootpass
-  primary:
-    persistence:
-      enabled: false
-      # storageClass: ""
-
-# -- Enable and configure postgresql database subchart under this key.
-#    For more options see [postgresql chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/postgresql)
-# @default -- See values.yaml
-postgresql:
-  enabled: false
-  image:
-# -- Enable and configure influxdb database subchart under this key.
-#    For more options see [influxdb chart documentation](https://github.com/bitnami/charts/tree/master/bitnami/influxdb)
-# @default -- See values.yaml
-influxdb:
-  enabled: false
-  architecture: standalone
-  database: home_assistant
-  authEnabled: false
-  persistence:
-    enabled: false
-    # storageClass: ""
-    # size: 8Gi
-
-metrics:
-  # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
-  # @default -- See values.yaml
-  enabled: false
-  serviceMonitor:
-    interval: 1m
-    scrapeTimeout: 30s
-    labels: {}
-    ## See https://www.home-assistant.io/docs/authentication/ for where to find
-    ## long lived access token creation under your account profile, which is
-    ## needed to monitor Home Assistant
-    # bearerTokenSecret:
-    #   name: ""
-    #   key: ""
-
-  # -- Enable and configure Prometheus Rules for the chart under this key.
-  # @default -- See values.yaml
-  prometheusRule:
-    enabled: false
-    labels: {}
-    # -- Configure additionial rules for the chart under this key.
-    # @default -- See prometheusrules.yaml
-    rules: []
-      # - alert: HomeAssistantAbsent
-      #   annotations:
-      #     description: Home Assistant has disappeared from Prometheus service discovery.
-      #     summary: Home Assistant is down.
-      #   expr: |
-      #     absent(up{job=~".*home-assistant.*"} == 1)
-      #   for: 5m
-      #   labels:
-      #     severity: critical
-

apps/immich/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: stripprefix
@@ -7,7 +7,7 @@ spec:
     prefixes:
       - /api
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: websocket
@@ -18,7 +18,7 @@ spec:
       # enable websockets
       Upgrade: "websocket"
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
     name: immich-ingressroute

apps/immich/kustomization.yaml

@@ -1,16 +1,33 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: 
-- namespace.yaml
-- ingress.yaml
-- pvc.yaml
-- postgres.sealedsecret.yaml
+  - namespace.yaml
+  - ingress.yaml
+  - pvc.yaml
+  - postgres.yaml
+  - postgres.sealedsecret.yaml
+
 
 namespace: immich
 
+
 helmCharts:
   - name: immich
     releaseName: immich
-    version: 0.2.0
+    version: 0.8.1
     valuesFile: values.yaml
     repo: https://immich-app.github.io/immich-charts
+
+
+images:
+  - name: ghcr.io/immich-app/immich-machine-learning
+    newTag: v1.117.0
+  - name: ghcr.io/immich-app/immich-server
+    newTag: v1.117.0
+
+
+patches:
+  - path: patch-redis-pvc.yaml
+    target:
+      kind: StatefulSet
+      name: immich-redis-master

apps/immich/patch-redis-pvc.yaml

@@ -0,0 +1,17 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: immich-redis-master
+spec:
+  volumeClaimTemplates:
+  - apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: redis-data
+    spec:
+      storageClassName: nfs-client
+      accessModes:
+        - ReadWriteMany
+      resources:
+        requests:
+          storage: 2Gi

apps/immich/postgres.yaml

@@ -0,0 +1,35 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: immich-postgres
+spec:
+  instances: 1
+  imageName: ghcr.io/tensorchord/cloudnative-pgvecto.rs:16.2
+  bootstrap:
+    initdb:
+      owner: immich
+      database: immich
+      secret:
+        name: postgres-password
+
+  # Enable the VECTORS extension
+      postInitSQL:
+        - CREATE EXTENSION IF NOT EXISTS "vectors";
+
+  postgresql:
+    shared_preload_libraries:
+      - "vectors.so"
+
+  # Persistent storage configuration
+  storage:
+    size: 2Gi
+    pvcTemplate:
+      accessModes:
+        - ReadWriteOnce
+      resources:
+        requests:
+          storage: 2Gi
+      storageClassName: nfs-client
+      volumeMode: Filesystem
+  monitoring:
+    enablePodMonitor: true

apps/immich/pvc.yaml

@@ -1,26 +1,11 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: immich-nfs
-spec:
-  capacity:
-    storage: "50Gi"
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /kluster/immich
-    server: 192.168.1.157
----
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: immich-nfs
+  name: data
 spec:
-  storageClassName: ""
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: "50Gi"
-  volumeName: immich-nfs
+      storage: "100Gi"

apps/immich/values.yaml

@@ -6,7 +6,7 @@
 
 env:
   REDIS_HOSTNAME: '{{ printf "%s-redis-master" .Release.Name }}'
-  DB_HOSTNAME: "postgres-postgresql.postgres"
+  DB_HOSTNAME: "immich-postgres-rw"
   DB_USERNAME: 
     valueFrom:
       secretKeyRef:
@@ -22,89 +22,41 @@ env:
       secretKeyRef:
         name: postgres-password
         key: password
-  TYPESENSE_ENABLED: "{{ .Values.typesense.enabled }}"
-  TYPESENSE_API_KEY: "{{ .Values.typesense.env.TYPESENSE_API_KEY }}"
-  TYPESENSE_HOST: '{{ printf "%s-typesense" .Release.Name }}'
-  IMMICH_WEB_URL: '{{ printf "http://%s-web:3000" .Release.Name }}'
-  IMMICH_SERVER_URL: '{{ printf "http://%s-server:3001" .Release.Name }}'
   IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
-
-image:
-  tag: v1.89.0
+  IMMICH_METRICS: true
 
 immich:
+  metrics:
+    # Enabling this will create the service monitors needed to monitor immich with the prometheus operator
+    enabled: true
   persistence:
     # Main data store for all photos shared between different components.
     library:
       # Automatically creating the library volume is not supported by this chart
       # You have to specify an existing PVC to use
-      existingClaim: immich-nfs
+      existingClaim: data
 
 # Dependencies
 
 postgresql:
   enabled: false
 
-
 redis:
   enabled: true
   architecture: standalone
   auth:
     enabled: false
 
-typesense:
-  enabled: true
-  env:
-    TYPESENSE_DATA_DIR: /tsdata
-    TYPESENSE_API_KEY: typesense
-  persistence:
-    tsdata:
-      # Enabling typesense persistence is recommended to avoid slow reindexing
-      enabled: true
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      # storageClass: storage-class
-  image:
-    repository: docker.io/typesense/typesense
-    tag: 0.24.0
-    pullPolicy: IfNotPresent
-
 # Immich components
 
 server:
   enabled: true
-
-  image:
-    repository: ghcr.io/immich-app/immich-server
-    pullPolicy: IfNotPresent
-
   ingress:
     main:
       enabled: false
 
-microservices:
-  enabled: true
-  env:
-    REVERSE_GEOCODING_DUMP_DIRECTORY: /geodata-cache
-  persistence:
-    geodata-cache:
-      enabled: true
-      size: 1Gi
-      # Optional: Set this to pvc to avoid downloading the geodata every start.
-      type: emptyDir
-      accessMode: ReadWriteMany
-      # storageClass: your-class
-  image:
-    repository: ghcr.io/immich-app/immich-server
-    pullPolicy: IfNotPresent
-
 machine-learning:
   enabled: true
-  image:
-    repository: ghcr.io/immich-app/immich-machine-learning
-    pullPolicy: IfNotPresent
-  env:
-    TRANSFORMERS_CACHE: /cache
   persistence:
     cache:
       enabled: true
@@ -112,4 +64,3 @@ machine-learning:
       # Optional: Set this to pvc to avoid downloading the ML models every start.
       type: emptyDir
       accessMode: ReadWriteMany
-      # storageClass: your-class

apps/media/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyfin-server
+spec:
+  selector:
+    matchLabels:
+      app: jellyfin-server
+  template:
+    metadata:
+      labels:
+        app: jellyfin-server
+    spec:
+      containers:
+      - name: jellyfin-server
+        image: jellyfin/jellyfin
+        resources:
+          limits:
+            memory: "2Gi"
+            cpu: "2"
+          requests:
+            memory: "128Mi"
+            cpu: "250m"
+        ports:
+        - containerPort: 8096
+          name: jellyfin
+        env:
+        - name: TZ
+          value: Europe/Berlin
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: media
+          mountPath: /media
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8096
+          initialDelaySeconds: 100
+          periodSeconds: 15
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: config
+      - name: media
+        persistentVolumeClaim:
+          claimName: media
+

apps/media/ingress.yaml

@@ -0,0 +1,44 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: jellyfin-backend-ingress
+  namespace: media
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`media.kluster.moll.re`) && !Path(`/metrics`)
+      middlewares:
+        - name: jellyfin-websocket
+        - name: jellyfin-server-headers
+      kind: Rule
+      services:
+        - name: jellyfin-server
+          port: 8096
+  tls:
+    certResolver: default-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: jellyfin-websocket
+  namespace: media
+spec:
+  headers:
+    customRequestHeaders:
+      Connection: keep-alive, Upgrade
+      Upgrade: WebSocket
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: jellyfin-server-headers
+  namespace: media
+spec:
+  headers:
+    accessControlAllowCredentials: true
+    accessControlAllowHeaders: [ "Authorization","Content-Type" ] # "Accept","Origin"
+    accessControlAllowMethods: [ "GET","HEAD","OPTIONS" ] # "POST","PUT"
+    accessControlAllowOriginList:
+      - "*"
+    accessControlMaxAge: 100

apps/media/jellyfin.ingress.yaml

@@ -1,32 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: jellyfin-ingress
-  namespace: media
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`media.kluster.moll.re`)
-      middlewares:
-        - name: jellyfin-websocket
-      kind: Rule
-      services:
-        - name: jellyfin
-          port: 8096
-  tls:
-    certResolver: default-tls
-
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: jellyfin-websocket
-  namespace: media
-spec:
-  headers:
-    customRequestHeaders:
-      X-Forwarded-Proto: "https"
-      Upgrade: "websocket"
-
-

apps/media/jellyfin.pvc.yaml

@@ -1,62 +0,0 @@
-
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: media
-  name: jellyfin-config-nfs
-
-spec:
-  # storageClassName: slow
-  capacity:
-    storage: "1Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/jellyfin-config
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: media
-  name: jellyfin-config-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
-  volumeName: jellyfin-config-nfs
----
-
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: media
-  name: jellyfin-data-nfs
-spec:
-  # storageClassName: slow
-  capacity:
-    storage: "1Ti"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/jellyfin-media
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: media
-  name: jellyfin-data-nfs
-spec:
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Ti"
-  volumeName: jellyfin-data-nfs

apps/media/jellyfin.values.yaml

@@ -1,108 +0,0 @@
-image:
-  # -- image repository
-  repository: jellyfin/jellyfin
-  # -- image tag
-  tag: 10.8.9
-
-  # -- image pull policy
-  pullPolicy: IfNotPresent
-
-
-# -- environment variables. See [image docs](https://jellyfin.org/docs/general/administration/configuration.html) for more details.
-# @default -- See below
-env:
-  # -- Set the container timezone
-  TZ: Europe/Berlin
-
-# -- Configures service settings for the chart.
-# @default -- See values.yaml
-service:
-  main:
-    ports:
-      http:
-        port: 8096
-
-ingress:
-  # -- Enable and configure ingress settings for the chart under this key.
-  # @default -- See values.yaml
-  main:
-    enabled: false
-
-# -- Configure persistence settings for the chart under this key.
-# @default -- See values.yaml
-persistence:
-  config:
-    enabled: true
-    type: pvc
-    existingClaim: jellyfin-config-nfs
-    accessMode: 
-      - ReadWriteOnce
-
-  # Cache does NOT contain temporary transcoding data.
-  cache:
-    enabled: false
-    mountPath: /cache
-
-  media:
-    enabled: true
-    # use local storage
-    type: pvc
-    existingClaim: jellyfin-data-nfs
-    accessMode: 
-      - ReadWriteOnce
-    mountPath: /media
-
-  # encoder:
-  #   enabled: true
-  #   type: hostPath
-  #   hostPath: /dev/dri/renderD128
-
-
-# # -- Configure the Security Context for the Pod
-# podSecurityContext:
-#   runAsUser: 0 # root user -> access to /dev/video*
-#   runAsUser: 568
-#   runAsGroup: 568
-#   fsGroup: 568
-#   # Hardware acceleration using an Intel iGPU w/ QuickSync
-#   # These IDs below should be matched to your `video` and `render` group on the host
-#   # To obtain those IDs run the following grep statement on the host:
-#   # $ cat /etc/group | grep "video\|render"
-#   # video:x:44:
-#   # render:x:109:
-#   supplementalGroups:
-#   - 44
-#   - 109
-
-# resources:
-#   requests:
-#     # Hardware acceleration using an Intel iGPU w/ QuickSync and
-#     # using intel-gpu-plugin (https://github.com/intel/intel-device-plugins-for-kubernetes)
-#     gpu.intel.com/i915: 1
-#     cpu: 200m
-#     memory: 256Mi
-#   limits:
-#     # Hardware acceleration using an Intel iGPU w/ QuickSync and
-#     # using intel-gpu-plugin (https://github.com/intel/intel-device-plugins-for-kubernetes)
-#     gpu.intel.com/i915: 1
-#     memory: 4096Mi
-
-probes:
-  # -- Liveness probe configuration
-  # @default -- See below
-  liveness:
-    # -- Enable the liveness probe
-    enabled: true
-    # -- Set this to `true` if you wish to specify your own livenessProbe
-    custom: true
-    # -- The spec field contains the values for the default livenessProbe.
-    # If you selected `custom: true`, this field holds the definition of the livenessProbe.
-    # @default -- See below
-    spec:
-      initialDelaySeconds: 100
-      periodSeconds: 100
-      timeoutSeconds: 5
-      failureThreshold: 3
-      httpGet:
-        path: /health
-        port: 8096

