using an alternative stack

.gitmodules

@@ -0,0 +1,6 @@
+[submodule "infrastructure/external-dns/octodns"]
+	path = infrastructure/external-dns/octodns
+	url = ssh://git@git.kluster.moll.re:2222/remoll/dns.git
+[submodule "apps/monitoring/dashboards"]
+	path = apps/monitoring/dashboards
+	url = ssh://git@git.kluster.moll.re:2222/remoll/grafana-dashboards.git

README.md

@@ -1,7 +1,7 @@
 # Kluster setup and IaaC using argoCD
 
 
-### Description
+### Initial setup
 #### Requirements:
 - A running k3s instance
 - `sealedsecrets` deployed
@@ -27,60 +27,21 @@ The app-of-apps will bootstrap a fully featured cluster with the following compo
     - immich
     - ...
 
-## Setup instructions
+#### Recap
-1. install sealedsecrets see [README](./infrastructure/sealedsecrets/README.md)
+- install sealedsecrets see [README](./infrastructure/sealedsecrets/README.md)
     ```bash
     kubectl apply -k infrastructure/sealedsecrets
     kubectl apply -f infrastructure/sealedsecrets/main.key
     kubectl delete pod -n kube-system -l name=sealed-secrets-controller
     ```
-1. install argocd and the app-of-apps bundled with it
+- install argocd
     ```bash
     kubectl apply -k infrastructure/argocd
     ```
+- wait...
 
 
-> NOTE: The argocd kustomization already mentions some CRDs available only after the full bootstrapping (traefik). You might have to apply the last step twice
-
 ### Adding an application
 todo
 
 
-
-
-### Status
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=authelia-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/authelia-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=backup-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/backup-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=external-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/external-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=external-dns-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/external-dns-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=gitea-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/gitea-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=metallb-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/metallb-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=monitoring-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/monitoring-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=nfs-provisioner-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/nfs-provisioner-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=pg-ha-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/pg-ha-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=renovate-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/renovate-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=sealedsecrets-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/sealedsecrets-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=traefik-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/traefik-application)
-
-
----
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=adguard-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/adguard-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=audiobookshelf-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/audiobookshelf-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=code-server-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/code-server-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=files-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/files-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=finance-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/finance-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=grafana-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/grafana-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=homeassistant-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/homeassistant-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=immich-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/immich-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=kitchenowl-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/kitchenowl-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=linkding-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/linkding-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=media-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/media-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=minecraft-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/minecraft-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=ntfy-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/ntfy-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=paperless-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/paperless-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=recipes-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/recipes-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=rss-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/rss-application)
----
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=journal-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/journal-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=physics-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/physics-application)
-

apps/adguard/configmap.yaml

@@ -27,10 +27,7 @@ data:
       ratelimit_whitelist: []
       refuse_any: true
       upstream_dns:
-        - tls://1.1.1.1
+        - https://dns10.quad9.net/dns-query
-        - tls://dns.google
-        - tls://p0.freedns.controld.com
-        - tls://dns.quad9.net
       upstream_dns_file: ""
       bootstrap_dns:
         - 9.9.9.10
@@ -38,7 +35,8 @@ data:
         - 2620:fe::10
         - 2620:fe::fe:10
       fallback_dns: []
-      upstream_mode: load_balance
+      all_servers: false
+      fastest_addr: false
       fastest_timeout: 1s
       allowed_clients: []
       disallowed_clients: []
@@ -74,8 +72,6 @@ data:
       dns64_prefixes: []
       serve_http3: false
       use_http3_upstreams: false
-      serve_plain_dns: true
-      hostsfile_enabled: true
     tls:
       enabled: false
       server_name: ""
@@ -92,14 +88,12 @@ data:
       private_key_path: ""
       strict_sni_check: false
     querylog:
-      dir_path: ""
       ignored: []
       interval: 2160h
       size_memory: 1000
       enabled: true
       file_enabled: true
     statistics:
-      dir_path: ""
       ignored: []
       interval: 24h
       enabled: true
@@ -116,10 +110,6 @@ data:
         url: https://someonewhocares.org/hosts/zero/hosts
         name: Dan Pollock's List
         id: 1684963532
-      - enabled: true
-        url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_3.txt
-        name: Peter Lowe's Blocklist
-        id: 1735824753
     whitelist_filters: []
     user_rules: []
     dhcp:
@@ -144,36 +134,13 @@ data:
       blocking_ipv6: ""
       blocked_services:
         schedule:
-          time_zone: Europe/Berlin
+          time_zone: UTC
-          sun:
+        ids: []
-            start: 18h
-            end: 23h59m
-          mon:
-            start: 18h
-            end: 23h59m
-          tue:
-            start: 18h
-            end: 23h59m
-          wed:
-            start: 18h
-            end: 23h59m
-          thu:
-            start: 18h
-            end: 23h59m
-          fri:
-            start: 18h
-            end: 23h59m
-          sat:
-            start: 18h
-            end: 23h59m
-        ids:
-          - reddit
       protection_disabled_until: null
       safe_search:
         enabled: false
         bing: true
         duckduckgo: true
-        ecosia: true
         google: true
         pixabay: true
         yandex: true
@@ -182,13 +149,11 @@ data:
       parental_block_host: family-block.dns.adguard.com
       safebrowsing_block_host: standard-block.dns.adguard.com
       rewrites: []
-      safe_fs_patterns:
-        - /opt/adguardhome/data/userfilters/*
       safebrowsing_cache_size: 1048576
       safesearch_cache_size: 1048576
       parental_cache_size: 1048576
       cache_time: 30
-      filters_update_interval: 168
+      filters_update_interval: 24
       blocked_response_ttl: 10
       filtering_enabled: true
       parental_enabled: true
@@ -203,7 +168,6 @@ data:
         hosts: true
       persistent: []
     log:
-      enabled: true
       file: ""
       max_backups: 0
       max_size: 100
@@ -215,4 +179,4 @@ data:
       group: ""
       user: ""
       rlimit_nofile: 0
-    schema_version: 29
+    schema_version: 27

apps/adguard/kustomization.yaml

@@ -10,7 +10,7 @@ resources:
 images:
   - name: adguard/adguardhome
     newName: adguard/adguardhome
-    newTag: v0.107.65
+    newTag: v0.107.48
 
 namespace: adguard
 

apps/audiobookshelf/deployment.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: audiobookshelf
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: audiobookshelf
-  template:
-    metadata:
-      labels:
-        app: audiobookshelf
-    spec:
-      containers:
-        - name: audiobookshelf
-          image: audiobookshelf
-          ports:
-            - containerPort: 80
-            
-          env:
-          - name: TZ
-            value: Europe/Berlin
-          - name: CONFIG_PATH
-            value: /data/config
-          - name: METADATA_PATH
-            value: /data/metadata
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          resources:
-            requests:
-              cpu: "100m"
-              memory: "200Mi"
-            limits:
-              cpu: "2"
-              memory: "1Gi"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: audiobookshelf-data
-

apps/audiobookshelf/ingress.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: audiobookshelf-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`audiobookshelf.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: audiobookshelf-web
-      port: 80
-
-  tls:
-    certResolver: default-tls 

apps/audiobookshelf/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources: 
-  - namespace.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-
-namespace: audiobookshelf
-
-images:
-  - name: audiobookshelf
-    newName: ghcr.io/advplyr/audiobookshelf
-    newTag: "2.29.0"

apps/audiobookshelf/pvc.yaml

@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: audiobookshelf-data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

apps/audiobookshelf/service.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: audiobookshelf-web
-spec:
-  selector:
-    app: audiobookshelf
-  ports:
-  - port: 80
-    targetPort: 80

apps/code-server/deployment.yaml

@@ -1,41 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: code-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: code-server
-  template:
-    metadata:
-      labels:
-        app: code-server
-    spec:
-      containers:
-        - name: code-server
-          image: code-server
-          ports:
-            - containerPort: 8080
-          env:
-          - name: TZ
-            value: Europe/Berlin
-          - name: CONFIG_PATH
-            value: /data/config
-          - name: METADATA_PATH
-            value: /data/metadata
-          volumeMounts:
-            - name: data
-              mountPath: /home/coder
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "100Mi"
-            limits:
-              cpu: "6"
-              memory: "16Gi"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: code-server-data
-

apps/code-server/ingress.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: audiobookshelf-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`code.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: code-server-web
-      port: 8080
-
-  tls:
-    certResolver: default-tls 

apps/code-server/pvc.yaml

@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: code-server-data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

apps/code-server/service.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: code-server-web
-spec:
-  selector:
-    app: code-server
-  ports:
-  - port: 8080
-    targetPort: 8080
-  type: LoadBalancer

apps/files/kustomization.yaml

@@ -13,4 +13,4 @@ namespace: files
 images:
   - name: ocis
     newName: owncloud/ocis
-    newTag: "7.2.0"
+    newTag: "5.0.3"

apps/finance/actualbudget.deployment.yaml

@@ -21,9 +21,6 @@ spec:
           env:
             - name: TZ
               value: Europe/Berlin
-          envFrom:
-            - secretRef:
-                name: actualbudget-oidc
           volumeMounts:
             - name: data
               mountPath: /data

apps/finance/kustomization.yaml

@@ -9,9 +9,8 @@ resources:
   - actualbudget.deployment.yaml
   - actualbudget.service.yaml
   - actualbudget.ingress.yaml
-  - oidc.sealedsecret.yaml
 
 images:
   - name: actualbudget
     newName: actualbudget/actual-server
-    newTag: 25.9.0
+    newTag: 24.5.0

