Update ghcr.io/immich-app/immich-machine-learning Docker tag to v1.120.0

2024-11-06 17:04:15 +00:00
167 changed files with 489 additions and 2384 deletions
--- a/.envrc
+++ b/.envrc
@@ -1 +0,0 @@
-use nix
--- a/.gitignore
+++ b/.gitignore
@@ -3,7 +3,4 @@
 main.key

 # Helm Chart files
-charts/
-
-# Nix and local environment files
-.direnv/
+charts/
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Kluster setup and IaaC using argoCD


-### Description
+### Initial setup
 #### Requirements:
 - A running k3s instance
 - `sealedsecrets` deployed
@@ -27,61 +27,21 @@ The app-of-apps will bootstrap a fully featured cluster with the following compo
    - immich
    - ...

-## Setup instructions
-1. install sealedsecrets see [README](./infrastructure/sealedsecrets/README.md)
+#### Recap
+- install sealedsecrets see [README](./infrastructure/sealedsecrets/README.md)
    ```bash
    kubectl apply -k infrastructure/sealedsecrets
    kubectl apply -f infrastructure/sealedsecrets/main.key
    kubectl delete pod -n kube-system -l name=sealed-secrets-controller
    ```
-1. install argocd and the app-of-apps bundled with it
+- install argocd
    ```bash
    kubectl apply -k infrastructure/argocd
    ```
-
-
-> NOTE: The argocd kustomization already mentions some CRDs available only after the full bootstrapping (traefik). Some might fail to apply right away. Since the argo application is managed through argo as well, they will become available as all kluster applications are rolled out.
+- wait...


 ### Adding an application
-1. todo
-1. Don't forget to add the status badge.
+todo


-
-### Status
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=authelia-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/authelia-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=backup-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/backup-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=external-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/external-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=external-dns-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/external-dns-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=gitea-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/gitea-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=metallb-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/metallb-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=monitoring-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/monitoring-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=nfs-provisioner-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/nfs-provisioner-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=pg-ha-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/pg-ha-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=renovate-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/renovate-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=sealedsecrets-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/sealedsecrets-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=traefik-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/traefik-application)
-
-
---
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=adguard-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/adguard-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=audiobookshelf-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/audiobookshelf-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=code-server-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/code-server-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=files-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/files-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=finance-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/finance-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=grafana-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/grafana-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=homeassistant-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/homeassistant-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=immich-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/immich-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=kitchenowl-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/kitchenowl-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=linkding-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/linkding-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=media-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/media-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=minecraft-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/minecraft-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=ntfy-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/ntfy-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=paperless-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/paperless-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=recipes-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/recipes-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=rss-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/rss-application)
---
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=journal-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/journal-application)
-[![App Status](https://argocd.kluster.moll.re/api/badge?name=physics-application&revision=true&showAppName=true)](https://argocd.kluster.moll.re/applications/physics-application)
-
--- a/apps/adguard/configmap.yaml
+++ b/apps/adguard/configmap.yaml
@@ -27,10 +27,7 @@ data:
      ratelimit_whitelist: []
      refuse_any: true
      upstream_dns:
-        - tls://1.1.1.1
-        - tls://dns.google
-        - tls://p0.freedns.controld.com
-        - tls://dns.quad9.net
+        - https://dns10.quad9.net/dns-query
      upstream_dns_file: ""
      bootstrap_dns:
        - 9.9.9.10
@@ -38,7 +35,8 @@ data:
        - 2620:fe::10
        - 2620:fe::fe:10
      fallback_dns: []
-      upstream_mode: load_balance
+      all_servers: false
+      fastest_addr: false
      fastest_timeout: 1s
      allowed_clients: []
      disallowed_clients: []
@@ -74,8 +72,6 @@ data:
      dns64_prefixes: []
      serve_http3: false
      use_http3_upstreams: false
-      serve_plain_dns: true
-      hostsfile_enabled: true
    tls:
      enabled: false
      server_name: ""
@@ -92,14 +88,12 @@ data:
      private_key_path: ""
      strict_sni_check: false
    querylog:
-      dir_path: ""
      ignored: []
      interval: 2160h
      size_memory: 1000
      enabled: true
      file_enabled: true
    statistics:
-      dir_path: ""
      ignored: []
      interval: 24h
      enabled: true
@@ -116,10 +110,6 @@ data:
        url: https://someonewhocares.org/hosts/zero/hosts
        name: Dan Pollock's List
        id: 1684963532
-      - enabled: true
-        url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_3.txt
-        name: Peter Lowe's Blocklist
-        id: 1735824753
    whitelist_filters: []
    user_rules: []
    dhcp:
@@ -144,36 +134,13 @@ data:
      blocking_ipv6: ""
      blocked_services:
        schedule:
-          time_zone: Europe/Berlin
-          sun:
-            start: 18h
-            end: 23h59m
-          mon:
-            start: 18h
-            end: 23h59m
-          tue:
-            start: 18h
-            end: 23h59m
-          wed:
-            start: 18h
-            end: 23h59m
-          thu:
-            start: 18h
-            end: 23h59m
-          fri:
-            start: 18h
-            end: 23h59m
-          sat:
-            start: 18h
-            end: 23h59m
-        ids:
-          - reddit
+          time_zone: UTC
+        ids: []
      protection_disabled_until: null
      safe_search:
        enabled: false
        bing: true
        duckduckgo: true
-        ecosia: true
        google: true
        pixabay: true
        yandex: true
@@ -182,13 +149,11 @@ data:
      parental_block_host: family-block.dns.adguard.com
      safebrowsing_block_host: standard-block.dns.adguard.com
      rewrites: []
-      safe_fs_patterns:
-        - /opt/adguardhome/data/userfilters/*
      safebrowsing_cache_size: 1048576
      safesearch_cache_size: 1048576
      parental_cache_size: 1048576
      cache_time: 30
-      filters_update_interval: 168
+      filters_update_interval: 24
      blocked_response_ttl: 10
      filtering_enabled: true
      parental_enabled: true
@@ -203,7 +168,6 @@ data:
        hosts: true
      persistent: []
    log:
-      enabled: true
      file: ""
      max_backups: 0
      max_size: 100
@@ -215,4 +179,4 @@ data:
      group: ""
      user: ""
      rlimit_nofile: 0
-    schema_version: 29
+    schema_version: 27
--- a/apps/adguard/kustomization.yaml
+++ b/apps/adguard/kustomization.yaml
@@ -10,7 +10,7 @@ resources:
 images:
  - name: adguard/adguardhome
    newName: adguard/adguardhome
-    newTag: v0.107.69
+    newTag: v0.107.53