apps/media/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: media
+
+resources: 
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+
+images:
+  - name: jellyfin/jellyfin
+    newName: jellyfin/jellyfin
+    newTag: 10.9.11

apps/media/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/media/pvc.yaml

@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: config
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+
+---
+
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: media
+spec:
+  capacity:
+    storage: "1Ti"
+  accessModes:
+    - ReadWriteOnce
+  nfs:
+    path: /export/jellyfin-media
+    server: 192.168.1.157
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: media
+spec:
+  storageClassName: ""
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Ti"
+  volumeName: media

apps/media/service.yaml

@@ -0,0 +1,14 @@
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin-server
+  labels:
+    app: jellyfin-server-service
+spec:
+  selector:
+    app: jellyfin-server
+  ports:
+    - protocol: TCP
+      port: 8096
+      targetPort: 8096

apps/minecraft/README.md

@@ -0,0 +1,7 @@
+## Sending a command
+```
+kubectl exec -it -n minecraft deploy/minecraft-server -- /bin/bash
+mc-send-to-console /help
+# or directly
+kubectl exec -it -n minecraft deploy/minecraft-server -- mc-send-to-console /help
+```

apps/minecraft/curseforge.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: curseforge-api
+  namespace: minecraft
+spec:
+  encryptedData:
+    key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: curseforge-api
+      namespace: minecraft
+    type: Opaque

apps/minecraft/job.yaml

@@ -0,0 +1,57 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: start-server
+spec:
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+      - name: minecraft-server
+        image: minecraft
+        resources:
+          limits:
+            memory: "10000Mi"
+            cpu: "5"
+          requests:
+            memory: "1500Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 25565
+        env:
+        - name: EULA
+          value: "TRUE"
+        - name: TYPE
+          value: "AUTO_CURSEFORGE"
+        - name: CF_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: curseforge-api
+              key: key
+        - name: CF_PAGE_URL
+          value: "https://www.curseforge.com/minecraft/modpacks/vault-hunters-1-18-2/files/5413446"
+        - name: VERSION
+          value: "1.18.2"
+        - name: INIT_MEMORY
+          value: "1G"
+        - name: MAX_MEMORY
+          value: "8G"
+        - name: MOTD
+          value: "VaultHunters baby!"
+        - name: ENABLE_RCON
+          value: "false"
+        - name: CREATE_CONSOLE_IN_PIPE
+          value: "true"
+        - name: ONLINE_MODE
+          value: "true"
+        - name: ENABLE_AUTOSTOP
+          value: "true"
+        
+        volumeMounts:
+        - name: minecraft-data
+          mountPath: /data
+
+      volumes:
+      - name: minecraft-data
+        persistentVolumeClaim:
+          claimName: minecraft-data

apps/minecraft/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: minecraft
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - job.yaml
+  - service.yaml
+  - curseforge.sealedsecret.yaml
+
+
+images:
+  - name: minecraft
+    newName: itzg/minecraft-server
+    newTag: java21

apps/minecraft/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/minecraft/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: minecraft-data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/minecraft/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: minecraft-server
+spec:
+  selector:
+    app: minecraft-server
+  ports:
+  - port: 25565
+    targetPort: 25565
+  type: LoadBalancer
+  loadBalancerIP: 192.168.3.4

apps/monitoring/grafana-admin.sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: grafana-admin-secret
+  namespace: monitoring
+spec:
+  encryptedData:
+    password: AgAwMLnsYN1y8JQSqgGQbNG/8jKensTDsEw6ogITdkhDRlJcg8HQ5t7a6xLzNCrLHLJiQW8YOoyLT4lvFkBRMOa2EYcrDvBiRD0PjygWLIscKa7dA+jpAUf/icD9zsiDnTym2yf+VUANcmEgE6DiNvlcsrcmYqiR4pKVUTDlKPNOjOpTJ3nXETb3/sbt69E0JSGwtkvusYQSXKLU9KLbciihv+ycdkdlC9xy9myd4+vYZYXSh/eAvyZeb/hsmdSX7yaASmupMvet6Qsdt99PNzFQxtbQH+LQvYalVZ8bjWZQvCN/p0bA4H15otKBfe8rtEwVthgvyEvo6TK0Mg0pFY/b3AOGFmImnT3rDmgG6S8KTZH0Jce17ksFqvELQmHjqHuYpQsPDl44glM8kWRJ9Mf/Z424LRwZlJNVcOkuVl4qFqPUjzd2rWIyF0RaD0BE012C0ThJxKn2l17lVJbNtdUiR3qNpW01ot2m0CgKd2kXbjDmgRgAll4WgrukfCIn9ZnE0gVCFLJuK3MOQAaipFYy/bDO0izwl9T8nldgcI8OfiC3NTk2O+Es5jJRXu0oJGaC3HrTB7wXiwOoELvAsxLTPxKBiN9mCHCMtZX0PEtrio0dFRQ6Pi5xPng0KVT0I9dvGNsPdhPETNOB913WEvbgP8Gt3cj016nCzk51eUsYbXPpNL2B4kmbIhecqW/8kwKQPwYjVlBSXj3NxjzwMY6PvOl1
+    user: AgBqmjCYGMqy5zBE+vhtsynOvhWdHWDJDyl1D+laBtLjXTJwzRbNTdunHYo1ekwyqQ6Cr5pi4YMiLxAl1LIHF+Lfsp2QlY+ResAGzp9WgSBtNQDX3EmLDQofeWxMUDdMtMsE9wiKLCfNGDkRDsGquXTz+YFq03m1vH9cB8Bp+1ClWOTui+/Ce0MZlWsJZX1W8WXH7XTirtwUo0s53pc4AplUUH97ZEK3KSIxWa3gLCn0sAPDDLPX+JVA2xtpMq1XuVFiFifjzEtG2h0dejiF35FtSAR+rR4YmEfimk3QpRDfOqV5QUxvjCG+dTV49upSevF2mvbHW+o+lB6vEc6l9cZXvlbnMdaep3NmOsJcJ8wQIdFpFK4iVzFOTKSEbzLPlZ/J+sjS5vDXsfthorIO2faMA1iIf+I663zNxQU5btaK4TNYOZQlrFVjAmioRLkDhGZ6tDUPX/zMv+Crt+0HCwyEyhmvFZckDvezTZrxARSXXMKBVcvjHCyUNkz7ubZRiMU0PGM7fYuHr659e+XMRvj+LFA68ZaEIzCQpCFJenWWYAXgUdRG4LQ1LP2MwvRHpkOYSoRkHIpX7jOfhX82A60h/ta/CdbWifqNyL9OecvE3FKsZu/Kr0taw9W6nm6FBhQLgFkOnFrqp9dWnxfHruXuDBgcn0iE8nR7Ht2zS7hfQPeR4a3Y0xK3Plqbzdrb9HKnWQQhf14=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: grafana-admin-secret
+      namespace: monitoring
+    type: Opaque

apps/monitoring/grafana-auth.sealedsecret.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: grafana-auth
+  namespace: monitoring
+spec:
+  encryptedData:
+    client_secret: AgCcKsnS3u2eI+fNVC9hAZ3QRFOHFErAzs5aQgX51CSdJwM03SZUoTyrDi5JPcHUVyS3MbevFH5piMhDTARMI3bLOjYlcwMbpf77JCPa7o95Y9asA/FW3lXicYt3biN9xBXJBz7Ws3fVRtEzyf6DmbGedT9gaX8aPwrUVbP19RdyJiuu76oB1A/jdUkX4K+X6kVvmoP/BWdypk/kdQJrzBNt00DIXF4NHfYey36AuhpBtqYZs4faA/tBXMXLE4RxPNtcHwNfVjnRj3v3qzNufD1fnweJvLq2UfLMrQjoR9XDVnM0zkpautylkI7yrvcoEH7ljnf6b1FMogOEZUfH1BIdqTd/WwrrlCqE58OPfJWthIfN+pQ8LvdHsGo3jc9gXvfXS2cStyhP06eTZ4D79kG+RtDQGOsD/Wpx7EcM6hbB3+dIjcs3wEAIGjpIVtY9JayW8YeRnFApMuhDST1+hscm+LdoGvaSTlAuGzv9BbVrPX/Fo9XKeYHlbG/x71Er+vF8WbW0wUa46MHLvbEy376XIdJDYi+vjl4eqznZ6YhvPbawhoKXT8ZcKUcUAjVcMue/O/jCSPZplbn3vdSCeqPTiqVqDw9PTMIeWFUepgPMxiGpFRAqdwIecFBnYItq0dXoGlFrZpo0S6AECgZjxzUR5EgdkdPlDDs2CN+d9yP7f2S+gmL7AIlQr74NW1GrTGw2x/rD4IJhunh7
+  template:
+    metadata:
+      creationTimestamp: null
+      name: grafana-auth
+      namespace: monitoring
+    type: Opaque

apps/monitoring/grafana.ingress.yaml

@@ -1,5 +1,5 @@
 kind: IngressRoute
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 metadata:
   name: grafana-ingress
 spec:
@@ -13,5 +13,3 @@ spec:
           port: 80
   tls:
     certResolver: default-tls
-
-

apps/monitoring/grafana.pvc.yaml

@@ -1,35 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: grafana-nfs
-  labels:
-    directory: grafana
-spec:
-  # storageClassName: slow
-  capacity:
-    storage: "1Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/grafana
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: grafana-nfs
-spec:
-  # storageClassName: slow
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "1Gi"
-  selector:
-    matchLabels:
-      directory: grafana
-
-
-

apps/monitoring/grafana.values.yaml

@@ -1,570 +1,61 @@
-rbac:
-  create: true
-  ## Use an existing ClusterRole/Role (depending on rbac.namespaced false/true)
-  # useExistingRole: name-of-some-(cluster)role
-  pspEnabled: true
-  pspUseAppArmor: true
-  namespaced: false
-  extraRoleRules: []
-  # - apiGroups: []
-  #   resources: []
-  #   verbs: []
-  extraClusterRoleRules: []
-  # - apiGroups: []
-  #   resources: []
-  #   verbs: []
-serviceAccount:
-  create: true
-  name:
-  nameTest:
-## Service account annotations. Can be templated.
-#  annotations:
-#    eks.amazonaws.com/role-arn: arn:aws:iam::123456789000:role/iam-role-name-here
-  autoMount: true
-
 replicas: 1
 
 ## Create a headless service for the deployment
 headlessService: false
 
-## Create HorizontalPodAutoscaler object for deployment type
-#
-autoscaling:
-  enabled: false
-#   minReplicas: 1
-#   maxReplicas: 10
-#   metrics:
-#   - type: Resource
-#     resource:
-#       name: cpu
-#       targetAverageUtilization: 60
-#   - type: Resource
-#     resource:
-#       name: memory
-#       targetAverageUtilization: 60
-
-## See `kubectl explain poddisruptionbudget.spec` for more
-## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
-podDisruptionBudget: {}
-#  minAvailable: 1
-#  maxUnavailable: 1
-
-## See `kubectl explain deployment.spec.strategy` for more
-## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
-deploymentStrategy:
-  type: RollingUpdate
-
-readinessProbe:
-  httpGet:
-    path: /api/health
-    port: 3000
-
-livenessProbe:
-  httpGet:
-    path: /api/health
-    port: 3000
-  initialDelaySeconds: 60
-  timeoutSeconds: 30
-  failureThreshold: 10
-
-## Use an alternate scheduler, e.g. "stork".
-## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
-##
-# schedulerName: "default-scheduler"
-
-image:
-  repository: grafana/grafana
-  tag: 9.0.2
-  sha: ""
-  pullPolicy: IfNotPresent
-
-  ## Optionally specify an array of imagePullSecrets.
-  ## Secrets must be manually created in the namespace.
-  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
-  ## Can be templated.
-  ##
-  # pullSecrets:
-  #   - myRegistrKeySecretName
-
-testFramework:
-  enabled: true
-  image: "bats/bats"
-  tag: "v1.4.1"
-  imagePullPolicy: IfNotPresent
-  securityContext: {}
-
-securityContext:
-  runAsUser: 472
-  runAsGroup: 472
-  fsGroup: 472
-
-containerSecurityContext:
-  {}
-
-# Extra configmaps to mount in grafana pods
-# Values are templated.
-extraConfigmapMounts: []
-  # - name: certs-configmap
-  #   mountPath: /etc/grafana/ssl/
-  #   subPath: certificates.crt # (optional)
-  #   configMap: certs-configmap
-  #   readOnly: true
-
-
-extraEmptyDirMounts: []
-  # - name: provisioning-notifiers
-  #   mountPath: /etc/grafana/provisioning/notifiers
-
-
-# Apply extra labels to common labels.
-extraLabels: {}
-
-## Assign a PriorityClassName to pods if set
-# priorityClassName:
-
-downloadDashboardsImage:
-  repository: curlimages/curl
-  tag: 7.73.0
-  sha: ""
-  pullPolicy: IfNotPresent
-
-downloadDashboards:
-  env: {}
-  envFromSecret: ""
-  resources: {}
-
-## Pod Annotations
-# podAnnotations: {}
-
-## Pod Labels
-# podLabels: {}
-
-podPortName: grafana
-
-## Deployment annotations
-# annotations: {}
-
 ## Expose the grafana service to be accessed from outside the cluster (LoadBalancer service).
 ## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
 ## ref: http://kubernetes.io/docs/user-guide/services/
 ##
 service:
   enabled: true
-  type: ClusterIP
-  port: 80
-  targetPort: 3000
-    # targetPort: 4181 To be used with a proxy extraContainer
-  annotations: {}
-  labels: {}
-  portName: service
 
 serviceMonitor:
   ## If true, a ServiceMonitor CRD is created for a prometheus operator
   ## https://github.com/coreos/prometheus-operator
   ##
   enabled: false
-  path: /metrics
-  #  namespace: monitoring  (defaults to use the namespace this chart is deployed to)
-  labels: {}
-  interval: 1m
-  scheme: http
-  tlsConfig: {}
-  scrapeTimeout: 30s
-  relabelings: []
 