apps/finance/oidc.sealedsecret.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: actualbudget-oidc
-  namespace: finance
-spec:
-  encryptedData:
-    ACTUAL_OPENID_AUTH_METHOD: AgAhPqooAS/7R9S/X3KGfSfs3ClN38J9CEfkUTYAUvKGEehQ2Tz3thPNvhvnbz/gKRc7C172jgxoxaGMiVXi40Qa+I7Y8JVHefjoSd8NuubzQZU8ZK5KlYRgc5OnoPM3RLarHyZ2DFw5Q/ngv3sp1c5dSI4/604KSQPxVAFCnb/lnSkOsBggDRymWvYclx1NrLIClpLAFwHgCOm6g1kHCvtGIdBLxKOHsiRJm62+UyHt0GLkR0QFTDXBQxoBm9QR9kLjQqw/QqcOIVx1by0RHoHBI6HDEEIQVH3UgWqlMmIwm+a4KQeBEdEfWLn9YC8MGSdlQRlaZoi5ltFT2c/DWuMuRStnaOWbsMQVR+y6yJ2UNBe29uVQh6877iqfmAJvT6gXic73zI7Vkq6IFQ7veQPBaTi22HP/sxiElGI8rY0LtRHD4TctKSePaOPvsgrv8k8SpB5qYAft7UonbTPWzzRSSc4Y3Z4fQiD0x/uhtTqTTtukx39nzM2TjVGcJThWaxUGa07w1fjTafieFVwwreURBUpRK92X2NY3ovOdA9c1WrHfqIzVtpcnfQyCeA5D4XT2sBFk0+crwEm1GmtscjPkGnyctNMUSmkHd+QKw8EAmWxKge4+7rfOrZp5ZK7cBFJcB4gVQcxnm3bXr0qZyiA1udaxmSxVflQR2AjduvhKuE73AGPi0bJki5TvKJp6bavTotYfdMY=
-    ACTUAL_OPENID_CLIENT_ID: AgA6X0uYaU1n4XSXVntmT4+NgahYkkMVx61OZP8ExnSMkRPlwQfErhNHrwKsTsnD8OzP3svhxBe5bwaI8O1OKF0k5pQWG0DbRfmBrwiep9nBsKPt+fQm0AJUsZ2sQNShusmsSEumBKbMD0CMPklVMq18tLpOIh/YaXM34lsOutW0SIx7HWWQsyLmoolEoRVdkKvDhoh3FXjKqzGYlr1uKuqYG7pJPsxEpsTs2pZTUIlB2gVcEqb/ZXxgkj01GDYzB519swIOfYdISj7oCR8VG90M9iDrgmxsPkWozMDxFjNo5JR2dB9wvP7ptFex8JonbZZXYZD7tE+36U8iys6Cjh6JGwr9luN1AxYYSkRrNWJd2CuID+8ujWptoTvRSO0RwiVVp5LhXe1l2GxLsS2UVtO+nbWH6DGMJei4DQ+LAxDXFR8FAvi7615cneN0umQfF4ZMUJirvxHA3tFN42tbnRmSCbLAZLNLhQq8VbRmkYOAN6LCzSKYlyhSyA3NM2HjRTFkXGUhOPL+3tPZJB4v0QlEhlhy1Ffxh2mbUXgmQ+ZHGUsBXEHfc/Gba6gJhsj6S2DkiAeZUW6euY5/v4vpveWsS+YS+BxH441//8mOJnrpsWrcQbM5yCk4WMnmpETy/VFEkc3dqYfVWHDfvwAeqjVfXAovXBmwOoCASG6qDf0P7FdeLFTHUNuahyNhBzhBAQ/yNpOkbzKTJFBWwnM=
-    ACTUAL_OPENID_CLIENT_SECRET: AgAbJinP4E8rbGAw7BTfh/GB3XxQOfHiLFrgaikQbUIsmZu+Y6ktK7aJdcX2/g6yhHXX6z8p4xoYTaGgkpo8H0XWvUDT4ohqJVdJSWZgNx8MyzisVKi+51BEpslL4JvGo/ISjXT0hNeYGzFXlHnnr3LX+fuTVh3dKtk4t8nmR8SqaCCIyvKiBPmX/1QWo4Vrfw7OLpVlfGP0i3J7FrhjNgKMRWcQKQC4Ohk+NLHHghdtqzuFB8eKwcuBZmynKCVyblOhwZSL5WnyJPskWLMjNEizWuCubDdyHVY3ZqYLDe5dgoi7Gop5/xY7FEuEkmTL0g7LpKo4RkEKRLjsZwWtW+xN6HRRt7zGoUdIpo20ZnTtEH8C/qcxjHKUycFvzKLnk6ntq5rEdK2/MhBtMfd3a8pb4vpT9JNra1AWsB7zCUv4yc/FT0RpkL+1r1CVva4o+tzM8ojnm4o0ch6qsGb0IOYZvJx6sF7c6aj7c41YQK3ZrQF3bhhhEHYyWOBjy1V4T/GJPZ9CbhGG0PIsSvpW7d5pG5jNAwU/Xo6FL/vVUPwmSq/hCqYMSSSKNiMH/q/vzKyu5B5aQbNDAumzsLRqD/auJz8nAaUoLNBVHq+7zTs3wV7pEayY22teq/MN5PRtYOQLE5Ck60gv9Q70cfhgvTeK+eX4h9BbhfijCV/EiSYhLP7meeIpE80icdLUSkNROfW+0sf3RNbW5q3JX8PsW0h29VJgREJdlziLj2cCshe+ww==
-    ACTUAL_OPENID_DISCOVERY_URL: AgAQVZX6r8SPkwwBR1dmUF/ahuZKkGSsU/GULe5PF7Nm75UadtjPb5aHAZjWE59MdV61DQZDa4KJz1/fW4xDUrJBuUElIRQH4oyMTQG12MSMauQpLd25SVU8ex2NYyerbd85j521FSxujP0l3941KGsENLt5wCx/idXu47txhAHgS81mj3CLfWzT5yyG+V1i48a24xK905v+ft5ZKuNLOxvVb6yZSBt1j/3egx49eB49CRk/dxYQtPpSw8Zb6KgaN+skjq5HTH/Neb4J92nlJ1aFPVKbFLbtxyIHDSoO35U8ODHEJVGKBbZjjfrrjCpmQYnZPEWN9s+xj2NAXZ7qANcJfbFEF/3bOiKZhc0jLM5MyhiMZoytn4FvGM8zxINC3z8zqaWJm1wiMXEUH3/FLUa2UWeHKQB14h0f5XGwytb3s/nPCoBnHhtOK1y4utJ2APsQhRsxySZjgYNRaRCarp8PntY7yB7VHYlv5Mitx+qBWcAUmcKp1I4NTnm1LORRGzIFcrJJKtQfqcW7GNuZDA3AiLGyOMVigcA93GnPbppor5BItE9FK/BKqrR4Bz31jXSO8S7pjhi3JxBIKEMmMZRVbyelJ9o7gTpqrBvO7KZ5v/L+mlE0J8D2LZoEWPqxfa/BE+QZfwIS3wDWQl1GTruaAM4u0bp4i9GkyK3hPVXnml3dNMElSG3GvNqHhhy1Boo1cHXHbQ5YzbkGgzL9fLkigVQCi0FKItyBxdGsui9U0OU5LNi0EGKBibs22mdDkp6f051GWeMidtSwz9j5
-    ACTUAL_OPENID_SERVER_HOSTNAME: AgB+C31GqtPKbMifuTFYhwOgUwXph+RQYdnVQaVIaDiveE6Lydl/2HnTyFQIi2mhrbiCpDgegXuvGBoM7WHxlPepny5E66lY/cAdFaFDGMARqMXCRLVmvkt3U1IyNn9zPCPil0x+eAv2S/ETLm8Nj2OL9utxkdNBHub9xiGrE0d7qBeBfK1FNmainthYQUpnCsR7jowmmvYGuEyDwfG+suUooDdb5zaWmCJZRYk1jKD3zlu21N0sfciBJ/GpTdz/2V+NXqJJqs3r2zoB2GJPQ64pMuZHZ+yw8bYUkg7/QOHD2ofWmtzNOGGtiNRHAG8MtvF6ovc4Hgv5uu+4x413UP6pSIJsrHrXSHYP+mvu+ya3gNUn6YK2qymezrqbvUF/n7LoaDzTRqa0PmemtdskuABiwfqrdiOarxaWjomkXqnrBK6VkJ8PhOMDMv/j/c6zlXdhpnqlUyxMcjBjqicfNBWN8UByDIEw4D0rhibzOS4fIKjNHrmXHv39GNJsY90avhZqq42oTMJL0vcaj3v4pBZJdJ05TOvY7PQ/iUwnnczGqOtpAQtBKfCV2+PXp9o/64wOGc0Br322kSpzjIleWP9VWVgbqvwMjUGtlL+xTkCaOFpiYETxUim09c745WDc+YgU55rd5i/5t20wiKy7RSYnHvYOwvdjAlEgAnD0YZBXOQkL51nL9P+nOMAYBE0HiM1vYsd8R6h6Fk+G2gcs/2CLgwglqOtMwAm9A9+5qSqyMak6Z68=
-  template:
-    metadata:
-      creationTimestamp: null
-      name: actualbudget-oidc
-      namespace: finance

apps/grafana/grafana-admin.sealedsecret.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: grafana-admin-secret
-  namespace: grafana
-spec:
-  encryptedData:
-    password: AgAU6g/CwKj+1gPpt4DLvLsS0YCvJdVHWw4W4bRhibE9brVvcJtGB3D9MTJrSLVVwusaE6OR59og7oW5ge3yTd/9bbclXYLrxEi7OwvkQjCvo8MfD8yhJO9nV4Xs9Mjk2Z4SHGYuq6wvcssuJrpz5f0XEC7ocTRA+u0UaE+/b4FrYF71uyKGvj8GSXgLZUjGPFsGfPzwJn7cLBmlclVHx1xGbFpUc042m5Mulpn0QolFQnOwZiW4PL8pQyz1MXVRwCsz0RJd5apZL3XJ4X7BLMoAp+diHQ2xi3zoU9VScp+J2QgvFdRKgDa6v7Jz1f+HCwq5W/DoegwFXBrcMIfF2YrnvTnc1PCVwD9IHOeylO7J2hfi8teQiqTvvRlVgdBTLqoqlVovemf5k6ke6JfjTwnsJjTNnL7MKN5Qt0o7N2XRZ3ba9jp8cKbI7fyFQKaU2QEf2PIkp82kEnixmpA1aATgeA3W4E5Km7sKHUEB81+pwnOe54tzD2ShgQX/+UiswhWYTT+gdZKL1udBBemUDC0z9PSJNTPTy+hq+G4CIzVQUYxlioM3c+3geF7YLU8yXisj84pk44GN9KX3z5x+M2+LZL7agAWPUjxtrP2V+id7dNJQfCm0aSMeo57dVfb4zlBUAAgKIKjX+j1KqCVqE9zEO2F/QX7mY6MJTP2me3wmY7JAVRJ7d6bbkyyoDhs8JErLYLp0A+Eh+qx8nWgM9ErPVSA0
-    user: AgB8ZLG2EuERjg1nKdH/xadbUuIR2c8a9gF5fE8ctrp4DNDLLuuqmjyoHRiWpkrtfnE1yKg1rPP+asV9Lj5iVmE9J+OB3QUOeFS4MHciBNj7pa68zfFgnHP4kxMX6aXyKRQrYruYjHwfzCpOM1zyTEphuGlnokjQXxjF/mZsoM2NWn7WGReqfxqH95tJXfs9AUC5vVv/PHqd+KKRZH7+G1AnWVJ7RFQHedR7wyftO4/rkm8deMuZWtOLl25fAOyOr7+hSqT69s9/uTKSLJXjobSqtulqsR+v5lkwx2ThNKzmcEcuoenKG6lk8XLRSIscccZH3JTPh6IknQWUOC4nmYj+XUxE8Go0RX/4eL+D/6FrYrtp0gr3HOCLAGU4vAHMeKfJoyqykJVnvY6QY6bFgaziyOlWaoEHpg6g0vHHDwyX7HIDcQfJZGOLH9dhrWJ2sOkzyuuxfqWEgz/M2eBW4EUAudHwfTLPocSMUI+D6fjeciMojet5uxWMP7ZHh/E061f5+Vfk6CKYd9Kpi69Xah8KEyyHYP5NImkdIwjgllaEAd/FBE2+QJyTVZlUQC7y9ObagDMCUFaFbTS5QOLh5BOJDL5buEYFWG0IhoH47SC/pKeEOQH//uvoo27K9zvxTOQN1YOTrxCozmexMOsTIdhvU0dOnJDBrThSHKYLCeIokDOgUUT52FqDH51RoLoK3UkyGbMoq+M=
-  template:
-    metadata:
-      creationTimestamp: null
-      name: grafana-admin-secret
-      namespace: grafana
-    type: Opaque

apps/grafana/grafana-auth.sealedsecret.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: grafana-auth
-  namespace: grafana
-spec:
-  encryptedData:
-    client_secret: AgCEdC1/ERlPQyQP+bd9gcW33Yrvl4uRbx+RF5AY4vYAquOzxmLTygMl/WZlB5wlCE5idIHgto6/fUWVZrQbmfClRqsW2pFoddKQAtS9cQNXwMjLCm7e0lXk9GM9O3ZwktmklFbCu8XewHmefGHhoJ28vPxPMaINv1fM4zYKvNz5RHf0dJfTHgxb68wRYjAbE/eJpRcVE3a29Yw6Gfa8Mb+cFI7RTHvjuv9LBgWqM6b3qvvJ4wYR2WKuiQrnJ5xAtHpMAI/2R80qq151wlaZueDZ1PwjRBHURkmPTmwZnrMrmIugNge7Tpww+ArZlG9kDfSu1aTJidbXbcpN6fyt1qARTCYrBlbn60PTYLnPL/NObvMCpjS6DsYsYz7MJ7WoOupu46Ib5paZHmak+CilC6lb9LjJj4EKfRsagZmWT07JavhHBW/tqjB3GToccIz4fOAOdA9aU51J4wCL2ctp2SgzCEKe2EaBK/f9nDd9ASmmon9PDwRDVtG8yTukrNcZHNzodi09Af81DB0RNa36Z3Sjt5xu94paN+mjiOWGf2JduVEq+60NbPvDbPE9e1aVH3DdQcij2WGZaTE8dAGLSsLoOkIq3m2E+Mbk1Re1gI9H18xJM72ivb5uDe7pzReyvO5DY4Pfq8JgQhPxWcDq9ScmWS6Bb+jdCKytFq5NafSAl+akPbbwN+1GFu33if/P5D9I2TwOA8V1wyVU
-  template:
-    metadata:
-      creationTimestamp: null
-      name: grafana-auth
-      namespace: grafana
-    type: Opaque