 namespace: adguard

--- a/apps/audiobookshelf/ingress.yaml
+++ b/apps/audiobookshelf/ingress.yaml
@@ -9,20 +9,9 @@ spec:
  routes:
  - match: Host(`audiobookshelf.kluster.moll.re`)
    kind: Rule
-    middlewares:
-    - name: buffering
    services:
    - name: audiobookshelf-web
      port: 80

  tls:
-    certResolver: default-tls
---
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: buffering
-spec:
-  buffering:
-    maxRequestBodyBytes: 10000000000 # approx 10gb
-    memRequestBodyBytes: 1048576
+    certResolver: default-tls 
--- a/apps/audiobookshelf/kustomization.yaml
+++ b/apps/audiobookshelf/kustomization.yaml
@@ -12,4 +12,4 @@ namespace: audiobookshelf
 images:
  - name: audiobookshelf
    newName: ghcr.io/advplyr/audiobookshelf
-    newTag: "2.30.0"
+    newTag: "2.16.2"
--- a/apps/avahi-reflector/daemonset.yaml
+++ b/apps/avahi-reflector/daemonset.yaml
@@ -1,25 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: avahi-reflector
-spec:
-  selector:
-    matchLabels:
-      app: avahi-reflector
-  template:
-    metadata:
-      labels:
-        app: avahi-reflector
-    spec:
-      hostNetwork: true
-      containers:
-        - name: avahi-reflector
-          image: avahi-reflector
-          securityContext:
-            privileged: true   # required for raw sockets
-          env:
-            - name: REFLECTOR_ENABLE_REFLECTOR
-              value: "yes"
-            - name: SERVER_ALLOW_INTERFACES
-              # use all interfaces
-              value: ""
--- a/apps/avahi-reflector/kustomization.yaml
+++ b/apps/avahi-reflector/kustomization.yaml
@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: avahi
-
-resources:
-  - namespace.yaml
-  - daemonset.yaml
-  # - configmap.yaml
-
-images:
-  - name: avahi-reflector
-    newName: flungo/avahi
-    newTag: latest
--- a/apps/avahi-reflector/namespace.yaml
+++ b/apps/avahi-reflector/namespace.yaml
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
--- a/apps/code-server/deployment.yaml
+++ b/apps/code-server/deployment.yaml
@@ -1,41 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: code-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: code-server
-  template:
-    metadata:
-      labels:
-        app: code-server
-    spec:
-      containers:
-        - name: code-server
-          image: code-server
-          ports:
-            - containerPort: 8080
-          env:
-          - name: TZ
-            value: Europe/Berlin
-          - name: CONFIG_PATH
-            value: /data/config
-          - name: METADATA_PATH
-            value: /data/metadata
-          volumeMounts:
-            - name: data
-              mountPath: /home/coder
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "100Mi"
-            limits:
-              cpu: "6"
-              memory: "16Gi"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: code-server-data
-
--- a/apps/code-server/ingress.yaml
+++ b/apps/code-server/ingress.yaml
@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: audiobookshelf-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`code.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: code-server-web
-      port: 8080
-
-  tls:
-    certResolver: default-tls 
--- a/apps/code-server/kustomization.yaml
+++ b/apps/code-server/kustomization.yaml
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources: 
-  - namespace.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-
-namespace: code-server
-
-images:
-  - name: code-server
-    newName: ghcr.io/coder/code-server
-    newTag: 4.104.3-fedora
--- a/apps/code-server/pvc.yaml
+++ b/apps/code-server/pvc.yaml
@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: code-server-data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
--- a/apps/code-server/service.yaml
+++ b/apps/code-server/service.yaml
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: code-server-web
-spec:
-  selector:
-    app: code-server
-  ports:
-  - port: 8080
-    targetPort: 8080
-  type: LoadBalancer
--- a/apps/files/kustomization.yaml
+++ b/apps/files/kustomization.yaml
@@ -13,4 +13,4 @@ namespace: files
 images:
  - name: ocis
    newName: owncloud/ocis
-    newTag: "7.3.1"
+    newTag: "5.0.8"
--- a/apps/files/ocis-config.sealedsecret.yaml
+++ b/apps/files/ocis-config.sealedsecret.yaml
--- a/apps/finance/actualbudget.deployment.yaml
+++ b/apps/finance/actualbudget.deployment.yaml
@@ -21,9 +21,6 @@ spec:
          env:
            - name: TZ
              value: Europe/Berlin
-          envFrom:
-            - secretRef:
-                name: actualbudget-oidc
          volumeMounts:
            - name: data
              mountPath: /data
--- a/apps/finance/kustomization.yaml
+++ b/apps/finance/kustomization.yaml
@@ -9,9 +9,8 @@ resources:
  - actualbudget.deployment.yaml
  - actualbudget.service.yaml
  - actualbudget.ingress.yaml
-  - oidc.sealedsecret.yaml