-extraExposePorts: []
- # - name: keycloak
- #   port: 8080
- #   targetPort: 8080
- #   type: ClusterIP
-
-# overrides pod.spec.hostAliases in the grafana deployment's pods
-hostAliases: []
-  # - ip: "1.2.3.4"
-  #   hostnames:
-  #     - "my.host.com"
+envValueFrom:
+  AUTH_GRAFANA_CLIENT_SECRET:
+    secretKeyRef:
+      name: grafana-auth
+      key: client_secret
 
 ingress:
-  enabled: true
-  # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
-  # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
-  # ingressClassName: nginx
-  # Values can be templated
-  annotations: {
-    kubernetes.io/ingress.class: nginx,
-    cert-manager.io/cluster-issuer: cloudflare-letsencrypt-prod
-  }
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  labels: {}
-  path: /
+  enabled: false
 
-  # pathType is only for k8s >= 1.1=
-  pathType: Prefix
-
-  hosts:
-    - grafana.kluster.moll.re
-  ## Extra paths to prepend to every host configuration. This is useful when working with annotation based services.
-  extraPaths: []
-  # - path: /*
-  #   backend:
-  #     serviceName: ssl-redirect
-  #     servicePort: use-annotation
-  ## Or for k8s > 1.19
-  # - path: /*
-  #   pathType: Prefix
-  #   backend:
-  #     service:
-  #       name: ssl-redirect
-  #       port:
-  #         name: use-annotation
-
-
-  tls: 
-    - hosts:
-      - grafana.kluster.moll.re
-      secretName: cloudflare-letsencrypt-issuer-account-key
-    #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
-
-resources: {}
-#  limits:
-#    cpu: 100m
-#    memory: 128Mi
-#  requests:
-#    cpu: 100m
-#    memory: 128Mi
-
-## Node labels for pod assignment
-## ref: https://kubernetes.io/docs/user-guide/node-selection/
-#
-nodeSelector: {}
-
-## Tolerations for pod assignment
-## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-##
-tolerations: []
-
-## Affinity for pod assignment (evaluated as template)
-## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-##
-affinity: {}
-
-## Additional init containers (evaluated as template)
-## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-##
-extraInitContainers: []
-
-## Enable an Specify container in extraContainers. This is meant to allow adding an authentication proxy to a grafana pod
-extraContainers: ""
-# extraContainers: |
-# - name: proxy
-#   image: quay.io/gambol99/keycloak-proxy:latest
-#   args:
-#   - -provider=github
-#   - -client-id=
-#   - -client-secret=
-#   - -github-org=<ORG_NAME>
-#   - -email-domain=*
-#   - -cookie-secret=
-#   - -http-address=http://0.0.0.0:4181
-#   - -upstream-url=http://127.0.0.1:3000
-#   ports:
-#     - name: proxy-web
-#       containerPort: 4181
-
-## Volumes that can be used in init containers that will not be mounted to deployment pods
-extraContainerVolumes: []
-#  - name: volume-from-secret
-#    secret:
-#      secretName: secret-to-mount
-#  - name: empty-dir-volume
-#    emptyDir: {}
-
-## Enable persistence using Persistent Volume Claims
-## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
-##
-persistence:
-  type: pvc
-  enabled: true
-  # storageClassName: default
-  accessModes:
-    - ReadWriteOnce
-  size: 10Gi
-  # annotations: {}
-  finalizers:
-    - kubernetes.io/pvc-protection
-  # selectorLabels: {}
-  ## Sub-directory of the PV to mount. Can be templated.
-  # subPath: ""
-  ## Name of an existing PVC. Can be templated.
-  existingClaim: grafana-nfs
-
-  ## If persistence is not enabled, this allows to mount the
-  ## local storage in-memory to improve performance
-  ##
-  inMemory:
-    enabled: false
-    ## The maximum usage on memory medium EmptyDir would be
-    ## the minimum value between the SizeLimit specified
-    ## here and the sum of memory limits of all containers in a pod
-    ##
-    # sizeLimit: 300Mi
-
-initChownData:
-  ## If false, data ownership will not be reset at startup
-  ## This allows the prometheus-server to be run with an arbitrary user
-  ##
-  enabled: true
-
-  ## initChownData container image
-  ##
-  image:
-    repository: busybox
-    tag: "1.31.1"
-    sha: ""
-    pullPolicy: IfNotPresent
-
-  ## initChownData resource requests and limits
-  ## Ref: http://kubernetes.io/docs/user-guide/compute-resources/
-  ##
-  resources: {}
-  #  limits:
-  #    cpu: 100m
-  #    memory: 128Mi
-  #  requests:
-  #    cpu: 100m
-  #    memory: 128Mi
-
-
-# Administrator credentials when not using an existing secret (see below)
-adminUser: admin
-# adminPassword: strongpassword
-
-# Use an existing secret for the admin user.
+# credentials
 admin:
-  ## Name of the secret. Can be templated.
-  existingSecret: ""
-  userKey: admin-user
-  passwordKey: admin-password
+  existingSecret: grafana-admin-secret
+  userKey: user
+  passwordKey: password
 
-## Define command to be executed at startup by grafana container
-## Needed if using `vault-env` to manage secrets (ref: https://banzaicloud.com/blog/inject-secrets-into-pods-vault/)
-## Default is "run.sh" as defined in grafana's Dockerfile
-# command:
-# - "sh"
-# - "/run.sh"
-
-## Use an alternate scheduler, e.g. "stork".
-## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
-##
-# schedulerName:
-
-## Extra environment variables that will be pass onto deployment pods
-##
-## to provide grafana with access to CloudWatch on AWS EKS:
-## 1. create an iam role of type "Web identity" with provider oidc.eks.* (note the provider for later)
-## 2. edit the "Trust relationships" of the role, add a line inside the StringEquals clause using the
-## same oidc eks provider as noted before (same as the existing line)
-## also, replace NAMESPACE and prometheus-operator-grafana with the service account namespace and name
-##
-##  "oidc.eks.us-east-1.amazonaws.com/id/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:sub": "system:serviceaccount:NAMESPACE:prometheus-operator-grafana",
-##
-## 3. attach a policy to the role, you can use a built in policy called CloudWatchReadOnlyAccess
-## 4. use the following env: (replace 123456789000 and iam-role-name-here with your aws account number and role name)
-##
-## env:
-##   AWS_ROLE_ARN: arn:aws:iam::123456789000:role/iam-role-name-here
-##   AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
-##   AWS_REGION: us-east-1
-##
-## 5. uncomment the EKS section in extraSecretMounts: below
-## 6. uncomment the annotation section in the serviceAccount: above
-## make sure to replace arn:aws:iam::123456789000:role/iam-role-name-here with your role arn
-
-env: {}
-
-## "valueFrom" environment variable references that will be added to deployment pods. Name is templated.
-## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#envvarsource-v1-core
-## Renders in container spec as:
-##   env:
-##     ...
-##     - name: <key>
-##       valueFrom:
-##         <value rendered as YAML>
-envValueFrom: {}
-  #  ENV_NAME:
-  #    configMapKeyRef:
-  #      name: configmap-name
-  #      key: value_key
-
-## The name of a secret in the same kubernetes namespace which contain values to be added to the environment
-## This can be useful for auth tokens, etc. Value is templated.
-envFromSecret: ""
-
-## Sensible environment variables that will be rendered as new secret object
-## This can be useful for auth tokens, etc
-envRenderSecret: {}
-
-## The names of secrets in the same kubernetes namespace which contain values to be added to the environment
-## Each entry should contain a name key, and can optionally specify whether the secret must be defined with an optional key.
-## Name is templated.
-envFromSecrets: []
-## - name: secret-name
-##   optional: true
-
-## The names of conifgmaps in the same kubernetes namespace which contain values to be added to the environment
-## Each entry should contain a name key, and can optionally specify whether the configmap must be defined with an optional key.
-## Name is templated.
-## ref: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#configmapenvsource-v1-core
-envFromConfigMaps: []
-## - name: configmap-name
-##   optional: true
-
-# Inject Kubernetes services as environment variables.
-# See https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#environment-variables
-enableServiceLinks: true
-
-## Additional grafana server secret mounts
-# Defines additional mounts with secrets. Secrets must be manually created in the namespace.
-extraSecretMounts: []
-  # - name: secret-files
-  #   mountPath: /etc/secrets
-  #   secretName: grafana-secret-files
-  #   readOnly: true
-  #   subPath: ""
-  #
-  # for AWS EKS (cloudwatch) use the following (see also instruction in env: above)
-  # - name: aws-iam-token
-  #   mountPath: /var/run/secrets/eks.amazonaws.com/serviceaccount
-  #   readOnly: true
-  #   projected:
-  #     defaultMode: 420
-  #     sources:
-  #       - serviceAccountToken:
-  #           audience: sts.amazonaws.com
-  #           expirationSeconds: 86400
-  #           path: token
-  #
-  # for CSI e.g. Azure Key Vault use the following
-  # - name: secrets-store-inline
-  #  mountPath: /run/secrets
-  #  readOnly: true
-  #  csi:
-  #    driver: secrets-store.csi.k8s.io
-  #    readOnly: true
-  #    volumeAttributes:
-  #      secretProviderClass: "akv-grafana-spc"
-  #    nodePublishSecretRef:                       # Only required when using service principal mode
-  #       name: grafana-akv-creds                  # Only required when using service principal mode
-
-## Additional grafana server volume mounts
-# Defines additional volume mounts.
-extraVolumeMounts: []
-  # - name: extra-volume-0
-  #   mountPath: /mnt/volume0
-  #   readOnly: true
-  #   existingClaim: volume-claim
-  # - name: extra-volume-1
-  #   mountPath: /mnt/volume1
-  #   readOnly: true
-  #   hostPath: /usr/shared/
-
-## Container Lifecycle Hooks. Execute a specific bash command or make an HTTP request
-lifecycleHooks: {}
-  # postStart:
-  #   exec:
-  #     command: []
-
-## Pass the plugins you want installed as a list.
-##
-plugins: []
-  # - digrich-bubblechart-panel
-  # - grafana-clock-panel
-
-## Configure grafana datasources
-## ref: http://docs.grafana.org/administration/provisioning/#datasources
-##
-datasources: {}
-#  datasources.yaml:
-#    apiVersion: 1
-#    datasources:
-#    - name: Prometheus
-#      type: prometheus
-#      url: http://prometheus-prometheus-server
-#      access: proxy
-#      isDefault: true
-#    - name: CloudWatch
-#      type: cloudwatch
-#      access: proxy
-#      uid: cloudwatch
-#      editable: false
-#      jsonData:
-#        authType: default
-#        defaultRegion: us-east-1
-
-## Configure notifiers
-## ref: http://docs.grafana.org/administration/provisioning/#alert-notification-channels
-##
-notifiers: {}
-#  notifiers.yaml:
-#    notifiers:
-#    - name: email-notifier
-#      type: email
-#      uid: email1
-#      # either:
-#      org_id: 1
-#      # or
-#      org_name: Main Org.
-#      is_default: true
-#      settings:
-#        addresses: an_email_address@example.com
-#    delete_notifiers:
-
-## Configure grafana dashboard providers
-## ref: http://docs.grafana.org/administration/provisioning/#dashboards
-##
-## `path` must be /var/lib/grafana/dashboards/<provider_name>
-##
-dashboardProviders: {}
-#  dashboardproviders.yaml:
-#    apiVersion: 1
-#    providers:
-#    - name: 'default'
-#      orgId: 1
-#      folder: ''
-#      type: file
-#      disableDeletion: false
-#      editable: true
-#      options:
-#        path: /var/lib/grafana/dashboards/default
-
-## Configure grafana dashboard to import
-## NOTE: To use dashboards you must also enable/configure dashboardProviders
-## ref: https://grafana.com/dashboards
-##
-## dashboards per provider, use provider name as key.
-##
-dashboards: {}
-  # default:
-  #   some-dashboard:
-  #     json: |
-  #       $RAW_JSON
-  #   custom-dashboard:
-  #     file: dashboards/custom-dashboard.json
-  #   prometheus-stats:
-  #     gnetId: 2
-  #     revision: 2
-  #     datasource: Prometheus
-  #   local-dashboard:
-  #     url: https://example.com/repository/test.json
-  #     token: ''
-  #   local-dashboard-base64:
-  #     url: https://example.com/repository/test-b64.json
-  #     token: ''
-  #     b64content: true
+datasources:
+  datasources.yaml:
+    apiVersion: 1
+    datasources:
+      - name: Thanos
+        type: prometheus
+        url: http://thanos-querier.prometheus.svc:10902
+        isDefault: true
+      - name: Prometheus
+        type: prometheus
+        url: http://prometheus.prometheus.svc:9090
+        isDefault: false
 
+dashboardProviders:
+ dashboardproviders.yaml:
+   apiVersion: 1
+   providers:
+   - name: 'default'
+     orgId: 1
+     folder: ''
+     type: file
+     disableDeletion: false
+     editable: true
+     options:
+       path: /var/lib/grafana/dashboards/default
 ## Reference to external ConfigMap per provider. Use provider name as key and ConfigMap name as value.
 ## A provider dashboards must be defined either by external ConfigMaps or in values.yaml, not in both.
 ## ConfigMap data example:
@@ -573,301 +64,30 @@ dashboards: {}
 ##   example-dashboard.json: |
 ##     RAW_JSON
 ##
-dashboardsConfigMaps: {}
-#  default: ""
+dashboardsConfigMaps:
+  default: grafana-dashboards
+
 