apps/grafana/kustomization.yaml

@@ -1,21 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: grafana
-
-resources: 
-  - namespace.yaml
-  - grafana.ingress.yaml
-  - grafana-admin.sealedsecret.yaml
-  - grafana-auth.sealedsecret.yaml
-  # grafana dashboards are provisioned from a git repository
-  # in the initial bootstrap of the app of apps, the git repo won't be available, so this sync will initially fail
-  - https://git.kluster.moll.re/remoll/grafana-dashboards//?timeout=10&ref=main
-
-
-helmCharts:
-  - releaseName: grafana
-    name: grafana
-    repo: https://grafana.github.io/helm-charts
-    version: 9.4.5
-    valuesFile: grafana.values.yaml

apps/homeassistant/deployment.yaml

@@ -14,7 +14,7 @@ spec:
     spec:
       containers:
         - name: homeassistant
-          image: homeassistant
+          image: homeassistant/home-assistant
           ports:
             - containerPort: 8123
           env:

apps/homeassistant/kustomization.yaml

@@ -13,6 +13,6 @@ resources:
 
 
 images:
-  - name: homeassistant
+  - name: homeassistant/home-assistant
     newName: homeassistant/home-assistant
-    newTag: "2025.9"
+    newTag: "2024.5"

apps/homeassistant/service.yaml

@@ -2,8 +2,6 @@ apiVersion: v1
 kind: Service
 metadata:
   name: homeassistant-web
-  labels:
-    app: homeassistant
 spec:
   selector:
     app: homeassistant

apps/homepage/configmap.yaml

@@ -0,0 +1,98 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+  labels:
+    app.kubernetes.io/name: homepage
+data:
+  kubernetes.yaml: "" #|
+  #  mode: cluster
+  settings.yaml: |
+    title: "Homepage"
+    background: https://images.unsplash.com/photo-1547327132-5d20850c62b5?q=80&w=3870&auto=format&fit=crop
+    cardBlur: sm
+  #settings.yaml: |
+  #  providers:
+  #    longhorn:
+  #      url: https://longhorn.my.network
+  custom.css: ""
+  custom.js: ""
+  bookmarks.yaml: |
+    - Developer:
+        - Github:
+            - abbr: GH
+              href: https://github.com/moll-re
+  services.yaml: |
+    - Media:
+        - Jellyfin backend:
+            href: https://media-backend.kluster.moll.re
+            ping: media-backend.kluster.moll.re
+        - Jellyfin vue:
+            href: https://media.kluster.moll.re
+            ping: media.kluster.moll.re
+        - Immich:
+            href: https://immich.kluster.moll.re
+            ping: immich.kluster.moll.re
+
+    - Productivity:
+        - OwnCloud:
+            href: https://ocis.kluster.moll.re
+            ping: ocis.kluster.moll.re
+        - ToDo:
+            href: https://todos.kluster.moll.re
+            ping: todos.kluster.moll.re
+        - Finance:
+            href: https://finance.kluster.moll.re
+            ping: finance.kluster.moll.re
+
+    - Home:
+        - Home Assistant:
+            href: https://home.kluster.moll.re
+            ping: home.kluster.moll.re
+        - Grafana:
+            href: https://grafana.kluster.moll.re
+            ping: grafana.kluster.moll.re
+        - Recipes:
+            href: https://recipes.kluster.moll.re
+            ping: recipes.kluster.moll.re
+    
+    - Infra:
+        - Gitea:
+            href: https://git.kluster.moll.re
+            ping: git.kluster.moll.re
+        - ArgoCD:
+            href: https://argocd.kluster.moll.re
+            ping: argocd.kluster.moll.re
+
+  widgets.yaml: |
+    # - kubernetes:
+    #     cluster:
+    #       show: true
+    #       cpu: true
+    #       memory: true
+    #       showLabel: true
+    #       label: "cluster"
+    #     nodes:
+    #       show: true
+    #       cpu: true
+    #       memory: true
+    #       showLabel: true
+    - search:
+        provider: duckduckgo
+    - openmeteo:
+        label: Zürich # optional
+        latitude: 47.24236
+        longitude: 8.30439
+        units: metric # or imperial
+        cache: 30 # Time in minutes to cache API responses, to stay within limits
+        format: # optional, Intl.NumberFormat options
+            maximumFractionDigits: 1
+    - datetime:
+        locale: de
+        format:
+          dateStyle: long
+          timeStyle: short
+    - adguard:
+        url: http://adguard-home-web.adguard-home:3000
+
+  docker.yaml: ""

apps/homepage/deployment.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: homepage
+  labels:
+    app.kubernetes.io/name: homepage
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: homepage
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: homepage
+    spec:
+      # serviceAccountName: homepage
+      # automountServiceAccountToken: true
+      dnsPolicy: ClusterFirst
+      # enableServiceLinks: true
+      containers:
+        - name: homepage
+          image: homepage
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /app/config/custom.js
+              name: config
+              subPath: custom.js
+            - mountPath: /app/config/custom.css
+              name: config
+              subPath: custom.css
+            - mountPath: /app/config/bookmarks.yaml
+              name: config
+              subPath: bookmarks.yaml
+            - mountPath: /app/config/docker.yaml
+              name: config
+              subPath: docker.yaml
+            - mountPath: /app/config/kubernetes.yaml
+              name: config
+              subPath: kubernetes.yaml
+            - mountPath: /app/config/services.yaml
+              name: config
+              subPath: services.yaml
+            - mountPath: /app/config/settings.yaml
+              name: config
+              subPath: settings.yaml
+            - mountPath: /app/config/widgets.yaml
+              name: config
+              subPath: widgets.yaml
+            - mountPath: /app/config/logs
+              name: logs
+      volumes:
+        - name: config
+          configMap:
+            name: config
+        - name: logs
+          emptyDir: {}

apps/homepage/ingress.yaml

@@ -1,17 +1,16 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: authelia-ingressroute
+  name: homepage-ingressroute
 
 spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`auth.kluster.moll.re`)
+    - match: Host(`start.kluster.moll.re`)
       kind: Rule
       services:
-        - name: authelia
+        - name: homepage-web
-          port: 80
+          port: 3000
-
   tls:
     certResolver: default-tls

apps/homepage/kustomization.yaml

@@ -1,15 +1,17 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+
+namespace: homepage
+
 resources:
   - namespace.yaml
-  - pvc.yaml
   - deployment.yaml
   - service.yaml
+  - configmap.yaml
   - ingress.yaml
 
-namespace: code-server
 
 images:
-  - name: code-server
+  - name: homepage
-    newName: ghcr.io/coder/code-server
+    newName: ghcr.io/gethomepage/homepage
-    newTag: 4.101.2-fedora
+    newTag: v0.8.13

apps/homepage/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: homepage-web
+  labels:
+    app.kubernetes.io/name: homepage
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: homepage

apps/immich/immich.postgres.yaml

@@ -1,39 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: immich-postgresql
-spec:
-  instances: 1
-  imageName: ghcr.io/tensorchord/cloudnative-vectorchord:16-0.3.0
-
-  bootstrap:
-    initdb:
-      owner: immich
-      database: immich
-      secret:
-        name: postgres-password
-      dataChecksums: true
-      postInitApplicationSQL:
-        - ALTER USER immich WITH SUPERUSER;
-        - CREATE EXTENSION IF NOT EXISTS vchord CASCADE;
-        - CREATE EXTENSION IF NOT EXISTS "cube";
-        - CREATE EXTENSION IF NOT EXISTS "earthdistance";
-
-  postgresql:
-    shared_preload_libraries:
-      - "vchord.so"
-
-  storage:
-    size: 5Gi
-    storageClass: nfs-client
-
-  monitoring:
-    enablePodMonitor: true
-
-  resources:
-    limits:
-      cpu: 2
-      memory: 1024Mi
-    requests:
-      cpu: 50m
-      memory: 512Mi

apps/immich/ingress.yaml

@@ -1,5 +1,14 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
+metadata:
+  name: stripprefix
+spec:
+  stripPrefix:
+    prefixes:
+      - /api
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
 metadata:
   name: websocket
 spec:
@@ -12,18 +21,19 @@ spec:
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: immich-ingressroute
+    name: immich-ingressroute
 
 spec:
-  entryPoints:
+    entryPoints:
-    - websecure
+        - websecure
-  routes:
+    routes:
-    - match: Host(`immich.kluster.moll.re`)
+        - match: Host(`immich.kluster.moll.re`)
-      kind: Rule
+          kind: Rule
-      services:
+          services:
-        - name: immich-server
+              - name: immich-server
-          port: 2283
+                port: 3001
-      middlewares:
+                passHostHeader: true
-        - name: websocket
+          middlewares:
-  tls:
+              - name: websocket
-    certResolver: default-tls
+    tls:
+        certResolver: default-tls

apps/immich/kustomization.yaml

@@ -1,34 +1,24 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: 
-  - namespace.yaml
+- namespace.yaml
-  - ingress.yaml
+- ingress.yaml
-  - pvc.yaml
+- pvc.yaml
-  - immich.postgres.yaml
+- postgres.yaml
-  - postgres.sealedsecret.yaml
+- postgres.sealedsecret.yaml
-  - servicemonitor.yaml
-
 
 namespace: immich
 
-
 helmCharts:
   - name: immich
     releaseName: immich
-    version: 0.9.3
+    version: 0.6.0
     valuesFile: values.yaml
     repo: https://immich-app.github.io/immich-charts
 
 
 images:
   - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v1.141.1
+    newTag: v1.103.1
   - name: ghcr.io/immich-app/immich-server
-    newTag: v1.141.1
+    newTag: v1.103.1
-
-
-patches:
-  - path: patch-redis-pvc.yaml
-    target:
-      kind: StatefulSet
-      name: immich-redis-master

apps/immich/patch-redis-pvc.yaml

@@ -1,17 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: immich-redis-master
-spec:
-  volumeClaimTemplates:
-  - apiVersion: v1
-    kind: PersistentVolumeClaim
-    metadata:
-      name: redis-data
-    spec:
-      storageClassName: nfs-client
-      accessModes:
-        - ReadWriteMany
-      resources:
-        requests:
-          storage: 2Gi

apps/immich/postgres.yaml

@@ -12,24 +12,18 @@ spec:
       secret:
         name: postgres-password
 
-  # Enable the VECTORS extension
-      postInitSQL:
-        - CREATE EXTENSION IF NOT EXISTS "vectors";
-
   postgresql:
     shared_preload_libraries:
       - "vectors.so"
 
-  # Persistent storage configuration
   storage:
-    size: 2Gi
+    size: 1Gi
     pvcTemplate:
-      accessModes:
+      storageClassName: ""
-        - ReadWriteOnce
       resources:
         requests:
-          storage: 2Gi
+          storage: "1Gi"
-      storageClassName: nfs-client
+      volumeName: immich-postgres
-      volumeMode: Filesystem
+
   monitoring:
     enablePodMonitor: true

apps/immich/pvc.yaml

@@ -1,11 +1,40 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: immich-nfs
+spec:
+  capacity:
+    storage: "50Gi"
+  accessModes:
+    - ReadWriteOnce
+  nfs:
+    path: /kluster/immich
+    server: 192.168.1.157
+---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: data
+  name: immich-nfs
 spec:
-  storageClassName: "nfs-client"
+  storageClassName: ""
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: "100Gi"
+      storage: "50Gi"
+  volumeName: immich-nfs
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: immich-postgres
+spec:
+  capacity:
+    storage: "1Gi"
+  accessModes:
+    - ReadWriteOnce
+  nfs:
+    path: /kluster/immich-postgres
+    server: 192.168.1.157
+# later used by cnpg

apps/immich/renovate.json

@@ -1,10 +0,0 @@
-{
-    "packageRules": [
-      {
-        "matchDatasources": ["docker"],
-        "matchPackagePrefixes": ["ghcr.io/immich-app/"],
-        "groupName": "Immich containers",
-        "groupSlug": "immich-app-images"
-      }
-    ]
-  }

apps/immich/servicemonitor.yaml

@@ -1,14 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: immich-service-monitor
-spec:
-  endpoints:
-  - port: metrics-api
-    scheme: http
-  - port: metrics-ms
-    scheme: http
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: server
-      app.kubernetes.io/service: immich-server

apps/immich/values.yaml

@@ -6,7 +6,7 @@
 
 env:
   REDIS_HOSTNAME: '{{ printf "%s-redis-master" .Release.Name }}'
-  DB_HOSTNAME: "immich-postgresql-rw"
+  DB_HOSTNAME: "immich-postgres-rw"
   DB_USERNAME: 
     valueFrom:
       secretKeyRef:
@@ -22,21 +22,22 @@ env:
       secretKeyRef:
         name: postgres-password
         key: password
+  IMMICH_WEB_URL: '{{ printf "http://%s-web:3000" .Release.Name }}'
   IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
-  IMMICH_METRICS: true
 
 immich:
-  metrics:
-    # Enabling this will create the service monitors needed to monitor immich with the prometheus operator
-    enabled: true
   persistence:
     # Main data store for all photos shared between different components.
     library:
       # Automatically creating the library volume is not supported by this chart
       # You have to specify an existing PVC to use
-      existingClaim: data
+      existingClaim: immich-nfs
 