-## Grafana's primary configuration
-## NOTE: values in map will be converted to ini format
-## ref: http://docs.grafana.org/installation/configuration/
-##
 grafana.ini:
-  paths:
-    data: /var/lib/grafana/
-    logs: /var/log/grafana
-    plugins: /var/lib/grafana/plugins
-    provisioning: /etc/grafana/provisioning
+  wal: true
+  default_theme: dark
+  unified_alerting:
+    enabled: false
   analytics:
-    check_for_updates: true
-  log:
-    mode: console
-  grafana_net:
-    url: https://grafana.net
-## grafana Authentication can be enabled with the following values on grafana.ini
- # server:
-      # The full public facing url you use in browser, used for redirects and emails
- #    root_url:
- # https://grafana.com/docs/grafana/latest/auth/github/#enable-github-in-grafana
- # auth.github:
- #    enabled: false
- #    allow_sign_up: false
- #    scopes: user:email,read:org
- #    auth_url: https://github.com/login/oauth/authorize
- #    token_url: https://github.com/login/oauth/access_token
- #    api_url: https://api.github.com/user
- #    team_ids:
- #    allowed_organizations:
- #    client_id:
- #    client_secret:
-## LDAP Authentication can be enabled with the following values on grafana.ini
-## NOTE: Grafana will fail to start if the value for ldap.toml is invalid
-  # auth.ldap:
-  #   enabled: true
-  #   allow_sign_up: true
-  #   config_file: /etc/grafana/ldap.toml
-
-## Grafana's LDAP configuration
-## Templated by the template in _helpers.tpl
-## NOTE: To enable the grafana.ini must be configured with auth.ldap.enabled
-## ref: http://docs.grafana.org/installation/configuration/#auth-ldap
-## ref: http://docs.grafana.org/installation/ldap/#configuration
-ldap:
-  enabled: false
-  # `existingSecret` is a reference to an existing secret containing the ldap configuration
-  # for Grafana in a key `ldap-toml`.
-  existingSecret: ""
-  # `config` is the content of `ldap.toml` that will be stored in the created secret
-  config: ""
-  # config: |-
-  #   verbose_logging = true
-
-  #   [[servers]]
-  #   host = "my-ldap-server"
-  #   port = 636
-  #   use_ssl = true
-  #   start_tls = false
-  #   ssl_skip_verify = false
-  #   bind_dn = "uid=%s,ou=users,dc=myorg,dc=com"
-
-## Grafana's SMTP configuration
-## NOTE: To enable, grafana.ini must be configured with smtp.enabled
-## ref: http://docs.grafana.org/installation/configuration/#smtp
-smtp:
-  # `existingSecret` is a reference to an existing secret containing the smtp configuration
-  # for Grafana.
-  existingSecret: ""
-  userKey: "user"
-  passwordKey: "password"
-
-## Sidecars that collect the configmaps with specified label and stores the included files them into the respective folders
-## Requires at least Grafana 5 to work and can't be used together with parameters dashboardProviders, datasources and dashboards
-sidecar:
-  image:
-    repository: quay.io/kiwigrid/k8s-sidecar
-    tag: 1.15.6
-    sha: ""
-  imagePullPolicy: IfNotPresent
-  resources: {}
-#   limits:
-#     cpu: 100m
-#     memory: 100Mi
-#   requests:
-#     cpu: 50m
-#     memory: 50Mi
-  securityContext: {}
-  # skipTlsVerify Set to true to skip tls verification for kube api calls
-  # skipTlsVerify: true
-  enableUniqueFilenames: false
-  readinessProbe: {}
-  livenessProbe: {}
-  dashboards:
-    enabled: false
-    SCProvider: true
-    # label that the configmaps with dashboards are marked with
-    label: grafana_dashboard
-    # value of label that the configmaps with dashboards are set to
-    labelValue: null
-    # folder in the pod that should hold the collected dashboards (unless `defaultFolderName` is set)
-    folder: /tmp/dashboards
-    # The default folder name, it will create a subfolder under the `folder` and put dashboards in there instead
-    defaultFolderName: null
-    # Namespaces list. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
-    # Otherwise the namespace in which the sidecar is running will be used.
-    # It's also possible to specify ALL to search in all namespaces.
-    searchNamespace: null
-    # Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
-    watchMethod: WATCH
-    # search in configmap, secret or both
-    resource: both
-    # If specified, the sidecar will look for annotation with this name to create folder and put graph here.
-    # You can use this parameter together with `provider.foldersFromFilesStructure`to annotate configmaps and create folder structure.
-    folderAnnotation: null
-    # Absolute path to shell script to execute after a configmap got reloaded
-    script: null
-    # watchServerTimeout: request to the server, asking it to cleanly close the connection after that.
-    # defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S
-    # watchServerTimeout: 3600
-    #
-    # watchClientTimeout: is a client-side timeout, configuring your local socket.
-    # If you have a network outage dropping all packets with no RST/FIN,
-    # this is how long your client waits before realizing & dropping the connection.
-    # defaults to 66sec (sic!)
-    # watchClientTimeout: 60
-    #
-    # provider configuration that lets grafana manage the dashboards
-    provider:
-      # name of the provider, should be unique
-      name: sidecarProvider
-      # orgid as configured in grafana
-      orgid: 1
-      # folder in which the dashboards should be imported in grafana
-      folder: ''
-      # type of the provider
-      type: file
-      # disableDelete to activate a import-only behaviour
-      disableDelete: false
-      # allow updating provisioned dashboards from the UI
-      allowUiUpdates: false
-      # allow Grafana to replicate dashboard structure from filesystem
-      foldersFromFilesStructure: false
-    # Additional dashboard sidecar volume mounts
-    extraMounts: []
-    # Sets the size limit of the dashboard sidecar emptyDir volume
-    sizeLimit: {}
-  datasources:
-    enabled: false
-    # label that the configmaps with datasources are marked with
-    label: grafana_datasource
-    # value of label that the configmaps with datasources are set to
-    labelValue: null
-    # If specified, the sidecar will search for datasource config-maps inside this namespace.
-    # Otherwise the namespace in which the sidecar is running will be used.
-    # It's also possible to specify ALL to search in all namespaces
-    searchNamespace: null
-    # Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
-    watchMethod: WATCH
-    # search in configmap, secret or both
-    resource: both
-    # Endpoint to send request to reload datasources
-    reloadURL: "http://localhost:3000/api/admin/provisioning/datasources/reload"
-    skipReload: false
-    # Deploy the datasource sidecar as an initContainer in addition to a container.
-    # This is needed if skipReload is true, to load any datasources defined at startup time.
-    initDatasources: false
-    # Sets the size limit of the datasource sidecar emptyDir volume
-    sizeLimit: {}
-  plugins:
-    enabled: false
-    # label that the configmaps with plugins are marked with
-    label: grafana_plugin
-    # value of label that the configmaps with plugins are set to
-    labelValue: null
-    # If specified, the sidecar will search for plugin config-maps inside this namespace.
-    # Otherwise the namespace in which the sidecar is running will be used.
-    # It's also possible to specify ALL to search in all namespaces
-    searchNamespace: null
-    # Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
-    watchMethod: WATCH
-    # search in configmap, secret or both
-    resource: both
-    # Endpoint to send request to reload plugins
-    reloadURL: "http://localhost:3000/api/admin/provisioning/plugins/reload"
-    skipReload: false
-    # Deploy the datasource sidecar as an initContainer in addition to a container.
-    # This is needed if skipReload is true, to load any plugins defined at startup time.
-    initPlugins: false
-    # Sets the size limit of the plugin sidecar emptyDir volume
-    sizeLimit: {}
-  notifiers:
-    enabled: false
-    # label that the configmaps with notifiers are marked with
-    label: grafana_notifier
-    # If specified, the sidecar will search for notifier config-maps inside this namespace.
-    # Otherwise the namespace in which the sidecar is running will be used.
-    # It's also possible to specify ALL to search in all namespaces
-    searchNamespace: null
-    # search in configmap, secret or both
-    resource: both
-    # Sets the size limit of the notifier sidecar emptyDir volume
-    sizeLimit: {}
-
-## Override the deployment namespace
-##
-namespaceOverride: ""
-
-## Number of old ReplicaSets to retain
-##
-revisionHistoryLimit: 10
-
-## Add a seperate remote image renderer deployment/service
-imageRenderer:
-  # Enable the image-renderer deployment & service
-  enabled: false
-  replicas: 1
-  image:
-    # image-renderer Image repository
-    repository: grafana/grafana-image-renderer
-    # image-renderer Image tag
-    tag: latest
-    # image-renderer Image sha (optional)
-    sha: ""
-    # image-renderer ImagePullPolicy
-    pullPolicy: Always
-  # extra environment variables
-  env:
-    HTTP_HOST: "0.0.0.0"
-    # RENDERING_ARGS: --no-sandbox,--disable-gpu,--window-size=1280x758
-    # RENDERING_MODE: clustered
-    # IGNORE_HTTPS_ERRORS: true
-  # image-renderer deployment serviceAccount
-  serviceAccountName: ""
-  # image-renderer deployment securityContext
-  securityContext: {}
-  # image-renderer deployment Host Aliases
-  hostAliases: []
-  # image-renderer deployment priority class
-  priorityClassName: ''
-  service:
-    # Enable the image-renderer service
+    check_for_updates: false
+  server:
+    domain: grafana.kluster.moll.re
+    root_url: https://grafana.kluster.moll.re
+  auth.generic_oauth:
+    name: Authelia
     enabled: true
-    # image-renderer service port name
-    portName: 'http'
-    # image-renderer service port used by both service and deployment
-    port: 8081
-    targetPort: 8081
-  # If https is enabled in Grafana, this needs to be set as 'https' to correctly configure the callback used in Grafana
-  grafanaProtocol: http
-  # In case a sub_path is used this needs to be added to the image renderer callback
-  grafanaSubPath: ""
-  # name of the image-renderer port on the pod
-  podPortName: http
-  # number of image-renderer replica sets to keep
-  revisionHistoryLimit: 10
-  networkPolicy:
-    # Enable a NetworkPolicy to limit inbound traffic to only the created grafana pods
-    limitIngress: true
-    # Enable a NetworkPolicy to limit outbound traffic to only the created grafana pods
-    limitEgress: false
-  resources: {}
-#   limits:
-#     cpu: 100m
-#     memory: 100Mi
-#   requests:
-#     cpu: 50m
-#     memory: 50Mi
-  ## Node labels for pod assignment
-  ## ref: https://kubernetes.io/docs/user-guide/node-selection/
-  #
-  nodeSelector: {}
-
-  ## Tolerations for pod assignment
-  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-  ##
-  tolerations: []
-
-  ## Affinity for pod assignment (evaluated as template)
-  ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-  ##
-  affinity: {}
-
-# Create a dynamic manifests via values:
-extraObjects: []
-  # - apiVersion: "kubernetes-client.io/v1"
-  #   kind: ExternalSecret
-  #   metadata:
-  #     name: grafana-secrets
-  #   spec:
-  #     backendType: gcpSecretsManager
-  #     data:
-  #       - key: grafana-admin-password
-  #         name: adminPassword
-
+    allow_sign_up: true
+    client_id: grafana
+    client_secret: ${AUTH_GRAFANA_CLIENT_SECRET}
+    scopes: openid profile email groups
+    auth_url: https://auth.kluster.moll.re/api/oidc/authorization
+    token_url: https://auth.kluster.moll.re/api/oidc/token
+    api_url: https://auth.kluster.moll.re/api/oidc/authorization/userinfo
+    tls_skip_verify_insecure: true
+    auto_login: true
+    use_pkce: true

apps/monitoring/influxdb-telegraf.values.yaml

@@ -1,157 +0,0 @@
-## Default values.yaml for Telegraf
-## This is a YAML-formatted file.
-## ref: https://hub.docker.com/r/library/telegraf/tags/
-
-image:
-  repo: "telegraf"
-  tag: "1.22"
-  pullPolicy: IfNotPresent
-
-## Configure resource requests and limits
-## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-resources:
-  requests:
-    memory: 256Mi
-    cpu: 0.1
-  limits:
-    memory: 1Gi
-    cpu: 1
-
-## Pod annotations
-podAnnotations: {}
-
-## Pod labels
-podLabels: {}
-
-## Configure args passed to Telegraf containers
-args: []
-
-## The name of a secret in the same kubernetes namespace which contains values to
-## be added to the environment (must be manually created)
-## This can be useful for auth tokens, etc.
-# envFromSecret: "telegraf-tokens"
-
-## Environment
-env:
-  # This pulls HOSTNAME from the node, not the pod.
-  - name: HOSTNAME
-    valueFrom:
-      fieldRef:
-        fieldPath: spec.nodeName
-  # In test clusters where hostnames are resolved in /etc/hosts on each node,
-  # the HOSTNAME is not resolvable from inside containers
-  # So inject the host IP as well
-  - name: HOSTIP
-    valueFrom:
-      fieldRef:
-        fieldPath: status.hostIP
-  # Mount the host filesystem and set the appropriate env variables.
-  # ref: https://github.com/influxdata/telegraf/blob/master/docs/FAQ.md
-  # HOST_PROC is required by the cpu, disk, diskio, kernel and processes input plugins
-  - name: "HOST_PROC"
-    value: "/hostfs/proc"
-  # HOST_SYS is required by the diskio plugin
-  - name: "HOST_SYS"
-    value: "/hostfs/sys"
-  - name: "HOST_MOUNT_PREFIX"
-    value: "/hostfs"
-
-## Add custom volumes and mounts
-# volumes:
-# - name: telegraf-output-influxdb2
-#   configMap:
-#     name: "telegraf-output-influxdb2"
-# mountPoints:
-# - name: telegraf-output-influxdb2
-#   mountPath: /etc/telegraf/conf.d
-#   subPath: influxdb2.conf
-
-## Tolerations for pod assignment
-## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-##
-tolerations: []
-
-## If the DaemonSet should run on the host's network namespace
-## hostNetwork: true
-
-## If using hostNetwork=true, set dnsPolicy to ClusterFirstWithHostNet
-## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#
-## dnsPolicy: ClusterFirstWithHostNet
-
-## If using dnsPolicy=None, set dnsConfig
-## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
-## dnsConfig:
-##   nameservers:
-##     - 1.2.3.4
-##   searches:
-##     - ns1.svc.cluster-domain.example
-##     - my.dns.search.suffix
-##   options:
-##     - name: ndots
-##       value: "2"
-##     - name: edns0
-
-rbac:
-  # Specifies whether RBAC resources should be created
-  create: true
-
-serviceAccount:
-  # Specifies whether a ServiceAccount should be created
-  create: true
-  # The name of the ServiceAccount to use.
-  # If not set and create is true, a name is generated using the fullname template
-  # name:
-  # Annotations for the ServiceAccount
-  annotations: {}
-
-## Specify priorityClassName
-## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
-# priorityClassName: system-node-critical
-
-# Specify the pod's SecurityContext, including the OS user and group to run the pod
-podSecurityContext: {}
-
-override_config:
-  toml: ~
-  # Provide a literal TOML config
-  # toml: |+
-  #   [global_tags]
-  #     foo = "bar"
-  #   [agent]
-  #     interval = "10s"
-  #   [[inputs.mem]]
-  #   [[outputs.influxdb_v2]]
-  #     urls           = ["https://us-west-2-1.aws.cloud2.influxdata.com"]
-  #     bucket         = "data"
-  #     organization   = "OurCompany"
-  #     token          = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-
-## Exposed telegraf configuration
-## ref: https://docs.influxdata.com/telegraf/v1.13/administration/configuration/
-config:
-  # global_tags:
-  #   cluster: "mycluster"
-  agent:
-    interval: "10s"
-    round_interval: true
-    metric_batch_size: 1000
-    metric_buffer_limit: 10000
-    collection_jitter: "0s"
-    flush_interval: "10s"
-    flush_jitter: "0s"
-    precision: ""
-    debug: false
-    quiet: false
-    logfile: ""
-    hostname: "$HOSTNAME"
-    omit_hostname: false
-  outputs:
-    - influxdb_v2:
-        urls:
-          - "http://influxdb-influxdb2.monitoring:80"
-        token: N_jNm1hZTfyhJneTJj2G357mQ7EJdNzdvebjSJX6JkbyaXNup_IAqeYowblMgV8EjLypNvauTl27ewJvI_rbqQ==
-        organization: "influxdata"
-        bucket: "kluster"
-  monitor_self: false
-  docker_endpoint: "unix:///run/k3s/containerd/containerd.sock"
-

apps/monitoring/influxdb.pvc.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: influxdb-nfs
-  labels:
-    directory: influxdb
-spec:
-  # storageClassName: slow
-  capacity:
-    storage: "10Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /export/kluster/influxdb
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: influxdb-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "10Gi"
-  selector:
-    matchLabels:
-      directory: influxdb

apps/monitoring/influxdb.values.yaml

@@ -1,195 +0,0 @@
-image:
-  repository: influxdb
-  tag: 2.3.0-alpine
-  pullPolicy: IfNotPresent
-
-## Annotations to be added to InfluxDB pods
-##
-podAnnotations: {}
-
-## Labels to be added to InfluxDB pods
-##
-podLabels: {}
-
-nameOverride: ""
-fullnameOverride: ""
-
-## Configure resource requests and limits
-## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-##
-resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #  cpu: 100m
-  #  memory: 128Mi
-  # requests:
-  #  cpu: 100m
-  #  memory: 128Mi
-
-## Node labels for pod assignment
-## ref: https://kubernetes.io/docs/user-guide/node-selection/
-##
-nodeSelector: {}
-
-## Tolerations for pod assignment
-## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-##
-tolerations: []
-
-## Affinity for pod assignment
-## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-##
-affinity: {}
-
-securityContext: {}
-
-## Customize liveness, readiness and startup probes
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
-##
-livenessProbe: {}
-  # path: "/health"
-  # scheme: "HTTP"
-  # initialDelaySeconds: 0
-  # periodSeconds: 10
-  # timeoutSeconds: 1
-  # failureThreshold: 3
-
-readinessProbe: {}
-  # path: "/health"
-  # scheme: "HTTP"
-  # initialDelaySeconds: 0
-  # periodSeconds: 10
-  # timeoutSeconds: 1
-  # successThreshold: 1
-  # failureThreshold: 3
-
-startupProbe:
-  enabled: false
-  # path: "/health"
-  # scheme: "HTTP"
-  # initialDelaySeconds: 30
-  # periodSeconds: 5
-  # timeoutSeconds: 1
-  # failureThreshold: 6
-
-## Extra environment variables to configure influxdb
-## e.g.
-# env:
-#   - name: FOO
-#     value: BAR
-#   - name: BAZ
-#     valueFrom:
-#       secretKeyRef:
-#         name: my-secret
-#         key: my-key
-env: {}
-
-## Create default user through docker entrypoint
-## Defaults indicated below
-##
-adminUser:
-  organization: "influxdata"
-  bucket: "default"
-  user: "admin"
-  retention_policy: "0s"
-  ## Leave empty to generate a random password and token.
-  ## Or fill any of these values to use fixed values.
-  password: ""
-  token: ""
-
-  ## The password and token are obtained from an existing secret. The expected
-  ## keys are `admin-password` and `admin-token`.
-  ## If set, the password and token values above are ignored.
-  # existingSecret: influxdb-auth
-
-## Persist data to a persistent volume
-##
-persistence:
-  enabled: true
-  ## If true will use an existing PVC instead of creating one
-  useExisting: true
-  ## Name of existing PVC to be used in the influx deployment
-  name: influxdb-nfs
-  ## influxdb data Persistent Volume Storage Class
-  ## If defined, storageClassName: <storageClass>
-  ## If set to "-", storageClassName: "", which disables dynamic provisioning
-  ## If undefined (the default) or set to null, no storageClassName spec is
-  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
-  ##   GKE, AWS & OpenStack)
-  ##
-  # storageClass: "-"
-  accessMode: ReadWriteOnce
-  size: 10Gi
-  mountPath: /var/lib/influxdb2
-  subPath: ""
-
-## Add custom volume and volumeMounts
-##
-# volumes:
-#   - name: influxdb2-templates
-#     hostPath:
-#       path: /data/influxdb2-templates
-#       type: Directory
-# mountPoints:
-#   - name: influxdb2-templates
-#     mountPath: /influxdb2-templates
-#     readOnly: true
-
-## Allow executing custom init scripts
-## If the container finds any files with the .sh extension inside of the
-## /docker-entrypoint-initdb.d folder, it will execute them.
-## When multiple scripts are present, they will be executed in lexical sort order by name.
-## For more details see Custom Initialization Scripts in https://hub.docker.com/_/influxdb
-initScripts:
-  enabled: false
-  scripts:
-    init.sh: |+
-      #!/bin/bash
-      influx apply --force yes -u https://raw.githubusercontent.com/influxdata/community-templates/master/influxdb2_operational_monitoring/influxdb2_operational_monitoring.yml
-
-## Specify a service type
-## ref: http://kubernetes.io/docs/user-guide/services/
-##
-service:
-  type: LoadBalancer
-  loadBalancerIP: 192.168.3.4
-  port: 80
-  targetPort: 8086
-  annotations: {}
-  labels: {}
-  portName: http
-
-serviceAccount:
-  # Specifies whether a ServiceAccount should be created
-  create: true
-  # The name of the ServiceAccount to use.
-  # If not set and create is true, a name is generated using the fullname template
-  name:
-  # Annotations for the ServiceAccount
-  annotations: {}
-
-ingress:
-  enabled: false
-  # For Kubernetes >= 1.18 you should specify the ingress-controller via the field ingressClassName
-  # See https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/#specifying-the-class-of-an-ingress
-  # className: nginx
-  tls: false
-  # secretName: my-tls-cert # only needed if tls above is true or default certificate is not configured for Nginx
-  hostname: influxdb.foobar.com
-  annotations: {}
-    # kubernetes.io/ingress.class: "nginx"
-    # kubernetes.io/tls-acme: "true"
-  path: /
-
-## Pod disruption budget configuration
-##
-pdb:
-  ## Specifies whether a Pod disruption budget should be created
-  ##
-  create: true
-  minAvailable: 1
-  # maxUnavailable: 1
-

apps/monitoring/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: monitoring
+
+resources: 
+  - namespace.yaml
+  - grafana.ingress.yaml
+  - grafana-admin.sealedsecret.yaml
+  - grafana-auth.sealedsecret.yaml
+  # grafana dashboards are provisioned from a git repository
+  # in the initial bootstrap of the app of apps, the git repo won't be available, so this sync will initially fail
+  - https://git.kluster.moll.re/remoll/grafana-dashboards//?timeout=10&ref=main
+
+
+helmCharts:
+  - releaseName: grafana
+    name: grafana
+    repo: https://grafana.github.io/helm-charts
+    version: 8.5.4
+    valuesFile: grafana.values.yaml

apps/monitoring/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/monitoring/telegraf-adguard.values.yaml

@@ -1,167 +0,0 @@
-## Default values.yaml for Telegraf
-## This is a YAML-formatted file.
-## ref: https://hub.docker.com/r/library/telegraf/tags/
-
-replicaCount: 1
-image:
-  repo: "telegraf"
-  tag: "1.25"
-  pullPolicy: IfNotPresent
-podAnnotations: {}
-podLabels: {}
-imagePullSecrets: []
-## Configure args passed to Telegraf containers
-args: []
-# The name of a secret in the same kubernetes namespace which contains values to
-# be added to the environment (must be manually created)
-# This can be useful for auth tokens, etc.
-
-# envFromSecret: "telegraf-tokens"
-env:
-  - name: HOSTNAME
-    value: "telegraf-polling-service"
-# An older "volumeMounts" key was previously added which will likely
-# NOT WORK as you expect. Please use this newer configuration.
-
-# volumes:
-# - name: telegraf-output-influxdb2
-#   configMap:
-#     name: "telegraf-output-influxdb2"
-# mountPoints:
-# - name: telegraf-output-influxdb2
-#   mountPath: /etc/telegraf/conf.d
-#   subPath: influxdb2.conf
-
-## Configure resource requests and limits
-## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-resources: {}
-# requests:
-#   memory: 128Mi
-#   cpu: 100m
-# limits:
-#   memory: 128Mi
-#   cpu: 100m
-
-## Node labels for pod assignment
-## ref: https://kubernetes.io/docs/user-guide/node-selection/
-nodeSelector: {}
-## Affinity for pod assignment
-## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-##
-affinity: {}
-## Tolerations for pod assignment
-## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-##
-tolerations: []
-# - key: "key"
-#   operator: "Equal|Exists"
-#   value: "value"
-#   effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
-
-service:
-  enabled: false
-  type: ClusterIP
-  annotations: {}
-rbac:
-  # Specifies whether RBAC resources should be created
-  create: true
-  # Create only for the release namespace or cluster wide (Role vs ClusterRole)
-  clusterWide: false
-  # Rules for the created rule
-  rules: []
-# When using the prometheus input to scrape all pods you need extra rules set to the ClusterRole to be
-# able to scan the pods for scraping labels. The following rules have been taken from:
-# https://github.com/helm/charts/blob/master/stable/prometheus/templates/server-clusterrole.yaml#L8-L46
-#    - apiGroups:
-#        - ""
-#      resources:
-#        - nodes
-#        - nodes/proxy
-#        - nodes/metrics
-#        - services
-#        - endpoints
-#        - pods
-#        - ingresses
-#        - configmaps
-#      verbs:
-#        - get
-#        - list
-#        - watch
-#    - apiGroups:
-#        - "extensions"
-#      resources:
-#        - ingresses/status
-#        - ingresses
-#      verbs:
-#        - get
-#        - list
-#        - watch
-#    - nonResourceURLs:
-#        - "/metrics"
-#      verbs:
-#        - get
-
-serviceAccount:
-  # Specifies whether a ServiceAccount should be created
-  create: false
-## Exposed telegraf configuration
-## For full list of possible values see `/docs/all-config-values.yaml` and `/docs/all-config-values.toml`
-## ref: https://docs.influxdata.com/telegraf/v1.1/administration/configuration/
-config:
-  agent:
-    interval: "2m"
-    round_interval: true
-    metric_batch_size: 1000
-    metric_buffer_limit: 10000
-    collection_jitter: "0s"
-    flush_interval: "10s"
-    flush_jitter: "0s"
-    precision: ""
-    debug: false
-    quiet: false
-    logfile: ""
-    hostname: "$HOSTNAME"
-    omit_hostname: false
-  processors:
-    - enum:
-        mapping:
-          field: "status"
-          dest: "status_code"
-          value_mappings:
-            healthy: 1
-            problem: 2
-            critical: 3
-  outputs:
-    - influxdb_v2:
-        urls:
-          - "http://influxdb-influxdb2.monitoring:80"
-        token: We64mk4L4bqYCL77x3fAUSYfOse9Kktyf2eBLyrryG9c3-y8PQFiKPIh9EvSWuq78QSQz6hUcsm7XSFR2Zj1MA==
-        organization: "influxdata"
-        bucket: "homeassistant"
-  inputs:
-    - http:
-        urls:
-          - "http://adguard-home.adguard:3000/control/stats"
-        data_format: "json"
-metrics:
-  health:
-    enabled: false
-    service_address: "http://:8888"
-    threshold: 5000.0
-  internal:
-    enabled: true
-    collect_memstats: false
-# Lifecycle hooks
-# hooks:
-#   postStart: ["/bin/sh", "-c", "echo Telegraf started"]
-#   preStop: ["/bin/sh", "-c", "sleep 60"]
-
-## Pod disruption budget configuration
-##
-pdb:
-  ## Specifies whether a Pod disruption budget should be created
-  ##
-  create: true
-  minAvailable: 1
-  # maxUnavailable: 1
-