 # Dependencies
+
+postgresql:
+  enabled: false
+
 redis:
   enabled: true
   architecture: standalone
@@ -51,12 +52,22 @@ server:
     main:
       enabled: false
 
+microservices:
+  enabled: true
+  persistence:
+    geodata-cache:
+      enabled: true
+      size: 1Gi
+      # Optional: Set this to pvc to avoid downloading the geodata every start.
+      type: emptyDir
+      accessMode: ReadWriteMany
+
 machine-learning:
   enabled: true
   persistence:
     cache:
       enabled: true
-      size: 200Gi
+      size: 10Gi
       # Optional: Set this to pvc to avoid downloading the ML models every start.
       type: emptyDir
       accessMode: ReadWriteMany

apps/kitchenowl/deployment.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kitchenowl
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: kitchenowl
-  template:
-    metadata:
-      labels:
-        app: kitchenowl
-    spec:
-      containers:
-        - name: kitchenowl
-          image: kitchenowl
-          ports:
-            - containerPort: 8080
-          env:
-          - name: TZ
-            value: Europe/Berlin
-          envFrom:
-            - configMapRef:
-                name: kitchenowl-config
-            - secretRef:
-                name: kitchenowl-oauth
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "100Mi"
-            limits:
-              cpu: "100m"
-              memory: "1Gi"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: kitchenowl-data
-

apps/kitchenowl/ingress.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: kitchenowl-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`kitchen.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: kitchenowl-web
-      port: 8080
-
-  tls:
-    certResolver: default-tls 

apps/kitchenowl/kitchenowl-config.configmap.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kitchenowl-config
-data:
-  FRONT_URL: https://kitchen.kluster.moll.re
-  DISABLE_USERNAME_PASSWORD_LOGIN: "true"

apps/kitchenowl/kitchenowl-oauth.sealedsecret.yaml

@@ -1,19 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: kitchenowl-oauth
-  namespace: kitchenowl
-spec:
-  encryptedData:
-    JWT_SECRET_KEY: AgAclRIJS25ACVe4NqLQbAree6c6WpTBHnLpe3ZQJ0ScHG/EbW/ooABZj7y1ABAn/mCc+hBYXYHm81FNUfUtSuLKi2UlORbTCsfmisYH49WX0Lpku9LTM/8az9tjE0tjUUrJZcRUuJfdNJMDPQx7IPjUQ7sKk/exFnkPEbK98+AElXyHpPKXd9dxiCgll0n+ksbF9BDUR8KY8IB2Zvh4cXPww578qe/9XYnxLV8uY9K8KPvhl7NI40SIaL4PX8KmsDlBh1bpOR/OxhIwAGEZDQp/KROy6msrIOYW4SHM9nlSUSD4WvV8UjcbV1oNnYpE1usFOuxSfQlJ1zlFepKUv40JykyunvQv9nqVbEogsrS4o5N3gNEaB9yyFSHIlevp32LVpAuZu3cNplmT+Zg7+ODpCWIcVgmOAeapvB+X7H4ScbKVcYLAzrRFDtnS4Vo1M+RERhr0AuMU/tz0lGs99oRkCw2ZIg015R125u0VcRNqzgCtbBM5BFiKiP2kYrHn02Q6o5tRWxDQfrfb0mnfD5c/gM4+btlfM6DZMpr/l1kLlm8PDEpPGbkhK1XiAyJ4erHPDMLcmZXrSyxX9R1g8n7vnLnkqx5LkGmnltQI2FM7StxC6IrMlxY0nPnkq1lHhTz7yCpQJNXgfXZLVvov+f6jlD6WJhYHZCL/hIFfx3ybjGYZwJ0m84lH0OQJQw5dtsbPVqqoYZIPieqdRmHw7M7TTmFuQJXD94lZj5gsln1sMqs=
-    OIDC_CLIENT_ID: AgDOxWtGCiFrIP5aWHimrR6bu0uMS1/i1v1Kzo1lIR3j3zlw/Da2oCPNx1ZuhNAp9UMIs2euc8mtrWkyv4R6pcci+IxXiGzlQNBSkMfWu4DwhwlEdnVyCVehfE00t0ytBxX6NeLfS1b8JOtH9yo3e22fdaeTwn/iwGLNwi1BJxMmzk9pVp7jzXH09Zia8UvUmXw5GyGpIOIiGcIfaXkr1ZnY2l30jTw8eS7HaouzfWHWTpNXkMLN3qim4vs/B1Sgz/y9tUyVo/qMhWLdEcVklYHT7xHx03SPD7RtK+zdYZCqvDtj+tsdpYHt05zeGV+wflNQuiocjwP8TW7vhtbjKrf9lQIxB5CErju178ELOVrpsPBAYMgdEl7qZeKdSpydIwe3VbOg3XJ7O/Ps1KSnRYwrCvgE4ZCMm3geHyJxSiKRhBcuVYz5JkNd5ylD0Eq9NL5RCqJ4szL9NaGNPbzkvcdZzAnbTYFTzyqZ+XHX/BUFisXl5bKNHtaqAsOK8woGYnxJiawKRrwDUmHXU4RB3QiPCPhHSLU7OkvU+XDhyQqLa8bKEQzj9dUf4bX3Savk4noiRsXMYJznAlgMPo0Q4taxVIoyQHELYwIIdP5YRuw27B9wKUR7e2hhu4FTOEcyhwuFql3OuAjq8HJCDX6+COkL2WYFFxWBnbSCYEdzfbMBCHjrUUonijcQluU2VbaHODNMAvB16MRKapAW
-    OIDC_CLIENT_SECRET: AgAylnSUXwInlh/WvyCiFz+8asbCSZA6kk84Rt6l7bHVYw34c58lJHsZK2OvOIlHuaMe/ewnTqxVd0hI1Azl+wd/5NygMYlntKquq0vuzlhLrGc3u+0SOn9N2P6quA3slF9KR94CYsDx9ogy+EsEoA1yrsydB8S0g9W8syraR1MtpM0ZkcJ/D78OZ6qzyXUuBNAZc+iX/r96NvoMiGNYavgG7npOJh/pkKNYPuNkt4zpbAFjVyoCfgZd4V2nmZ6dhEVy8odW+jcsMn6OJ1OZVlPb1beq49lBEcaJqk83ZtKbq2evtBYHw9YAnENVq92ecenw/YL5LXUhOxeN0M9Amo99/O6pQwwrT1mtZqhTTeTIZTAxqmJKgyxGhE4DJUR/s71bc7K9hd2WvdAYnCyVC2uGa0MwXp4V7UuaN9GerldT8lcFxOpRnD7yroqVTqebjAJIkIinp5NNZ2ZP/LCiCwKKHHT19Pchn615WOPTofC6es/spIdQ8a1Nf2J5YzvRjsduFS55U6tMaC7cuV8kqKH9xTTf/sDHt+68wVEAO9koAe1zpO+zR2Pq3VuCnvcDGIwXopXjvyjfujEEhEWZl51PVJLZqtkP5Wg2wHvlgjJBbbIGTrqh4xa9pK7wLDM2hUFx1q/YKqwfP0EGVTc96G8Wermj0DtIqclqFLr54DtxVe+Rr8J4edG6YQ26/seYsrZ1Oq2PejHQt8u9EzQYAtYYlBsw2ujCWys6KrbhaVr3
-    OIDC_ISSUER: AgA2JPd5axkL5YIRA95qm/iH8wgM2J0AjKjgGClWabYJ3UKIk0hi/L/zR+1Pw9Z+6amYXj7Q0FxLqCcNYG+H5ABxnqUi7Gl8gvfVbegaO3q5QiO27g18RMDssNHDSun8PPaxHBvBD68hxgsaXntu8sZavCGdwEK0TzLJi7eH/4jtHlofzfYgaCsGqeOBgvs/q87PVJ/qxazXlY9e7abbRAKl9ZMY7Wga58/IU2HhWwYMvI53yQyGMcKf3XiI9iNHgIcj1+TmlgQo+PRKyopNfzgFbey7on8woQXphY+ioqQ0hyworpxAVoWlvzKKopt1xBDr4zxzkzbWyxtjwPVOOH3iyenZz8tZa/JkNYWxkWHbh0KCs9yUIji3D3shQOFM/NtE17THsQm3NgpZ2lg9ET1v6uXqwfOLiQ+J1JQLwNFnYeruH2lK4EGt2nDCq2VycOIjW4kMpiJ4LiT8gap9HwYjTpAn+opicYn5e9fmpgiHdMPvrsG1m9edg0cbwdSpEelliHnAUfKsxMV2e1fLsga6yrhBLSXIQs8rbURRa6wqVvGoLB86a9Q5Rm94Jfm0Sa9v5LMGRYvqO5LbLrjrR8e/2r17pHQE8ynMQCAW1yVTe09FcgRwYhDUohfThtjIh16sdoC97eUel7fo/POt3atP69JsCIBZstprhVtBIBssmavpIotVqi8F2/yUkhrZR26mH3gsOxkNTEk6XzHHtJRu0cU+BmObTvYgMi3DHg==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: kitchenowl-oauth
-      namespace: kitchenowl
-    type: Opaque

apps/kitchenowl/kustomization.yaml

@@ -1,17 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources: 
-  - namespace.yaml
-  - pvc.yaml
-  - kitchenowl-oauth.sealedsecret.yaml
-  - kitchenowl-config.configmap.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-
-namespace: kitchenowl
-
-images:
-  - name: kitchenowl
-    newName: tombursch/kitchenowl
-    newTag: v0.7.3

apps/kitchenowl/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder

apps/kitchenowl/pvc.yaml

@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: kitchenowl-data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

apps/kitchenowl/service.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: kitchenowl-web
-spec:
-  selector:
-    app: kitchenowl
-  ports:
-  - port: 8080
-    targetPort: 8080

apps/linkding/deployment.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: linkding
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: linkding
-  template:
-    metadata:
-      labels:
-        app: linkding
-    spec:
-      containers:
-        - name: linkding
-          image: linkding
-          ports:
-            - containerPort: 9090
-          env:
-          - name: TZ
-            value: Europe/Berlin
-          envFrom:
-            - secretRef:
-                name: oauth-config
-
-          volumeMounts:
-            - name: linkding-data
-              mountPath: /etc/linkding/data
-          resources:
-            requests:
-              cpu: "100m"
-              memory: "200Mi"
-            limits:
-              cpu: "1"
-              memory: "1Gi"
-      volumes:
-        - name: linkding-data
-          persistentVolumeClaim:
-            claimName: data

apps/linkding/ingress.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: linkding-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`linkding.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: linkding-web
-      port: 9090
-
-  tls:
-    certResolver: default-tls 

apps/linkding/kustomization.yaml

@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources: 
-  - namespace.yaml
-  - ingress.yaml
-  - service.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - oauth.sealedsecret.yaml
-
-namespace: linkding
-
-images:
-  - name: linkding
-    newName: sissbruecker/linkding
-    newTag: "1.42.0"