apps/monitoring/telegraf-speedtest.values.yaml

@@ -1,110 +0,0 @@
-## Default values.yaml for Telegraf
-## This is a YAML-formatted file.
-## ref: https://hub.docker.com/r/library/telegraf/tags/
-
-replicaCount: 1
-image:
-  repo: "telegraf"
-  tag: "1.25"
-  pullPolicy: IfNotPresent
-podAnnotations: {}
-podLabels: {}
-imagePullSecrets: []
-## Configure args passed to Telegraf containers
-args: []
-# The name of a secret in the same kubernetes namespace which contains values to
-# be added to the environment (must be manually created)
-# This can be useful for auth tokens, etc.
-
-# envFromSecret: "telegraf-tokens"
-env:
-  - name: HOSTNAME
-    value: "telegraf-speedtest"
-
-## Configure resource requests and limits
-## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-resources: {}
-# requests:
-#   memory: 128Mi
-#   cpu: 100m
-# limits:
-#   memory: 128Mi
-#   cpu: 100m
-
-## Node labels for pod assignment
-## ref: https://kubernetes.io/docs/user-guide/node-selection/
-nodeSelector: {}
-## Affinity for pod assignment
-## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-##
-affinity: {}
-## Tolerations for pod assignment
-## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-##
-tolerations: []
-# - key: "key"
-#   operator: "Equal|Exists"
-#   value: "value"
-#   effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
-service:
-  enabled: false
-rbac:
-  # Specifies whether RBAC resources should be created
-  create: false
-
-serviceAccount:
-  # Specifies whether a ServiceAccount should be created
-  create: false
-
-
-## Exposed telegraf configuration
-## For full list of possible values see `/docs/all-config-values.yaml` and `/docs/all-config-values.toml`
-## ref: https://docs.influxdata.com/telegraf/v1.1/administration/configuration/
-config:
-  agent:
-    interval: "2h"
-    round_interval: true
-    metric_batch_size: 1000
-    metric_buffer_limit: 10000
-    collection_jitter: "0s"
-    flush_interval: "10s"
-    flush_jitter: "0s"
-    precision: ""
-    debug: false
-    quiet: false
-    logfile: ""
-    hostname: "$HOSTNAME"
-    omit_hostname: false
-  processors:
-    - enum:
-        mapping:
-          field: "status"
-          dest: "status_code"
-          value_mappings:
-            healthy: 1
-            problem: 2
-            critical: 3
-  outputs:
-    - influxdb_v2:
-        urls:
-          - "http://influxdb-influxdb2.monitoring:80"
-        token: We64mk4L4bqYCL77x3fAUSYfOse9Kktyf2eBLyrryG9c3-y8PQFiKPIh9EvSWuq78QSQz6hUcsm7XSFR2Zj1MA==
-        organization: "influxdata"
-        bucket: "homeassistant"
-  inputs:
-    - internet_speed:
-        enable_file_download: false
-
-# Lifecycle hooks
-# hooks:
-#   postStart: ["/bin/sh", "-c", "echo Telegraf started"]
-#   preStop: ["/bin/sh", "-c", "sleep 60"]
-
-## Pod disruption budget configuration
-##
-pdb:
-  ## Specifies whether a Pod disruption budget should be created
-  ##
-  create: true
-  minAvailable: 1
-  # maxUnavailable: 1

apps/nextcloud/ingress.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  namespace: nextcloud
-  name: nextcloud-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`nextcloud.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: nextcloud
-      port: 8080
-  tls:
-    certResolver: default-tls 

apps/nextcloud/pvc.yaml

@@ -1,29 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  namespace: nextcloud
-  name: nextcloud-nfs
-spec:
-  # storageClassName: fast
-  capacity:
-    storage: "150Gi"
-  # volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce
-  nfs:
-    path: /kluster/nextcloud
-    server: 192.168.1.157
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: nextcloud
-  name: nextcloud-nfs
-spec:
-  storageClassName: ""
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: "150Gi"
-  volumeName: nextcloud-nfs

apps/nextcloud/values.yaml

@@ -1,294 +0,0 @@
-## Official nextcloud image version
-## ref: https://hub.docker.com/r/library/nextcloud/tags/
-##
-image:
-  repository: nextcloud
-  tag: "27" # needs to be a string because of the template
-  pullPolicy: IfNotPresent
-
-nameOverride: ""
-fullnameOverride: ""
-podAnnotations: {}
-deploymentAnnotations: {}
-
-# Number of replicas to be deployed
-replicaCount: 1
-
-## Allowing use of ingress controllers
-## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
-##
-ingress:
-  enabled: false
-
-
-# Allow configuration of lifecycle hooks
-# ref: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
-lifecycle: {}
-  # postStartCommand: []
-  # preStopCommand: []
-
-nextcloud:
-  host: nextcloud.kluster.moll.re
-  username: admin
-  password: changeme
-  ## Use an existing secret
-  existingSecret:
-    enabled: false
-  update: 0
-  # If web server is not binding default port, you can define it
-  # containerPort: 8080
-  datadir: /var/www/html/data
-  persistence:
-    subPath:
-  mail:
-    enabled: false
-  # PHP Configuration files
-  # Will be injected in /usr/local/etc/php/conf.d for apache image and in /usr/local/etc/php-fpm.d when nginx.enabled: true
-  phpConfigs: {}
-  # Default config files
-  # IMPORTANT: Will be used only if you put extra configs, otherwise default will come from nextcloud itself
-  # Default confgurations can be found here: https://github.com/nextcloud/docker/tree/master/16.0/apache/config
-  defaultConfigs:
-    # To protect /var/www/html/config
-    .htaccess: true
-    # Redis default configuration
-    redis.config.php: true
-    # Apache configuration for rewrite urls
-    apache-pretty-urls.config.php: true
-    # Define APCu as local cache
-    apcu.config.php: true
-    # Apps directory configs
-    apps.config.php: true
-    # Used for auto configure database
-    autoconfig.php: true
-    # SMTP default configuration
-    smtp.config.php: true
-  # Extra config files created in /var/www/html/config/
-  # ref: https://docs.nextcloud.com/server/15/admin_manual/configuration_server/config_sample_php_parameters.html#multiple-config-php-file
-  configs: {}
-
-  # For example, to use S3 as primary storage
-  # ref: https://docs.nextcloud.com/server/13/admin_manual/configuration_files/primary_storage.html#simple-storage-service-s3
-  #
-  #  configs:
-  #    s3.config.php: |-
-  #      <?php
-  #      $CONFIG = array (
-  #        'objectstore' => array(
-  #          'class' => '\\OC\\Files\\ObjectStore\\S3',
-  #          'arguments' => array(
-  #            'bucket'     => 'my-bucket',
-  #            'autocreate' => true,
-  #            'key'        => 'xxx',
-  #            'secret'     => 'xxx',
-  #            'region'     => 'us-east-1',
-  #            'use_ssl'    => true
-  #          )
-  #        )
-  #      );
-
-  ## Strategy used to replace old pods
-  ## IMPORTANT: use with care, it is suggested to leave as that for upgrade purposes
-  ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
-  strategy:
-    type: Recreate
-    # type: RollingUpdate
-    # rollingUpdate:
-    #   maxSurge: 1
-    #   maxUnavailable: 0
-
-  ##
-  ## Extra environment variables
-  extraEnv:
-  #  - name: SOME_SECRET_ENV
-  #    valueFrom:
-  #      secretKeyRef:
-  #        name: nextcloud
-  #        key: secret_key
-
-  # Extra mounts for the pods. Example shown is for connecting a legacy NFS volume
-  # to NextCloud pods in Kubernetes. This can then be configured in External Storage
-  extraVolumes:
-  #  - name: nfs
-  #    nfs:
-  #      server: "10.0.0.1"
-  #      path: "/nextcloud_data"
-  #      readOnly: false
-  extraVolumeMounts:
-  #  - name: nfs
-  #    mountPath: "/legacy_data"
-
-  # Extra secuurityContext parameters. For example you may need to define runAsNonRoot directive
-  # extraSecurityContext:
-  #   runAsUser: "33"
-  #   runAsGroup: "33"
-  #   runAsNonRoot: true
-  #   readOnlyRootFilesystem: true
-
-nginx:
-  ## You need to set an fpm version of the image for nextcloud if you want to use nginx!
-  enabled: false
-  resources: {}
-
-internalDatabase:
-  enabled: true
-  name: nextcloud
-
-##
-## External database configuration
-##
-externalDatabase:
-  enabled: true
-
-  ## Supported database engines: mysql or postgresql
-  type: postgresql
-
-  ## Database host
-  host: postgres-postgresql.postgres
-
-  ## Database user
-  user: nextcloud
-
-  ## Database password
-  password: test
-
-  ## Database name
-  database: nextcloud
-
-  ## Use a existing secret
-  existingSecret:
-    enabled: false
-    # secretName: nameofsecret
-    # usernameKey: username
-    # passwordKey: password
-
-##
-## MariaDB chart configuration
-##
-mariadb:
-  ## Whether to deploy a mariadb server to satisfy the applications database requirements. To use an external database set this to false and configure the externalDatabase parameters
-  enabled: false
-
-postgresql:
-  enabled: false
-##
-## Redis chart configuration
-## for more options see https://github.com/bitnami/charts/tree/master/bitnami/redis
-##
-
-redis:
-  enabled: false
-  auth:
-    enabled: true
-    password: 'changeme'
-
-## Cronjob to execute Nextcloud background tasks
-## ref: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/background_jobs_configuration.html#webcron
-##
-cronjob:
-  enabled: false
-  # Nexcl
-service:
-  type: ClusterIP
-  port: 8080
-  loadBalancerIP: nil
-  nodePort: nil
-
-## Enable persistence using Persistent Volume Claims
-## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
-##
-persistence:
-  # Nextcloud Data (/var/www/html)
-  enabled: true
-  annotations: {}
-  ## nextcloud data Persistent Volume Storage Class
-  ## If defined, storageClassName: <storageClass>
-  ## If set to "-", storageClassName: "", which disables dynamic provisioning
-  ## If undefined (the default) or set to null, no storageClassName spec is
-  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
-  ##   GKE, AWS & OpenStack)
-  ##
-  # storageClass: "-"
-
-  ## A manually managed Persistent Volume and Claim
-  ## Requires persistence.enabled: true
-  ## If defined, PVC must be created manually before volume will be bound
-  existingClaim: nextcloud-nfs
-
-  accessMode: ReadWriteOnce
-  size: 150Gi
-
-  ## Use an additional pvc for the data directory rather than a subpath of the default PVC
-  ## Useful to store data on a different storageClass (e.g. on slower disks)
-  nextcloudData:
-    enabled: false
-    subPath:
-    annotations: {}
-    # storageClass: "-"
-    # existingClaim:
-    accessMode: ReadWriteOnce
-    size: 8Gi
-
-resources:
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  limits:
-   cpu: 2000m
-   memory: 2Gi
-  requests:
-   cpu: 100m
-   memory: 128Mi
-
-## Liveness and readiness probe values
-## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
-##
-livenessProbe:
-  enabled: true
-  initialDelaySeconds: 250
-  periodSeconds: 10
-  timeoutSeconds: 5
-  failureThreshold: 3
-  successThreshold: 1
-readinessProbe:
-  enabled: true
-  initialDelaySeconds: 250
-  periodSeconds: 10
-  timeoutSeconds: 5
-  failureThreshold: 3
-  successThreshold: 1
-startupProbe:
-  enabled: false
-  initialDelaySeconds: 250
-  periodSeconds: 10
-  timeoutSeconds: 5
-  failureThreshold: 30
-  successThreshold: 1
-
-
-## Enable pod autoscaling using HorizontalPodAutoscaler
-## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
-##
-hpa:
-  enabled: false
-
-nodeSelector: {}
-
-tolerations: []
-
-affinity: {}
-
-
-## Prometheus Exporter / Metrics
-##
-metrics:
-  enabled: false
-
-
-rbac:
-  enabled: false
-  serviceaccount:
-    create: true
-    name: nextcloud-serviceaccount
-

apps/ntfy/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
   name: websocket
@@ -9,7 +9,7 @@ spec:
       # enable websockets
       Upgrade: "websocket"
 ---
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
     name: ntfy-ingressroute

apps/ntfy/kustomization.yaml

@@ -9,3 +9,8 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+
+images:
+  - name: binwiederhier/ntfy
+    newName: binwiederhier/ntfy
+    newTag: v2.11.0

apps/paperless/deployment.yaml

@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperless
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paperless
+  template:
+    metadata:
+      labels:
+        app: paperless
+    spec:
+      containers:
+        - name: paperless
+          image: paperless
+          ports:
+            - containerPort: 8000
+          env:
+          - name: PAPERLESS_REDIS
+            value: redis://redis-master:6379
+          - name: PAPERLESS_TIME_ZONE
+            value: Europe/Berlin
+          - name: PAPERLESS_OCR_LANGUAGE
+            value: deu+eng+fra
+          - name: PAPERLESS_URL
+            value: https://paperless.kluster.moll.re
+          - name: PAPERLESS_OCR_USER_ARGS
+            value: '{"invalidate_digital_signatures": true}'
+          - name: PAPERLESS_SECRET_KEY
+            valueFrom:
+              secretKeyRef:
+                name: paperless-secret-key
+                key: key
+          - name: PAPERLESS_DATA_DIR
+            value: /data
+          - name: PAPERLESS_MEDIA_ROOT
+            value: /data
+          - name: PAPERLESS_APPS
+            value: allauth.socialaccount.providers.openid_connect
+          - name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
+            valueFrom:
+              secretKeyRef:
+                name: paperless-oauth
+                key: provider-config
+          # - name: PAPERLESS_DISABLE_REGULAR_LOGIN
+          #   value: "True"
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "200Mi"
+            limits:
+              cpu: "2"
+              memory: "1Gi"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: paperless-data
+

apps/paperless/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: paperless-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`paperless.kluster.moll.re`)
+    kind: Rule
+    services:
+    - name: paperless-web
+      port: 8000
+
+  tls:
+    certResolver: default-tls 

apps/paperless/kustomization.yaml

@@ -0,0 +1,32 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - paperless-secret-key.sealedsecret.yaml
+  - paperless-oauth.sealedsecret.yaml
+
+namespace: paperless
+
+images:
+  - name: paperless
+    newName: ghcr.io/paperless-ngx/paperless-ngx
+    newTag: "2.12.1"
+
+
+helmCharts:
+  - name: redis
+    releaseName: redis
+    repo: https://charts.bitnami.com/bitnami
+    version: 20.1.5
+    valuesInline:
+      auth:
+        enabled: false
+      replica:
+        replicaCount: 0
+      master:
+        persistence:
+          storageClass: "nfs-client"

apps/paperless/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/paperless/paperless-oauth.sealedsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: paperless-oauth
+  namespace: paperless
+spec:
+  encryptedData:
+    provider-config: AgBI9IcNOfBevjUtIMwNTd0MTnr1WGxMKJ0cPnHzAS3cddmI+LTrkxxdRBuz2PFKTrhJ6/vh/2tiI9FBWMVm/YqTB64drbF3v13GfZMk/9c7W4SFyMoMcoE4xe6gs4SOm1ggTVxWT6O8IQ0gt7+FRUFaiLmwa08dxTkzrT0/zfQfYg+0aV8qS0eCJIrQk/IA1N31RpUoNV5Jl6vF7oE+cKIVyZ6LVMdecmFnuUgU+1qTC7ncgxxhWQekDQXJQnfYpgsQTF5GaHkGV8kvqJOa2Ohnk7MIeQEz5WuiKaXzU1ZMCYq3D8q/kaf/itLLBlL5MQh/hkuksCVG13aWxvulA/zIw3rSDujjZcSrD8LWH6oCMCn8zVcZjYQQBcTKUYEyYNvHLsmm0fOFIkUmFfBOS4WdHhjsBudz+941Wuc2EX5i6eLind7dk6gOlCL1HEyvbQRV6W50T104DQSNHslRG9CIjPh0BueGJ5fiaFoQa/UuM/JI8R/7cv3y5VkCG6j4gax9FVFgZKxPMtOTxB3gKolT25JHPDOqbDo996T4lsmiYRrYShni4JFZ8ALhcr7pKwlg+gVbDVaqMrVaSz1xzTP0MNxPMsojXVLtG3/Zv0/iXSVW4DPY67pFITEbZBWB3bHLvL9MiwKbWNwsDwPUylWkXTTFHsNbuRUnAXhRxcLn43uIv98JFTQcMVl2J9qrYkHm7w0FVImUr3oC+Ny/Z6j89ARposNx27B4FBgW7H7+yWMKRsAObC8cAjBOkBdXue0x5bEl7Al2BRRG7/WUKHXZvTOlvlj7GFTpLOQbPYjnBo8V8h42uOjGbiMLaCeN5sWlMtWD+7mpHV3XGdcGtPAZlIzgpUs2si/XIRNun2oDoUmJhb7YcGmugodcAK9+aYBThIkNU3guXdrM6Vc7CO2RP8PFpKBpcI9pUHgYA8dyYY+TaBqfYGrKFlGgoVcgh6oVkeOuctTX90XkojVFfqkCqab93faMh2pGCGcH4IZ81sdTYeWwNIvz1RGoi9GhUhQU5NfDeUBn2eHdOpfdsf4FkWe0kgE6TBPlQx7GQy56FldIc0G4QA8H8utL3E/MXYrao70ek/GHIxuev1/hzljJDk+5HJz5itBtKiW4s/5j2ZMD7MMBu/voDQW14XEK5pM9EbwmC6kRg6ljXvTlnUVmw1s04iUvIzF/dO6bCgaOEwFPjZj8oZs0dt64Ov+ZPLwTrmezFgHtfh4dyiRgHt4cO/WYFmzzYwd532p2De3JqjHUzT0iQIpkaz4jrF7+fdtDxtj7XgkJIg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: paperless-oauth
+      namespace: paperless

apps/paperless/paperless-secret-key.sealedsecret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: paperless-secret-key
+  namespace: paperless
+spec:
+  encryptedData:
+    key: AgAjDxYW+bf+7a+65DR/u5Qrh37JSPQCstUrNWRdxq9We1eGf7qzTnmyke/O5TiE26rHVx3yzyK/Lcp/R+pJUnDauCvL6ja7k82DLzElkoRGhvRg4nr5Iehw488WIdJDXWqAbus4oLFCgnj5axs1B97hEiAN2onCPDsOuk7oSdJfG4mMI47Ass2qFPyQaff9TulLXQQEY5U7LrawCTudUPeiTCYGbOjBadPjEzn5pDwsyAd1G+NrqoPOwkrbNzrwMwbnwB4hLO0f+jrYOh2OMNcdZzMZgM671VH9cRYSVV6uz5iAN4A1NpZ1ZdenQN4pcWvaPmPOcvp14vjZtrYbGeyaNGnob5IycRrO4yaf+0V7DZ4Thwc/vqm6r5y/MR9U4Q9EFoNNHYmfo9VEw7LhivtaDOG8OaZXUnIFoXFLOZ59qfoZdIyK4eByTRQBZFZLK9rVgXOommbqlCgzNuDM7u11OGcYfROJFeiI9pH333x5u7GZsDz0hnAjWKphXzeTglXdaXMsQUeAHusdqKCn0X1cMatGUjkBAXwlOBrqmaDwSRdyc/+J2QIdkyQM9A+88+yoop7q8c5P8oizBikVaL7SojulUTJStH5cv7nRzhmpAY4j15+o3RQKrbEjGB4HVVx3VBFjjOiP9gfjhiYqxznYwkYTpXADPwjhLFf4opOPuhpoUD1M3OKXlQpPK/RvFTWWsh14jbJuL7WJpXbfyYs0+drbVdnYeUsn8OKlnFDoOaACdpNUCr6t9dSFMs7o7Mo8yN0E
+  template:
+    metadata:
+      creationTimestamp: null
+      name: paperless-secret-key
+      namespace: paperless

apps/paperless/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: paperless-data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

apps/paperless/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperless-web
+spec:
+  selector:
+    app: paperless
+  ports:
+  - port: 8000
+    targetPort: 8000

apps/recipes/deployment.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mealie
+spec:
+  selector:
+    matchLabels:
+      app: mealie
+  template:
+    metadata:
+      labels:
+        app: mealie
+    spec:
+      containers:
+      - name: mealie
+        image: mealie
+        resources:
+          limits:
+            memory: "500Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 9000
+        env:
+          - name: TZ
+            value: Europe/Paris
+          - name: BASE_URL
+            value: https://recipes.kluster.moll.re
+          - name: ALLOW_SIGNUP
+            value: "true"
+        envFrom:
+          - secretRef:
+              name: mealie-oauth
+        volumeMounts:
+        - name: mealie-data
+          mountPath: /app/data
+
+      volumes:
+      - name: mealie-data
+        persistentVolumeClaim:
+          claimName: mealie

apps/recipes/ingress.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: mealie-ingressroute
+
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`recipes.kluster.moll.re`)
+      kind: Rule
+      services:
+        - name: mealie-web
+          port: 9000
+  tls:
+    certResolver: default-tls

apps/recipes/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: recipes
+
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - mealie-oauth.sealedsecret.yaml
+  - pvc.yaml
+  - service.yaml
+  - ingress.yaml
+
+images:
+  - name: mealie
+    newTag: v1.12.0
+    newName: ghcr.io/mealie-recipes/mealie