apps/linkding/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder

apps/linkding/oauth.sealedsecret.yaml

@@ -1,22 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: oauth-config
-  namespace: linkding
-spec:
-  encryptedData:
-    LD_ENABLE_OIDC: AgBfiwAdh1RD8gpzzVnF6y3c8kn5NFbms0T74pmj1aaFD0uQd/dqIxrvZxiBMzgqdrrVUCxRlpG3tiJYMpDEVXQPwRj8uuAizYFEP4uuGFpCtErjb+Y+aOdXSPRCVPbIqROiE+qswNT5KkJm6rR3FPckWipiQdzfpoq+G00MARKqzo4sNrx8+JzgoBFbS/tVPej3VdmDy8iceeVCQ2dJs+roRw+jOfCxqiUjHH5SyoZPnCTlmTZcwr3F9gBGEWGyEl0FNVgL/ku7WEL2COeIIE/2r4RWPqZU4DkPtIv/J4Dosxuw7EQnC5kzTgJGB/TF9Mn/FcS7iYQZKATvWzjC/cTdwZ+aG1qZGz87wM4fxQ05GhgEUkVOlGgxlzxk9BUL3l9Xsaa1KTivaQ4dvB/jm3j12b9rPfO2CXB4jPK7Pk1vKbr5icPXa8dyFY4hiJ1PYh/295a7ZM02n3ao4uHw8KSaxK9GxsCFBxr59q+6ZpjOGnTHZvKGfJHn3jEcIT8k89J5gqrlWjLqR50TEJj3jPZ3QDPN/u1Bf0wAoIOGK7jpnwIXQpacudU2pxZNWC2KtdZbcF9QzuOqKVFABmabdCkBtLa34cyZdweBaCfLRg1Ic0yxrWGzctnwM0Rfd+OzsEpLB7GHKllV597znF5QiK3rQrl5TmgHf0jC1OmMsBkNYCRo2AhYsBN5nli0dgD1y028rsW6
-    OIDC_OP_AUTHORIZATION_ENDPOINT: AgBYHGF/D1tzWRy2issyi3oZjYK/m5cuwdlHuqboPBBHybfTwCkvSfWAL8FSGAgoLYWZEwwoGr5GDSCnAWfhoYwVgCxWw7y4IohCkUSrwbzTVwJxoRTeWIilzwAdH2zX3mZJVHTYCQiLTCjv+MPRsF5FZP4+STtgfecK5Fjgb3sIfZa/yazbN6jf7bdaR91yX2iddeZn7B80aQvu3jOkujPX9yCJz/H+1BN35CtC7KLhFrKgw6uvfQi3g90On5uBHwrC53ve4rEvcOgi575WBA3fDYW4RxNb8yxxocQOuqNRa3jUa/RIjOnX9tFoG/QIXY89DUSsgpAZFWIlV4np4KOe4V+xWT1khz2TPRDaakDumkNmE/sAjpYfGX13+88A0N/hO9o2aXJhEXOFZ5eulyAwDdIodMg6lQTG43OhdSZLFfR5TrnzkVR1pIzwPMutgf8jai4dyYK+SV+oyGeZosNpD484gzhjMGkz8Djs7/cADcvJVmGfWWYvjenlfvFC5lK7F+355o9L38fUeG2lhRw8NsPWuzsiH7m6GaSEfEPcdqj/AohArtUnf9cfF04tocPwCuNLeIgR42W+cfapD9g14sN9v4Z7g/5IQSqL2EhNR9xQMoIT9BkBEhI9JR518Yds/Z89Lg0HsMw6UCrkg6um1If80gjHyRa7JrfxzepKifWNn9/suHlhecaeXcSOKMCCFYDtHyvO4/gCe8/PXjyVc/SUZNBDJsDOikVvVJfKqDlEkimfl+BISzkMv5ALxGDHMRc=
-    OIDC_OP_JWKS_ENDPOINT: AgAg+6Ty8o++uc+UfaVNtJviu1A771rtazn9pj7KafqgIx1xNuPtUBwGEScfku8glUy0bS8r7MyMNlUe3sIYfnDKQmmHBVHFoiJ0IjLZP/pV51A4fT2DUrFv9pnIemqjFD2jew5ToXhuHwUc+Y3LvX8M8aPpB/J+DjIIvgKQe2faHyWt4c24jOZaH56xJhI114LIXD0A7Qvq4O7UfpIUNfYSMojTH7VURptL18Mh1YRKJmil1PmRIstX9Smr3ltAG9Rw032v9ISdDmV+OyuhPo1Wk3AU85RdOQ9hZGMSFXQXFEqQUp/N76n875KDUMT4W57//YGFRUrm8w4oB+PlkjGV2pG7DNYVxUZEmi5UXwY8fTI+KljAZHSk/YOSku+gc75hWYXX6s3g/R6/IWmr9sV5O5N0bc3guQ96nnRmjuzb3HebM0hPfPS+6/xn29erTDETs1bvfCQ9oWNMomDsH4FVz5gC+zwrUvUD3Af3TVsU5g+lfOE83+pmMMWcJFn8Z0uldud0jR27o/ftKgBDmUaGi3zCQWJrYxtXehBy9fo0K7QpbYnLHvNnXVX9fGQ0PZNMc8N0wYZUDuhOv114lqfbVR5dHYoger4iT0xC+SHcWGgvyjqb4YI7bfnY+bnh8TLfuI/ttw1l7/ev79/yvjrtgPuBwN9ygUxENLR2Ur1Cc/u72d+ST4NIg5esth+y9Z2JdP/3+nlYctnyakWhEkUyBPK+5Iyacv29t1bMXoesB6Ub5WsXaw==
-    OIDC_OP_TOKEN_ENDPOINT: AgBRpyDYbQlq7dcqJ2Gd+CfSRZRgvpuUsIngAXX85dt0dChYhQ/YvnFl9r3GqsXNBrWQBa0uE7t+uXxo+oobjgfSibq28kQBL92PM/s7OctINTJBN3q0Gdv43vnliS69/WR21kZkLuAmPne1nL+FZJXavIUF8N6CX3gKb4WMdv+Rl4AAmUo9vsB1C7mxDcS1CppUeJ8KdF5qkb8Xag28Lv2rDA7W9Ne+tNGFi4q/UWqdU76iUxrHu/Kfg6RD0rYlOaW+0b3A5Rvj5oU8ho1Z/eIsA9NaZNYBQjtGAk9fiD2EB9IcFi6kYv5zGZsRcPTzMv/35Wh+lV8I3mDRGcfkmzQsZ8Hcfx7c3zpemZqvY7LMgrvO5AatWKYZUFPsTcaT/mVFmAaVuq5PqeuCQhqekug3rdQxxf2n1cWMMnbptf4g19oTFKx3FtXImpPk97Iv9RbMATKHE/nnfin5/7PtQNn9VBBW785hzzB7cs+IiEzdjGu7MnFlKaGEoS94eZtgLSEmpIMeXFW6V0rXHQ6J+CUjBjiEpAh6LKsh4De+IrWFuzAYH0jwowuY2r4VX3jx+Yv8SFEJ5AfDYbvx8qX1zy1dGfsQvrAai298QCOTizLmeuJLMIC0qlNLZWrYhf8XzF2/N8/bC0R0Pyr+6Jxo8HrtHyFcnl8ckHycWosCOkQmQIbX+vOffOpQ6vYUkHM4MqIAiTl6G+bxjtxBZUTXvqX1sKCEO7pccL8gJZQ+ICN9nP785JAd4eW2JeGW
-    OIDC_OP_USER_ENDPOINT: AgBD4amxFPHYQR6JWjNTsPM63NNI+f9DgZ9+whv5f3bUo7KNtB05vAYYQtAdMYJR+5499S6t0BYwOi4cNxQVJyga1bKogqih3EI/QlJeLvoFvDFj2wEMmCkT5MS+qemtPJwXK7JTHzUFX74b+S/a30/mvWKkMRHzc+G+E678/RDIScFJFssfJVMJB4Kp9T4y+v9jJAKZRixkx2lOR48JR5umXwxm+xQGaexeJOv0MZY4Am4P/nJcWM+Gk1Ka/ih+VAJRLsu9dgvShytQ1OHaAPMRu6H7Wb2bLrzpz4rTcGbZA3aTgHfItjWQpBV3fhNvyNW8QRbRFSyxHBC4snqW5Bl77u4KdMicwL/0x1JhwP6cx+/TVEyZ2n+5Y5PyOW+E7LXtiZGZ/eRw3xVLxvrFDwY0EBMqAUWHyQjwlZLctjxgBud5XDtT4athaNq5hnCELMepRI05kF+o5ECxKWoFXN5rXrwrlcgftCV9PTZbP8pkxyau8O28C4YX07J65G9ntV3VIg9tAXww6X68YHIQEdAgjNOI1soWt15q582OlhXBTTKAf/QU7mrSCn5FH0Q4Z7VLIsJwMz0orGB69Qxo/lLF7z+pQEE4PArceoLi7cffQV/+VzUBOACDdfKFiN3LTDuoMm6lvkAOdmzXccmXlEGvNEwLR+8Ac26Ld4fAnEFSLIJpwQHheIQRY19qbN5+cOa+RmuOroxWWA2P/8uSlp4kXVvAmPJOt8PprI3h8iRG5zBv+J8kE8wpI1scJdDr
-    OIDC_RP_CLIENT_ID: AgCOGuVP8BVfAT5FRmmJLptdv+8vtppOgpzJ2LXU3vR3sjQE4MLKgWwoAyrnkAa2IMrsmkg5+pyHBDlp1AMba3OTVZmhyEVLrFe/vCiL45hEaW2l6kiwlIW3nZnoJlGG2Ugj4SX8YCQGlyr19vEFcPdieWlKpHfda/EP4xYhXMSzXCxFCtT7uGjgnBlrV0uXeFCezYGzvmA4SbDli7fvGv5H85cwgUlMdSn2ZIP3DAxQ8gP0ETF6KaOK5QVP0e/7kw9SK3oo4XHE2c8AjHLFFnmz/uf07+7LuOunSqunolbVy+Lm2mHHnzx+0PBmMYvl7FHY/TkBZaVjVaZtrELbFYaraop8iE6hFMvOYNa/1BFY1x0aeRfPb0jt5IPnuebllnEh4P7JUQxef4Bqbjp8u7P+uOBWnQbeMEp5F3rWE8qy09NnjsKPz87Jw9pb0aPgXWLKVHjJpArhcb6gTJLESCw9kgT+c0pYI0s3BYmwNkJ+6wxflvTLb5z3YyY5/+8/s3PgDz6Hj4tyA8tBru/KQwnBVMw0GhF5YwlZ4SYHPwVX+ZMj9UQc6swNsrxKLqs5Ci7KjvzEDUJ4/aW+rv8naoCiebIJrbmLB8iSqNGh90s1S9BJsQaWXbKYday3spt0eg+tH/iQgAnUAjd9RK3TxkkmWVjmeUc/rOltsbaIvy6/WdyKnF8/f9B03Pm5eal73yC7reFyGYiXvA==
-    OIDC_RP_CLIENT_SECRET: AgA+Q9osGcUgiGsyPfHph3vGiNBjmL7pK3JlaE4PoI+eGsvb+3Ozf9KnfHSMm2R0fq/eukFn6i25MZ/mKYliVSIcjWbnGDFSysiCAwirKTUXoFUo87zmguNUPr8Rr45m1AIaJb31T4MKeFQRHSg715rs/6fKlbejUWUBZuMTN1DXkWr+00atj0JmmZPScSfRmwKNsHnoZCUWFE/DaFChpoCU4fCp5vL9P2LcdzsY84vue8y7Trg0e/LpEi6+DzSoxurE9jwjoUauXmZnOSW3jFgy+u5c9Oa3RC+IB/UUsmHI8eUVOXGdQsSFufrAMd1uyPRa2g+aCX0zX5boZC9dTGqaT+D/6xXnMFsvw5K+K4Y/QZ+j9ZHx0232sPCFVi2HaYHV51c2Xi6tizy+/0J27/4gvaVREXw94pmsaI5rt9sNDHoKw6LwkPO8heqkYzfIWhAg5vKswDn/MWAVTIzIubdTvrDjVWxoJ2FM9sCUsai/X7rj6QUiVTgbWuYYO0hMrT2Q9y05n68hWOmpqmna4/JGIE+N48h0/wAHLsLeV4ZNLJdJhQovOSkYsB5FIYPTuihFASLhE+uf8VBwSfYlwcWORz7dssAYvCJAx3huYZCSHrT4WPtLt4Ok/IuplXvVbZ/d6NISqE/g+BiNmN7r4DZQ/QbN4TD9t6BQESKkTqPHYIiVtZHdalgPFFSS8JP2wv50mSh/imjlX51ruHGQbVbIfZnfJGwLEL0KN/Zn3BMrNtMgCqEs3itnGQQnBchQ
-  template:
-    metadata:
-      creationTimestamp: null
-      name: oauth-config
-      namespace: linkding
-    type: Opaque

apps/linkding/pvc.yaml

@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

apps/linkding/service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: linkding-web
-  labels:
-    app: linkding
-spec:
-  selector:
-    app: linkding
-  ports:
-  - port: 9090
-    targetPort: 9090
-    name: http

apps/media-downloads/jackett.deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jackett
+spec:
+  selector:
+    matchLabels:
+      app: jackett
+  template:
+    metadata:
+      labels:
+        app: jackett
+    spec:
+      containers:
+      - name: jackett
+        image: jackett
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 9117
+        volumeMounts:
+        - name: media
+          mountPath: /media
+        - name: config
+          mountPath: /config
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: media-downloads
+      - name: config
+        persistentVolumeClaim:
+          claimName: transmission-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: jackett
+spec:
+  selector:
+    app: jackett
+  ports:
+    - protocol: TCP
+      port: 9117
+      targetPort: 9117
+  type: ClusterIP

apps/media-downloads/kustomization.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: media-downloads
+
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - transmission.deployment.yaml
+  - radarr.deployment.yaml
+  - jackett.deployment.yaml
+
+
+images:
+  - name: transmission
+    newName: haugene/transmission-openvpn
+    newTag: 5.3.1
+  - name: jackett
+    newName: lscr.io/linuxserver/jackett
+    newTag: latest
+  - name: radarr
+    newName: lscr.io/linuxserver/radarr
+    newTag: 5.4.6
+
+
+---
+# 2nd version
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: media-downloads
+
+
+resources: 
+  - namespace.yaml
+  - pvc.yaml
+  - qbittorrent.deployment.yaml
+  - qbittorrent.service.yaml
+  - qbittorrent.configmap.yaml
+  - radarr.deployment.yaml
+  - radarr.service.yaml
+  - radarr.configmap.yaml
+  - openvpn.secret.yaml
+
+images:
+  - name: qbittorrent
+    newName: binhex/arch-qbittorrentvpn
+    newTag: 5.0.1-1-02
+  - name: radarr
+    newName: hotio/radarr
+    newTag: release-5.14.0.9383

apps/media-downloads/pvc.yaml

@@ -1,23 +1,35 @@
-kind: PersistentVolumeClaim
 apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
-  name: stump-data
+  name: radarr-config
 spec:
   storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: "1Gi"
 ---
-kind: PersistentVolumeClaim
 apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
-  name: stump-config
+  name: qbittorrent-config
 spec:
   storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 10Gi
+      storage: "1Gi"
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: data
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "10Gi"

apps/media-downloads/qbittorrent.configmap.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: qbittorrent
+  labels:
+    app: qbittorrent
+data:
+  VPN_ENABLED: yes
+  VPN_USER: vpnbook
+  VPN_PASS: e83zu76
+  VPN_PROV: custom
+  VPN_CLIENT: openvpn
+  LAN_NETWORK: 10.244.0.0/24,10.9.0.0/24
+  WEBUI_PORT: "8080"
+  ENABLE_STARTUP_SCRIPTS: no

apps/media-downloads/qbittorrent.deployment.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+spec:
+  selector:
+    matchLabels:
+      app: qbittorrent
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: qbittorrent
+    spec:
+      containers:
+      - name: qbittorrent
+        image: qbittorrent
+        ports:
+        - containerPort: 8080
+        envFrom:
+        - configMapRef:
+            name: qbittorrent
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: config
+          mountPath: /config
+
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: data
+      - name: config
+        persistentVolumeClaim:
+          claimName: qbittorrent-config

apps/media-downloads/qbittorrent.service.yaml

@@ -0,0 +1,12 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: qbittorrent
+spec:
+  selector:
+    app: qbittorrent
+  type:  ClusterIP
+  ports:
+  - name: qbittorrent
+    port:  8080
+    targetPort:  8080

apps/media-downloads/radarr.configmap.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: radarr
+  labels:
+    app: radarr
+data:
+  # VPN_ENABLED: "true"
+  # VPN_CONF: "wg0"
+  # VPN_PROVIDER: "generic"
+  # VPN_LAN_NETWORK: "192.168.1.0/24"
+  # VPN_LAN_LEAK_ENABLED: "false"
+  # VPN_EXPOSE_PORTS_ON_LAN: ""
+  # VPN_AUTO_PORT_FORWARD: "false"
+  # VPN_AUTO_PORT_FORWARD_TO_PORTS: ""
+  # VPN_KEEP_LOCAL_DNS: "false"
+  # VPN_FIREWALL_TYPE: "auto"
+  # VPN_HEALTHCHECK_ENABLED: "false"
+  # PRIVOXY_ENABLED: "false"
+  # UNBOUND_ENABLED: "false"

apps/media-downloads/radarr.deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: radarr
+spec:
+  selector:
+    matchLabels:
+      app: radarr
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: radarr
+    spec:
+      containers:
+      - name: radarr
+        image: radarr
+        ports:
+        - containerPort: 7878
+        envFrom:
+        - configMapRef:
+            name: radarr
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: config
+          mountPath: /config
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: data
+      - name: config
+        persistentVolumeClaim:
+          claimName: radarr-config

apps/media-downloads/radarr.service.yaml

@@ -0,0 +1,12 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: radarr
+spec:
+  selector:
+    app: radarr
+  type:  ClusterIP
+  ports:
+  - name: radarr
+    port:  7878
+    targetPort:  7878

apps/media-downloads/transmission.deployment.yaml

@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: transmission
+spec:
+  selector:
+    matchLabels:
+      app: transmission
+  template:
+    metadata:
+      labels:
+        app: transmission
+    spec:
+      containers:
+      - name: transmission
+        image: transmission
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 9091
+        env:
+        - name: OPENVPN_PROVIDER
+          value: PROTONVPN
+        - name: LOCAL_NETWORK
+          value: 10.42.0.0/16
+        - name: OPENVPN_CONFIG
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: country
+        - name: OPENVPN_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: username
+        - name: OPENVPN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: protonvpn
+              key: password
+        volumeMounts:
+        - name: media
+          mountPath: /data
+        - name: config
+          mountPath: /config
+        securityContext:
+          capabilities:
+            add: ["NET_ADMIN"]
+      volumes:
+      - name: media
+        persistentVolumeClaim:
+          claimName: media-downloads
+      - name: config
+        persistentVolumeClaim:
+          claimName: transmission-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: transmission
+spec:
+  selector:
+    app: transmission
+  ports:
+    - protocol: TCP
+      port: 9091
+      targetPort: 9091
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: protonvpn
+type: Opaque
+stringData:
+  country: at.protonvpn.udp,fr.protonvpn.udp,pl.protonvpn.udp,ch.protonvpn.udp
+  username: VOYkNuZs5PHjeB8w
+  password: WvKCOPijcXKOqcL5d7zjXzOPToS4zPid

apps/media/ingress.yaml

@@ -1,5 +1,24 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
+metadata:
+  name: jellyfin-vue-ingress
+  namespace: media
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`media.kluster.moll.re`)
+      middlewares:
+        - name: jellyfin-websocket
+      kind: Rule
+      services:
+        - name: jellyfin-web
+          port: 80
+  tls:
+    certResolver: default-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
 metadata:
   name: jellyfin-backend-ingress
   namespace: media
@@ -7,7 +26,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`media.kluster.moll.re`) && !Path(`/metrics`)
+    - match: Host(`media-backend.kluster.moll.re`) && !Path(`/metrics`)
       middlewares:
         - name: jellyfin-websocket
         - name: jellyfin-server-headers

apps/media/jellyfin.servicemonitor.yaml

@@ -0,0 +1,17 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: jellyfin
+  labels:
+    metrics: prometheus
+spec:
+  selector:
+    matchLabels:
+      app: jellyfin-server-service
+  endpoints:
+  - path: /metrics
+    targetPort: jellyfin
+
+# this exposes metrics on port 8096 as enabled in the jellyfin config
+# https://jellyfin.org/docs/general/networking/monitoring/
+# the metrics are available at /metrics but blocked by the ingress

apps/media/kustomization.yaml

@@ -5,11 +5,16 @@ namespace: media
 resources: 
   - namespace.yaml
   - pvc.yaml
-  - deployment.yaml
+  - server.deployment.yaml
-  - service.yaml
+  - server.service.yaml
+  - web.deployment.yaml
+  - web.service.yaml
   - ingress.yaml
 
 images:
   - name: jellyfin/jellyfin
     newName: jellyfin/jellyfin
-    newTag: 10.10.7
+    newTag: 10.9.0
+  - name: ghcr.io/jellyfin/jellyfin-vue
+    newName: ghcr.io/jellyfin/jellyfin-vue
+    newTag: stable-rc.0.3.1

apps/media/server.deployment.yaml

@@ -18,9 +18,6 @@ spec:
           limits:
             memory: "2Gi"
             cpu: "2"
-          requests:
-            memory: "128Mi"
-            cpu: "250m"
         ports:
         - containerPort: 8096
           name: jellyfin

apps/media/web.deployment.yaml

@@ -0,0 +1,27 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jellyfin-web
+spec:
+  selector:
+    matchLabels:
+      app: jellyfin-web
+  template:
+    metadata:
+      labels:
+        app: jellyfin-web
+    spec:
+      containers:
+      - name: jellyfin-web
+        image: ghcr.io/jellyfin/jellyfin-vue
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "30m"
+        ports:
+        - containerPort: 80
+        env:
+        - name: TZ
+          value: Europe/Berlin
+        - name: DEFAULT_SERVERS
+          value: "https://media-backend.kluster.moll.re"

apps/media/web.service.yaml

@@ -0,0 +1,12 @@
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: jellyfin-web
+spec:
+  selector:
+    app: jellyfin-web
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80