apps/recipes/mealie-oauth.sealedsecret.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: mealie-oauth
+  namespace: recipes
+spec:
+  encryptedData:
+    OIDC_ADMIN_GROUP: AgCTE4M54XEyKP1cHcsosZwIp5GYcvZPIzb7sgOpvVJb7mzKT9kYFOqUkwc1eyn4bjqaXu6SJyP3M4ss3K7CgkNWMsSjBVrYpP6yqsREoWqoETwwecSxRS7hrK8pJb6kRKBKyLDd2oaFMxeg0y1lm9+ul4HwNL+uPcNLSX7KRue1Hy5xqjDNlwL2mzU9JVVZGqEW8FyvPCRKMPliQtK7WpTUbadKbltN9RKrRa4PqFW9xyBrg8Al35Xj7HrNfwt8YAUDeq+73QMLtbP3y2orSck2I46h9DKW4foqYWGnVh/272fvQSXDr3tr8Il969o5M/IfVzpRS74f4zU0LeI4POxT9EgBL2sALoKhxil0EZGJ3dsPREvSS7eccCMY8n0AQE8rOT8AHyRDhd8RzsCoyPoDTAJJWf4oGS4aSH/N7f6CvsMF2EdOSCghBWC7klfRFxraWcbTiFRi5ICxlFL4GkiB9svNWpQlCkiduR9RZTop1DU+xJK2XgBmTampbjlEiS+yf9L7tXpCRvp+vRcxHwlvsMUncIxUzY3CPTST6FrVOL0BMtLeKI+MmgaCxgzo6BBAUKBZSCJbJKLTrcnhviLJnxYXKYPah5ozfk5XBzcz4C7dWuhN6N1Uwa08nDtHbuN9Mj0AWElT3HAqf3naowVBeXgLV6vRNTwYOIVoqGhyVG0O65DpwuxUdFZMUBpmhFz1QTpAZ6cbDZbL
+    OIDC_AUTH_ENABLED: AgAQ48wodtQ11peCbSpBL61n28GMeMJPq6cmb0a39x/n+AJGOZbjcE2e/xdFu06J+ahHTehi2QtwWxlRBi4Op6sbjdn5cXkTZ+8vGB3v/JQZQzJpGraFT1WTPZ9onYXTLl8iGsZSteF3iaxSOMzLswMahDvk/DCNrIY78mkTpqSC3Pggf9GnAWTQKOnuTFYyStBaL9ExyDBiJkbFahm/bC8h7QG9OXD93bDQrApS/W6LF+3CU6TOKj1VXmeVuMpxGdasC4B5ShL9kvBz66i5P7BJYjPfTEJfIACIFzZQmLJwxzfST1kV0urdQ9PZmcvQLapxGI4xUssD275hSPrUE6XXMLyo0BzVEBPq5QsMW5UZB1sOPQMcIajdzWagByFJWcBU1mFMwJXVUHQXlsMDEl1pDTGbSS660XCS1aAtmVb19ToXH/GIEkWlohiNpVqI+D8ypoAwMzF1FnHGvyxF6maHV4vZA4zDE7bT4S+E6dEmXM2cc0essUDlbwgOTLi/3fuqxIar3Dub857H0B9++SeriHrSUJD1A/9IOZQQNsAOwEOylK+9BuyhHYFVzk9l2lKnCRYqif75wusyoly+4yBS69LGzg4mc4Bk6LejZe91VnZLlZB3M6fZzS87qWoSKuEibxJ469KVrCPNc5mn33gfg5nW/05rSYcBnl1VazPmA18sZyX1nWnQUwwErg98jGn7Ft0q
+    OIDC_AUTO_REDIRECT: AgBuLoXhaCs86FfeiagJQg2bnz99Poebydj212AdXpt66Lx1nciFlJMzZ03ahJiF5T8lalxPLSzkHnc5VHBT8yRSrKe1lCisDmXVv9SBBoZHntu9zQdJeChkkHImxILlJVZk4steD2CyIBDj2xjbjUfRjFYJX4F1WrzSDXG4Vf5bal8tPXNuqbHEGfx7xw9CRetMD4cfDESyKl7FgbXi4vyLgGyNTnKTAvY1w72Y7WKminiScj7S39TZZIVH7wJyvvsNEv7MCgwaPeT+W5pNwpx34oqfumTHTeJUwQWccwCnZknhOl9jwNRJ4cHFAsVArT1yvjLCbMir9p1DvP2w0R/A8CzPgDQxbJno1QKeGnw02YVlsYH5KiOKkQQdT6/kT+kk444Mg0JLPbG7XZSUZXGmVl5n31DuDFvTGum5BQOwFzYfOim1MM1OJyFiM7XuaCZCzSMNUQHtLGv3kBHZFhIS5PXqMjfdV/RAv3QhZgAnJzGYLEDawOwy4KwIXTk9b55OX7AyEwQzwMlJUujg/+IJP28BH71tgVtgQsVDnWVT2GtWW+UMamXhqh+YK6VD2BZ/81D/p0BEGq8m/dweP/qv3MK/CGBjgtIFOHnEcNZkqMH4HhrxFeu6fabUpT6+C5cGNyYJSEFpbUqjJRb7vBPIu/ewb8Y43SNikzaSp3/1A2LtkGDyzcRckQYTuFIiIg5r3jcg
+    OIDC_CLIENT_ID: AgBQiUtbuXKJABinO8VfjQ+yIj0a4AEvKboHd544CxYdx1OfZd0DZLsKpkowZS+Wl5QiheC/+8HFqsRzzwKas2i4IyOpihhSW/xd6X7XjDtu2Tjwuol1oRel5AmBpBj6Kl6zTvgLbHE+iUaJi7u5f2Pw0w2vXAJWxg9nhOFVEfTVtKaafYqVVXPB1KTqRPzwR5zsTuIZToEx0BvA95yWM5oKRPnjlSLk1vHMBDPqdgUq+7u+7qhj7C+rvhI7nuTOWRk0NzsELBl3AyAg82w0r+I9H7buU8OHPEhVOID//UIc/wL/QuaJNxeFiU+rM6K0CD6MMGQanuUngaEr/ZpEdxe82hGSuaLik2mWfvG4J4328a1bmmTT/JgPPDQW8Xtg68Tsqj9zT4rfaVt/+TttMMgj4oAFkyVLGZkp1sfgIX5zT7gHc0fCusTR5gGNLJ5PmHyqCu9D2jP1ERLRltiyXH6wms8+aACj+wsmo1OKUjmqrtqtAWNwZz2bmOJhhUgkP1mPz4o2LeECjBPPv9uPWkMb67ZUI4+Qp8o7J0SgQt4ZlRqhg04Rh5MxCY9TvbhLxQD5QqTktmGYWo6cDVnIEIKd/XOSG9pBT6bTGsRLicgRxjDwm/0ZU1Y3stI6UhONKYA1HG8rso8ZfRLvDsgp1Zb8tH/GAw+bl2HkOw1DbyFXWeRxau3RPwTym3GYjFgWZhP5ScOu2Rjg
+    OIDC_CONFIGURATION_URL: AgBiXJGc7WugRqlUE58fVPkkKkka3G39lhajhuR7EQePZ1HdE1D02/XncXgRO0r7C4kPAX3oZ1Uczo0XAMxQxAZye9NNFNei7E4rlc3BTNOOxCc2Uj57DjuqFA74cHcjs0xRCJ1KVMEcGX8zdG85v/qEI9Oru7vQf8YT3giTKNHDZMgeyrbCMFNS0cyXniseMMVIkiX0ky6TfcFdn84bZiqJYwXwnNNzeM/kJe01NvEe3DuvxZTEme8LNkie7CTgaMHfEYeXZWIh+JqkIPW+48uDYe4ojf/Ts9P2jwzf6qW8XyqwlLti0MxoVH6IqbLbJ9JVJZ94WNMm2tcjigD1eSV2klNxXYZefyqqratQpfi7Ou/KXdfs9Reijj7dtfZDOnztVouS7ivBLlufqdxgyJrnQok1MxQloZs602CBPRDE+oSHGh5ean2wbJLqt/Vl9NxcsFZpWI4tazZ0DUhD5pgS4MXoG8D+RXIz4++nfn+XhYhv84vP4VJh6kCF84dKSYDFUKkAMGJSZRDCcs4jaORO/DZLUUnytnOHV8Mo2ypfC9KgETdnbXWT7OcdCQPesABE/l2lN9KDYHxL6DqE3GibmCqE7yk6TOF36pmVeEsECeBkmcl2DpHVu9PRBiwO0YVTGUr9AVmwO3vAR+2LAVHkDmU+jn/e5SFHg2dkEpWDORC7Zn4vZrjy3pmTJdxBthVwTYqmdnWk4uvppyKP2l6MBtaVPqtB35sDuYtLGSFV1FLBJGJueW+Kk2cGbNxJJEEhBUf6ZHCDWLrZEJPN
+    OIDC_GROUPS_CLAIM: AgBjsoq/VaSx/P7PnODa2TIiSy/noUFrVmPuIPAyjoZP/w62zmwTqy8Ln4yRKywmsy+n9CMGgauUzkEU8HSuWJ0Moxzt+NBRpuA3nL5R8b0hMsdQXCvY3L5zqyvPH7hfY1LRVcM5cVyzTR2CTVUNbO04EeGaFt8Mh8tsmyHk+Cf8VidbkeqgEpee8tNO638F4xQGx9aob7H7UVKOou8CdpOvH3zsNFzGmSbwv9qm1sgcTxkZkjt8cGH/c4k30p8szcMFQmUK7dzrZAma5bDPg5BuwspCnRXoGVWLYN02jHYDg/08qLpL/vL+pPpChf0DMB4j2M+s5EDHnbcfT7S7pf2NkHCnWINCJSKLMUIcBSFXXEkbmSrHo1Ft6aHf/i6JHld4CT0dQs5AyK68mCzkZTWoHU6MM8+/3/J3J/TWkSP8HOyBY3gWPOU4hYEQQQlJp3T+mnnua70mo/vMr4CuZFyxLjz872CDwG5WfZkzJxM69s0XRkHEmsXi7VYjn7NThrqhh2lqbiIIJNpAemjruRl49T3gtfstVdxfgp3dfz/H/4FWRy5KY5XDUjGwYBXDCpaEey42CFSiT1w9yXV67emahUwKekvq1vvuz2bWzaTYGtCW77WzCO1cC26hORPAYbZZxgSeDgWmxMIhJF6tVFNSAu11rMjcMUKErujC5cKWb8N4DuF0H4cQv36SESKBdVCOMPzPxDg=
+    OIDC_PROVIDER_NAME: AgBHYuK2JYedcaHwDca/c1RKzq8YgO9cJ0lXPY2+ain+lwFJwZ7oMOPevVOq3RoUHznEYbRxKw0CLE+110NFr16bav4bn4pXRD5CeqQDAWPIxxouu+w2NgWijnqfKnVYrtrprQlfGO9mYsZiEGj/sbftX2Wd73L7oXp/6Ab+28rnxtv3KF46wXo8yfqzOGf+QRQKdT+2pv58zjN3UCGrSANirLHvmY8+a73YiVW8/xuJZN4og3JbPW65FwBpgnvQCaHKFTbPyPIpILx7sKz2yxGzT6Jt2PeSjdwou/fT70tmrwOVucbHJkKUsd/jkI0gzRPLr9Fo5LcALAKQsn70hNQIRgTFgCy4ILurJMBKeYtHkNMdnBwKRh4NlTgJB2vNXq604480ta20Z3E2m3DUxW6XPFTQN9uC5/7IT0e/F4UgQai6HENwAqIPGuOM4eKeouw8pr+RoLMI76Z0B6xWhLRqxrZknzwzOngpaku8w9SeJPkifSFwxxFjacAqFrMwLGT1kg/KIJcBa3BUK8gVRLzqJd9hq1hQtavmm6T3W9PW8yCG3IP4b/Kxsm0+B1pXSaFC2a3elFu5lgw7JeJO22NwPmCUw3cX/zfYcn4u1MSsn2Wlr5tLNwjfpeGXb0w9eGStEZNKpj/OLo5W6sxdO1PIdCRd/IdxFuDd3q3G9cJTP7aMjeWSQhr7bzgzx1K78zZ9h4Qiw4YXrw==
+    OIDC_REMEMBER_ME: AgARqfhGDWYi0iqE//vNsJfgZBYJklJ7KUUHm3GkD27gNk0JtOobt/RlE3UV4cBGkstjGQkEGldkwshtQk/hAuuu8Qb9PpeDxQOUABAFX7NDcr2hWnDosFSShq724ycY6B63vjzahMBYEGo9tAB07VPy6RtvZDH5EGYcubfSe2GgX/P9VcKq64eO2NkOHJWc1A9cPqQGYqFi3YZkN1yaix7kRW7sL627Slv3nU/yLpFpEwUi9ayzDBCDxfiBZoRZh+Gy4VpD2S0XmTNYgr+uRTmFxEm0gL4qvualqahssswG6x+l6S+KizbLOkhNmLtZ12t166mZLWlzUPQKiJwEiWUK5DfJs2LtZCWyqVko9972df+buaQ4yPEBO212OoM1gF0P0JaTJ7TNzo0hhYxDIBZPIx9RnG7XzqI+sccj/OLQMeyB4p9gbbKHP4YJyyYQTSPK3dHG8BFdfUDyyq1tv5IkzKRHmy48xaumN6KCPsCqrpr8j1XL9oLPGPtDgf9VRjfp01FkTg9ujskxjnfAt6fNw8JThMyRUdInagos8Wh/qxPPV33yN+EvQaooXxq1FhvZtLVAXsErzqXnNbLBmQGx87IpBT4KMpXBWmQ7+XaiFCWXQ2pdXRtwL9IT7c6dtyCpUpYtlVjYuh8L64W8GJuRUjzg6pRbcw0205MFUZfWuOObAHK67K+ChNgzzsCCy4GHVtpp
+    OIDC_SIGNUP_ENABLED: AgBju2S3K1/i7oEsF+KyOIAyduYJMqA5c/spXNVDtFDgrf5+v8dIa25b1LyNZWctBPLZrcuviQtY3uJWgBbY4cKagheBlwN/eCijghdFLR5U9iFNJUv31zkmnVeOAZqkLKAmO1fmHfgqrZ8+UG5YlaRXcGsMjtuCuteKhF+/ss8VxWNwsWVcJc+xcfK11UG/ogrQ3+h/Ii1RCiS5WSMmQB3uNRvyNQEdDJHdtK6gifK5ZHboHN36Rx3DEzyr3eDeIJasyYgfDtepTBTyw5cb/7yFhRMSraHTpGy3uxJwzzNL1YdCi2EHyllJMea1/AvxUQXQAxD3zOSmNwQdroE8NU/Y+Y/vuCOLVrLeveHaTUWvI9PkIlIxbU1Xql7UGf7s+Y1PTnG7aXWNYNuTCgaw03TO5bhAPX1tBubVT9oVUZgjOH+XGY4nImtBOt/1bJ2xmciC6t2nt+8lUxLfNuFS/876vJokYtd22YHGqHuGSLhAdWg7LcwIilx4iCB3OY0ORBtdE0hDOu5KR282vRqGu5vi977k6kD7sL2far0fHjpb8rOaJqfy56UsF1CjClqQWB0F2vPh/ZNjecC87ei0ds3hCEhGtXxYYdJ1u9U3lZHyvA37NxKaagTHZCmhgs4M6Pdqm5YjsO0iDorv+aBnRkZysqzdG8LPuZNy7BkqxejW9icS5+b4TeJgCButl2Cb2RO77tda
+    OIDC_USER_CLAIM: AgCKYNaYTjJxEFBsijRDPNXRH2nodeUMG6SBa/emB6QKNh9jnQISn9poaZXZ8Tc/xwy1sLJ3m02x+Uh7/PE+A/jiQ26uc8FVvnjvzzUOaily9Hj+xgKZnjQHmNpxPBfj3pzomWZIEoEHybsWGrae1jDzIBxSeKbMYgTGfwJoWt9n4lnQ1Z++Z5/Texp7o+oV5ZJqsEqvjebTUT+nwWaDicKpDA/QbAjD+ysCim+gh8q8FXDCHZKNgD4OcXONTpDR185EpBYV0EKSMytlz5bdBSKHxVUACTATjf3WrFDG5NtckzmJA3bA85Xl39Jxi9pLP9D0SLk5cSOLkwNbLVL1EeQ4Q2FApXcPGhmEAgan11HQo2vJW3Dsn1R3G69zNC2ArMC6Dz6pH5f8nFId5lyTKsQQs25fCf/BV2we3910a9hGKAEPdkp27xGczu0mBdo3LLWeiFaQcDo326N2pqNm3119mdCdu5I7rhjGGvOLZ7z1c8XwS9NdE0Kb3iQZLqu1xr/FSeQZLd9NNF6qYtyFM3CtdqKSgdM4vpsRkqMEiZA84u7hdglXohuaVOjIaQD66bi0He1LemzyzRkRD57zxdVSvubKIQmedNpeG2yOT7pjZqVEk7FwWPaWZZiK61UhBZNvGXUKSMEWVJ1DIr9QBsK2E4/EGdqWKa/A5+75PKvv1TpINTw26z9schtduuPfaGO4Z/2ThfPlYFwD2eoVMZpAYjI=
+    OIDC_USER_GROUP: AgCTGx9h4At2lcx4tN5YUBN2PRHG9ex3curTTq4kid+kKQXRUOYckYC3LNzC7aIbJ8byhFHtJVF/T37olPkgJjWzPN6C16C9eGDv8bgq6JnG9faveeXr2zjcceZ9O3bSb4sRxlQ5Zke1Asc2olYP/H6br4VPDdKkDsJ5h5/B/W/dd9FDXuPAbTp32bK/l+3YStR4Zpmaldt4hostPu9TXfE+UxJqcLCFMtQuHsHEtFV3Pimt0XIkoNPsodpKKoAhje8vNwk5YYSlhzH13XgZvKcP43z8bfekicOgRNM6T27sVGRrFM4sE635406sOXWXbxJzwlBQJTqajCtX+tAtei3LHdr0l1sjjyMDzlREUq6RYt/6klMZrLW5gsdma769AFA76JX+e+wjekmv72/aqUVn9635IamFM1J6+jIWKdWo76vJwzR/EisO12vkSbocSoAEsUxc3rGMN2aLZEvo0LjsjENKlj8fNxog5i+4jO9Bc0AXEQaFhlQwPdIKlylQPhrSiW/cnDG1WemDn+e77a9NiOkDxMXGequzdC5KyIeIrSjITXpg1MQNa039yIKkjfVL0uMsH7OL7+qzKPSPm5LOABBxKducSHHK4t364YD+8e7KeQStHjaCTpcxgf43at4BKuQ31Ty2bWfpMRofGRBvJPusgjXrdutNEAIVrzFfW11o0Yx06U7CRF5198yXHCig3zKgxgQW
+  template:
+    metadata:
+      creationTimestamp: null
+      name: mealie-oauth
+      namespace: recipes
+    type: Opaque

apps/recipes/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: placeholder

apps/recipes/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mealie
+spec:
+  resources:
+    requests:
+      storage: 5Gi
+  volumeMode: Filesystem
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce

apps/recipes/service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mealie-web
+spec:
+  selector:
+    app: mealie
+  ports:
+  - port: 9000
+    targetPort: 9000

apps/rss/deployment.yaml

@@ -18,9 +18,9 @@ spec:
           ports:
             - containerPort: 7070
           volumeMounts:
-            - name: rss-data
+            - name: data
               mountPath: /data
       volumes:
-        - name: rss-data
+        - name: data
           persistentVolumeClaim:
-            claimName: rss-claim
+            claimName: data

apps/rss/ingress.yaml

@@ -1,4 +1,4 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: rss-ingressroute
@@ -14,4 +14,3 @@ spec:
           port: 80
   tls:
     certResolver: default-tls
-        

apps/rss/namespace.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: placeholder
+  name: placeholder