apps/minecraft/README.md

@@ -1,11 +1,3 @@
-## Setup
-Because minecraft is quite sensitive to io performance, we want the data to be stored on a local disk. But hostpath is not well supported in talos (and is not persistent), so we use an ephemeral volume instead. In order to do this, we create an emptyDir volume and mount it to the pod.
-
-We use an initContaier that copies the data to the local storage. Afterwards, copying from the local storage back to the persistent storage is handled by a preStop lifecycle event.
-
-This way, we can have the best of both worlds: fast local storage and persistent storage.
-
-
 ## Sending a command
 ```
 kubectl exec -it -n minecraft deploy/minecraft-server -- /bin/bash

apps/minecraft/curseforge.sealedsecret.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: curseforge-api
-  namespace: minecraft
-spec:
-  encryptedData:
-    key: AgDG6apUvB38rB9tH+/ya5Af/32IUJjHiEGZFdYYqesuqyPB/qf99EtC/7CwqD6bDQQPVycJVcxwZuF8QtYfPXzv//yMkqEUJ2G1/Q5J8I6bjNGLR636UhliUpCkH1QDOspWJUjwKDVxlFN9l0g9UajvxnqLyGzbWPeay0sJEBvAY8ltEZpLP21V+GD+HgPk3HIfSFFBMsULS6GPCjMaFxkxQb6cG3K4Ej4NHCHRGOmax+4Rk7lwMyAHlXLlrwj/ytxrnHDWrugLIJE9KKmJn6UVNTuk6olgkhleg2PixV7oOiDVyu9ZQP8wbdppzRix6dnIcFEYJ1ZDK1rNF5QErYO0gBytiJnSsdFO0jUMsdBrho2FgUc5GgIdmgXWJJz3lrGFqXaRVvbPsBZTUAsQRh2+4IfqfWmAkEjBcjs1K8WWJfS+rO9e02KoHBT4decdsd8Qfr5EFdPIzMrkUoRMI9CJnIa5u2nR08Hhd9iojbL64FZ26kXMODtEdKmlo+HwjufLX5rYJVSfOyZYzivd/kgKA87YTFaMLKej07w3ofGrPYSoCnmLfJyoQdNyJhdonBDsgM1GgRWQZDpgJ1df0SB02A5lZ4V7lHWr8KlANv9YLuMoZnVehsH1NZjNQHDInIRiTLahEBbjcJzQz4vU1UWG100ATszEYKOUVkzPnTgkqKYU99ZQ23bHP8z7iAWQeumb6V84NTi6jNITBvU4yTFLuAiI3nW34Vb1mFVLwfWqMjEYX8gBB4yMSaVshB/japfkyXU0pYg4mK9gsB4=
-  template:
-    metadata:
-      creationTimestamp: null
-      name: curseforge-api
-      namespace: minecraft
-    type: Opaque

apps/minecraft/deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: minecraft-server
+spec:
+  selector:
+    matchLabels:
+      app: minecraft-server
+  template:
+    metadata:
+      labels:
+        app: minecraft-server
+    spec:
+      containers:
+      - name: minecraft-server
+        image: minecraft
+        resources:
+          limits:
+            memory: "4000Mi"
+            cpu: "2500m"
+          requests:
+            memory: "1000Mi"
+            cpu: "500m"
+        ports:
+        - containerPort: 25565
+        env:
+        - name: EULA
+          value: "TRUE"
+        - name: MODPACK
+          value: "https://www.curseforge.com/api/v1/mods/711537/files/5076228/download"
+        - name: VERSION
+          value: "1.18.2"
+        # - name: VERSION
+        #   value: "1.16.5"
+        # - name: MODPACK
+        #   value: "https://mediafilez.forgecdn.net/files/3602/5/VaultHunters-OfficialModpack-1.12.1-Server.zip"
+        - name: INIT_MEMORY
+          value: "1G"
+        - name: MAX_MEMORY
+          value: "3G"
+        - name: MOTD
+          value: "VaultHunters baby!"
+        - name: ENABLE_RCON
+          value: "false"
+        - name: CREATE_CONSOLE_IN_PIPE
+          value: "true"
+        - name: ONLINE_MODE
+          value: "true"
+        volumeMounts:
+        - name: minecraft-data
+          mountPath: /data
+
+      volumes:
+      - name: minecraft-data
+        persistentVolumeClaim:
+          claimName: minecraft-data

apps/minecraft/job.yaml

@@ -1,92 +0,0 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: start-server
-spec:
-  template:
-    metadata:
-      labels:
-        app: minecraft-server
-    spec:
-      restartPolicy: OnFailure
-      initContainers:
-      - name: copy-data-to-local
-        image: alpine
-        command: ["/bin/sh"]
-        args: ["-c", "cp -r /data/* /local-data/"]
-        volumeMounts:
-        - name: local-data
-          mountPath: /local-data
-        - name: minecraft-data
-          mountPath: /data
-      containers:
-      - name: minecraft-server
-        image: minecraft
-        resources:
-          limits:
-            memory: "11000Mi"
-            cpu: "5"
-          requests:
-            memory: "1500Mi"
-            cpu: "500m"
-        ports:
-        - containerPort: 25565
-        env:
-        - name: EULA
-          value: "TRUE"
-        - name: TYPE
-          value: "AUTO_CURSEFORGE"
-        - name: CF_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: curseforge-api
-              key: key
-        - name: CF_PAGE_URL
-          value: "https://www.curseforge.com/minecraft/modpacks/vault-hunters-1-18-2/files/6807187"
-        - name: VERSION
-          value: "1.18.2"
-        - name: INIT_MEMORY
-          value: "1G"
-        - name: MAX_MEMORY
-          value: "10G"
-        - name: MOTD
-          value: "VaultHunters baby!"
-        - name: ENABLE_RCON
-          value: "false"
-        - name: CREATE_CONSOLE_IN_PIPE
-          value: "true"
-        - name: ONLINE_MODE
-          value: "false"
-        - name: ENABLE_AUTOSTOP
-          value: "true"
-        - name: AUTOSTOP_TIMEOUT_EST
-          value: "1800" # stop 30 min after last disconnect
-        volumeMounts:
-        - name: local-data
-          mountPath: /data
-
-      - name: copy-data-to-persistent
-        image: rsync
-        command: ["/bin/sh"]
-        # args: ["-c", "sleep infinity"]
-        args: ["/run-rsync.sh"]
-        volumeMounts:
-        - name: local-data
-          mountPath: /local-data
-        - name: minecraft-data
-          mountPath: /persistent-data
-        - name: rsync-config
-          mountPath: /run-rsync.sh
-          subPath: run-rsync.sh
-
-
-      volumes:
-      - name: minecraft-data
-        persistentVolumeClaim:
-          claimName: minecraft-data
-      - name: local-data
-        emptyDir: {}
-      - name: rsync-config
-        configMap:
-          name: rsync-config
-          defaultMode: 0777

apps/minecraft/kustomization.yaml

@@ -6,19 +6,10 @@ namespace: minecraft
 resources:
   - namespace.yaml
   - pvc.yaml
-  - job.yaml
+  - deployment.yaml
   - service.yaml
-  - rsync.configmap.yaml
-  - curseforge.sealedsecret.yaml
-
 
 images:
   - name: minecraft
     newName: itzg/minecraft-server
     newTag: java21
-  - name: alpine
-    newName: alpine
-    newTag: "3.22"
-  - name: rsync
-    newName: eeacms/rsync
-    newTag: "2.7"

apps/minecraft/rsync.configmap.yaml

@@ -1,42 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: rsync-config
-data:
-  run-rsync.sh: |-
-    #!/bin/sh
-    set -eu
-    echo "Starting rsync..."
-
-    no_change_count=0
-
-    while [ "$no_change_count" -lt 3 ]; do
-      # use the i flag to get per line output of each change
-      rsync_output=$(rsync -avzi --delete /local-data/ /persistent-data/)
-      # echo "$rsync_output"
-
-      # in this format rsync outputs at least 4 lines:
-      # ---
-      # sending incremental file list
-      #
-      # sent 145,483 bytes  received 717 bytes  26,581.82 bytes/sec
-      # total size is 708,682,765  speedup is 4,847.35
-      # ---
-      # even though a non-zero number of bytes is sent, no changes were made
-
-      line_count=$(echo "$rsync_output" | wc -l)
-
-      if [ "$line_count" -eq 4 ]; then
-        echo "Rsync output was: $rsync_output"
-        no_change_count=$((no_change_count + 1))
-        echo "No changes detected. Incrementing no_change_count to $no_change_count."
-      else
-        no_change_count=0
-        echo "Changes detected. Resetting no_change_count to 0."
-      fi
-
-      echo "Rsync completed. Sleeping for 10 minutes..."
-      sleep 600
-    done
-
-    echo "No changes detected for 3 consecutive runs. Exiting."

apps/monitoring/grafana-admin.sealedsecret.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: grafana-admin-secret
+  namespace: monitoring
+spec:
+  encryptedData:
+    password: AgBe8isrCWd5MuaQq5CpA+P3fDizCCDo23BVauaBJLuMRIYbVwpfahaJW7Ocj3LTXwdeVVPBrOk2D6vESUXu6I0EWc3y/NFN4ZezScxMcjmeaAb+z1zWwdH0FynTPJYOxv1fis1FDTkXDmGy3FXo5NDK9ET899TtulKFkh7UqSxdrRWbD3pegJgqKGPIqDCTAxZN/ssiccfWGS4lHqQBJkXn8DeampcKwjOCvgaBdilF03GoSfpgsqa2Iw2SfTDEobWBWVMMK/RB3/Oi/YJkGwMW3ECUxvTDam8gb0RFA1xjWXoYTLVVP5fK7q7x63ns51HebloxAP1GBrt138N/iDrfbGfjNP8Lx0NFl5y5bTgYN/z8DVTOFf90xxWe+YYERdwllg0Ci1JLNbA+NszXTD4L/HC7a8XuBfjRzxMTeymNjR76jzfPkH6v1EvesOduTfSrahPgS0qS+eGOier1rHxj3EBRhOScY1ut5Bq4oJMNId9nMVbVa6xyq2HyxuJHXV+j6h5FGHmEXn9gIR7wGp8RhtPhKgVGLrHcbHZ5Th2E7eomz1T2NK/ezNP8ZhcwOj/lyGywlW0vhU798zpWhMf57k2OPeuMlfs8Y8y74epBdyBjsrMR4EDctF8RZR3vraxENiMJ6kk1gqKj04ir6HwL7blqwiybIFFnJrp2j7MzgjS4SQ687qMX5Zf5XT03aEE+9W9Epy73tT7zVQKdENCQlcm5
+    user: AgAdiOivMn0d+nYjYycMZz9QSiS/9QqwHPJQMHkE7/IOou+CJtBknlETNtdv84KZgBQTucufYqu3LR3djOBpdnQsYbIXDxPFgRZQ11pwu/sO2EGifDk218yyzzfZMvx1FL7JL4LI1rKoiHycZowCwsAjEtlICVOOYv1/Plki+6MHXiAGG4r/yUhugGx3VLLX+Poq8oaTeHndgSsFXJege8SfgYR4TsC7pQgsM1UQEFncGIhJYTD2ashmUxFJ+7CJjHqPR0lFRrZXmFvPwTYTCMT+tnSHnCFWtTht8cEi1NxA4kD/eKEX0rOol15EUZnFUws2WqWI634TbyGwZ7km/Yw4XoDxiQR4ar6ulkqb/djcc3cWDYE7PF1m1c+r3iog85S5CSfZ5EvdCHHrbPN9uO2gmoRQWiR5qI70YMxBSnkeLZWN05O1vUuopdXFDTafY7YskxLEdIGHGqFUpUrJZOvBB0zNBdHGgYxFzb5pNmMCC5LPlOuoKjV4yskh9Tgovz06aAvsPxn2WWx6NOJambeziKB5OmSKvPsFofViyGBekVAWSWtt9yJe6lu5OKpBEiA6xhGhQ4ZryTXu9wvVALuPSIwBFITv85sIxjJb80qhJ51wb12QgzLLcPby0HSanyBI1M4jfsXWpK8gIAbDNO+eD7z3PhD9Y/5hPqYKXZ37Geyq23xiyxG8XDj6cL+Ie6k8XipayI4=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: grafana-admin-secret
+      namespace: monitoring
+    type: Opaque

apps/monitoring/grafana.pvc.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: grafana-nfs
+spec:
+  capacity:
+    storage: "1Gi"
+  accessModes:
+    - ReadWriteOnce
+  nfs:
+    path: /export/kluster/grafana
+    server: 192.168.1.157
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: grafana-nfs
+spec:
+  storageClassName: ""
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "1Gi"
+  volumeName: grafana-nfs

apps/monitoring/grafana.values.yaml

@@ -16,12 +16,6 @@ serviceMonitor:
   ##
   enabled: false
 
-envValueFrom:
-  AUTH_GRAFANA_CLIENT_SECRET:
-    secretKeyRef:
-      name: grafana-auth
-      key: client_secret
-
 ingress:
   enabled: false
 
@@ -35,17 +29,13 @@ datasources:
   datasources.yaml:
     apiVersion: 1
     datasources:
-      - name: Prometheus
-        type: prometheus
-        url: http://prometheus.monitoring.svc:9090
-        isDefault: true
       - name: Thanos
         type: prometheus
-        url: http://thanos-querier.monitoring.svc:10902
+        url: http://thanos-querier.prometheus.svc:9090
-        isDefault: false
+        isDefault: true
-      - name: Loki
+      - name: Prometheus
-        type: loki
+        type: prometheus
-        url: http://loki.monitoring.svc:3100
+        url: http://prometheus.prometheus.svc:9090
         isDefault: false
 
 dashboardProviders:
@@ -77,23 +67,3 @@ grafana.ini:
   default_theme: dark
   unified_alerting:
     enabled: false
-  analytics:
-    check_for_updates: false
-  server:
-    domain: grafana.kluster.moll.re
-    root_url: https://grafana.kluster.moll.re
-  auth.generic_oauth:
-    name: Authelia
-    enabled: true
-    icon: signin
-    client_id: grafana
-    client_secret: ${AUTH_GRAFANA_CLIENT_SECRET}
-    scopes: openid profile email groups
-    empty_scopes: false
-    auth_url: https://auth.kluster.moll.re/api/oidc/authorization
-    token_url: https://auth.kluster.moll.re/api/oidc/token
-    api_url: https://auth.kluster.moll.re/api/oidc/userinfo
-    tls_skip_verify_insecure: true
-    auto_login: true
-    use_pkce: true
-    role_attribute_path: contains(groups[*], 'apps_admin') && 'Admin' || 'Editor'

apps/monitoring/influxdb.pvc.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: influxdb-nfs
+spec:
+  capacity:
+    storage: "10Gi"
+  accessModes:
+    - ReadWriteOnce
+  nfs:
+    path: /export/kluster/influxdb
+    server: 192.168.1.157
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: influxdb-nfs
+spec:
+  storageClassName: ""
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: "10Gi"
+  volumeName: influxdb-nfs

apps/monitoring/influxdb.values.yaml

@@ -0,0 +1,26 @@
+## Create default user through docker entrypoint
+## Defaults indicated below
+##
+adminUser:
+  organization: "influxdata"
+  bucket: "default"
+  user: "admin"
+  retention_policy: "0s"
+  ## Leave empty to generate a random password and token.
+  ## Or fill any of these values to use fixed values.
+  password: ""
+  token: ""
+
+
+## Persist data to a persistent volume
+##
+persistence:
+  enabled: true
+  ## If true will use an existing PVC instead of creating one
+  useExisting: true
+  ## Name of existing PVC to be used in the influx deployment
+  name: influxdb-nfs
+
+
+ingress:
+  enabled: false

apps/monitoring/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: monitoring
+
+resources: 
+  - namespace.yaml
+  - grafana.pvc.yaml
+  # - influxdb.pvc.yaml
+  - grafana.ingress.yaml
+  - grafana-admin.sealedsecret.yaml
+  - dashboards/
+
+
+helmCharts:
+  - releaseName: grafana
+    name: grafana
+    repo: https://grafana.github.io/helm-charts
+    version: 7.3.9
+    valuesFile: grafana.values.yaml

apps/monitoring/telegraf-speedtest.values.yaml

@@ -0,0 +1,52 @@
+env:
+  - name: HOSTNAME
+    value: "telegraf-speedtest"
+
+service:
+  enabled: false
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: false
+
+serviceAccount:
+  # Specifies whether a ServiceAccount should be created
+  create: false
+
+
+## Exposed telegraf configuration
+## For full list of possible values see `/docs/all-config-values.yaml` and `/docs/all-config-values.toml`
+## ref: https://docs.influxdata.com/telegraf/v1.1/administration/configuration/
+config:
+  agent:
+    interval: "2h"
+    round_interval: true
+    metric_batch_size: 1000
+    metric_buffer_limit: 10000
+    collection_jitter: "0s"
+    flush_interval: "10s"
+    flush_jitter: "0s"
+    precision: ""
+    debug: false
+    quiet: false
+    logfile: ""
+    hostname: "$HOSTNAME"
+    omit_hostname: false
+  processors:
+    - enum:
+        mapping:
+          field: "status"
+          dest: "status_code"
+          value_mappings:
+            healthy: 1
+            problem: 2
+            critical: 3
+  outputs:
+    - influxdb_v2:
+        urls:
+          - "http://influxdb-influxdb2.monitoring:80"
+        token: We64mk4L4bqYCL77x3fAUSYfOse9Kktyf2eBLyrryG9c3-y8PQFiKPIh9EvSWuq78QSQz6hUcsm7XSFR2Zj1MA==
+        organization: "influxdata"
+        bucket: "homeassistant"
+  inputs:
+    - internet_speed:
+        enable_file_download: false

apps/ntfy/kustomization.yaml

@@ -13,4 +13,4 @@ resources:
 images:
   - name: binwiederhier/ntfy
     newName: binwiederhier/ntfy
-    newTag: v2.14.0
+    newTag: v2.10.0

apps/paperless/deployment.yaml

@@ -1,63 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: paperless
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: paperless
-  template:
-    metadata:
-      labels:
-        app: paperless
-    spec:
-      containers:
-        - name: paperless
-          image: paperless
-          ports:
-            - containerPort: 8000
-          env:
-          - name: PAPERLESS_REDIS
-            value: redis://redis-master:6379
-          - name: PAPERLESS_TIME_ZONE
-            value: Europe/Berlin
-          - name: PAPERLESS_OCR_LANGUAGE
-            value: deu+eng+fra
-          - name: PAPERLESS_URL
-            value: https://paperless.kluster.moll.re
-          - name: PAPERLESS_OCR_USER_ARGS
-            value: '{"invalidate_digital_signatures": true}'
-          - name: PAPERLESS_SECRET_KEY
-            valueFrom:
-              secretKeyRef:
-                name: paperless-secret-key
-                key: key
-          - name: PAPERLESS_DATA_DIR
-            value: /data
-          - name: PAPERLESS_MEDIA_ROOT
-            value: /data
-          - name: PAPERLESS_APPS
-            value: allauth.socialaccount.providers.openid_connect
-          - name: PAPERLESS_SOCIALACCOUNT_PROVIDERS
-            valueFrom:
-              secretKeyRef:
-                name: paperless-oauth
-                key: provider-config
-          # - name: PAPERLESS_DISABLE_REGULAR_LOGIN
-          #   value: "True"
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          resources:
-            requests:
-              cpu: "100m"
-              memory: "200Mi"
-            limits:
-              cpu: "2"
-              memory: "4Gi"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: paperless-data
-

apps/paperless/ingress.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: paperless-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`paperless.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: paperless-web
-      port: 8000
-
-  tls:
-    certResolver: default-tls 

apps/paperless/kustomization.yaml

@@ -1,32 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - paperless-secret-key.sealedsecret.yaml
-  - paperless-oauth.sealedsecret.yaml
-
-namespace: paperless
-
-images:
-  - name: paperless
-    newName: ghcr.io/paperless-ngx/paperless-ngx
-    newTag: "2.18.4"
-
-
-helmCharts:
-  - name: redis
-    releaseName: redis
-    repo: https://charts.bitnami.com/bitnami
-    version: 22.0.7
-    valuesInline:
-      auth:
-        enabled: false
-      replica:
-        replicaCount: 0
-      master:
-        persistence:
-          storageClass: "nfs-client"

apps/paperless/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder

apps/paperless/paperless-oauth.sealedsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: paperless-oauth
-  namespace: paperless
-spec:
-  encryptedData:
-    provider-config: AgBI9IcNOfBevjUtIMwNTd0MTnr1WGxMKJ0cPnHzAS3cddmI+LTrkxxdRBuz2PFKTrhJ6/vh/2tiI9FBWMVm/YqTB64drbF3v13GfZMk/9c7W4SFyMoMcoE4xe6gs4SOm1ggTVxWT6O8IQ0gt7+FRUFaiLmwa08dxTkzrT0/zfQfYg+0aV8qS0eCJIrQk/IA1N31RpUoNV5Jl6vF7oE+cKIVyZ6LVMdecmFnuUgU+1qTC7ncgxxhWQekDQXJQnfYpgsQTF5GaHkGV8kvqJOa2Ohnk7MIeQEz5WuiKaXzU1ZMCYq3D8q/kaf/itLLBlL5MQh/hkuksCVG13aWxvulA/zIw3rSDujjZcSrD8LWH6oCMCn8zVcZjYQQBcTKUYEyYNvHLsmm0fOFIkUmFfBOS4WdHhjsBudz+941Wuc2EX5i6eLind7dk6gOlCL1HEyvbQRV6W50T104DQSNHslRG9CIjPh0BueGJ5fiaFoQa/UuM/JI8R/7cv3y5VkCG6j4gax9FVFgZKxPMtOTxB3gKolT25JHPDOqbDo996T4lsmiYRrYShni4JFZ8ALhcr7pKwlg+gVbDVaqMrVaSz1xzTP0MNxPMsojXVLtG3/Zv0/iXSVW4DPY67pFITEbZBWB3bHLvL9MiwKbWNwsDwPUylWkXTTFHsNbuRUnAXhRxcLn43uIv98JFTQcMVl2J9qrYkHm7w0FVImUr3oC+Ny/Z6j89ARposNx27B4FBgW7H7+yWMKRsAObC8cAjBOkBdXue0x5bEl7Al2BRRG7/WUKHXZvTOlvlj7GFTpLOQbPYjnBo8V8h42uOjGbiMLaCeN5sWlMtWD+7mpHV3XGdcGtPAZlIzgpUs2si/XIRNun2oDoUmJhb7YcGmugodcAK9+aYBThIkNU3guXdrM6Vc7CO2RP8PFpKBpcI9pUHgYA8dyYY+TaBqfYGrKFlGgoVcgh6oVkeOuctTX90XkojVFfqkCqab93faMh2pGCGcH4IZ81sdTYeWwNIvz1RGoi9GhUhQU5NfDeUBn2eHdOpfdsf4FkWe0kgE6TBPlQx7GQy56FldIc0G4QA8H8utL3E/MXYrao70ek/GHIxuev1/hzljJDk+5HJz5itBtKiW4s/5j2ZMD7MMBu/voDQW14XEK5pM9EbwmC6kRg6ljXvTlnUVmw1s04iUvIzF/dO6bCgaOEwFPjZj8oZs0dt64Ov+ZPLwTrmezFgHtfh4dyiRgHt4cO/WYFmzzYwd532p2De3JqjHUzT0iQIpkaz4jrF7+fdtDxtj7XgkJIg==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: paperless-oauth
-      namespace: paperless

apps/paperless/paperless-secret-key.sealedsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: paperless-secret-key
-  namespace: paperless
-spec:
-  encryptedData:
-    key: AgAjDxYW+bf+7a+65DR/u5Qrh37JSPQCstUrNWRdxq9We1eGf7qzTnmyke/O5TiE26rHVx3yzyK/Lcp/R+pJUnDauCvL6ja7k82DLzElkoRGhvRg4nr5Iehw488WIdJDXWqAbus4oLFCgnj5axs1B97hEiAN2onCPDsOuk7oSdJfG4mMI47Ass2qFPyQaff9TulLXQQEY5U7LrawCTudUPeiTCYGbOjBadPjEzn5pDwsyAd1G+NrqoPOwkrbNzrwMwbnwB4hLO0f+jrYOh2OMNcdZzMZgM671VH9cRYSVV6uz5iAN4A1NpZ1ZdenQN4pcWvaPmPOcvp14vjZtrYbGeyaNGnob5IycRrO4yaf+0V7DZ4Thwc/vqm6r5y/MR9U4Q9EFoNNHYmfo9VEw7LhivtaDOG8OaZXUnIFoXFLOZ59qfoZdIyK4eByTRQBZFZLK9rVgXOommbqlCgzNuDM7u11OGcYfROJFeiI9pH333x5u7GZsDz0hnAjWKphXzeTglXdaXMsQUeAHusdqKCn0X1cMatGUjkBAXwlOBrqmaDwSRdyc/+J2QIdkyQM9A+88+yoop7q8c5P8oizBikVaL7SojulUTJStH5cv7nRzhmpAY4j15+o3RQKrbEjGB4HVVx3VBFjjOiP9gfjhiYqxznYwkYTpXADPwjhLFf4opOPuhpoUD1M3OKXlQpPK/RvFTWWsh14jbJuL7WJpXbfyYs0+drbVdnYeUsn8OKlnFDoOaACdpNUCr6t9dSFMs7o7Mo8yN0E
-  template:
-    metadata:
-      creationTimestamp: null
-      name: paperless-secret-key
-      namespace: paperless

apps/paperless/pvc.yaml

@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: paperless-data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

apps/paperless/service.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: paperless-web
-spec:
-  selector:
-    app: paperless
-  ports:
-  - port: 8000
-    targetPort: 8000

apps/recipes/deployment.yaml

@@ -21,15 +21,12 @@ spec:
         ports:
         - containerPort: 9000
         env:
+          - name: ALLOW_SIGNUP
+            value: "true"
           - name: TZ
             value: Europe/Paris
           - name: BASE_URL
             value: https://recipes.kluster.moll.re
-          - name: ALLOW_SIGNUP
-            value: "true"
-        envFrom:
-          - secretRef:
-              name: mealie-oauth
         volumeMounts:
         - name: mealie-data
           mountPath: /app/data

apps/recipes/ingress.yaml

@@ -14,4 +14,3 @@ spec:
           port: 9000
   tls:
     certResolver: default-tls
-

apps/recipes/kustomization.yaml

@@ -6,12 +6,11 @@ namespace: recipes
 resources:
   - namespace.yaml
   - deployment.yaml
-  - mealie-oauth.sealedsecret.yaml
   - pvc.yaml
   - service.yaml
   - ingress.yaml
 
 images:
   - name: mealie
-    newTag: v3.1.2
+    newTag: v1.6.0
     newName: ghcr.io/mealie-recipes/mealie