 images:
  - name: actualbudget
    newName: actualbudget/actual-server
-    newTag: 25.11.0
+    newTag: 24.11.0
--- a/apps/finance/oidc.sealedsecret.yaml
+++ b/apps/finance/oidc.sealedsecret.yaml
@@ -1,19 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: actualbudget-oidc
-  namespace: finance
-spec:
-  encryptedData:
-    ACTUAL_OPENID_AUTH_METHOD: AgAhPqooAS/7R9S/X3KGfSfs3ClN38J9CEfkUTYAUvKGEehQ2Tz3thPNvhvnbz/gKRc7C172jgxoxaGMiVXi40Qa+I7Y8JVHefjoSd8NuubzQZU8ZK5KlYRgc5OnoPM3RLarHyZ2DFw5Q/ngv3sp1c5dSI4/604KSQPxVAFCnb/lnSkOsBggDRymWvYclx1NrLIClpLAFwHgCOm6g1kHCvtGIdBLxKOHsiRJm62+UyHt0GLkR0QFTDXBQxoBm9QR9kLjQqw/QqcOIVx1by0RHoHBI6HDEEIQVH3UgWqlMmIwm+a4KQeBEdEfWLn9YC8MGSdlQRlaZoi5ltFT2c/DWuMuRStnaOWbsMQVR+y6yJ2UNBe29uVQh6877iqfmAJvT6gXic73zI7Vkq6IFQ7veQPBaTi22HP/sxiElGI8rY0LtRHD4TctKSePaOPvsgrv8k8SpB5qYAft7UonbTPWzzRSSc4Y3Z4fQiD0x/uhtTqTTtukx39nzM2TjVGcJThWaxUGa07w1fjTafieFVwwreURBUpRK92X2NY3ovOdA9c1WrHfqIzVtpcnfQyCeA5D4XT2sBFk0+crwEm1GmtscjPkGnyctNMUSmkHd+QKw8EAmWxKge4+7rfOrZp5ZK7cBFJcB4gVQcxnm3bXr0qZyiA1udaxmSxVflQR2AjduvhKuE73AGPi0bJki5TvKJp6bavTotYfdMY=
-    ACTUAL_OPENID_CLIENT_ID: AgA6X0uYaU1n4XSXVntmT4+NgahYkkMVx61OZP8ExnSMkRPlwQfErhNHrwKsTsnD8OzP3svhxBe5bwaI8O1OKF0k5pQWG0DbRfmBrwiep9nBsKPt+fQm0AJUsZ2sQNShusmsSEumBKbMD0CMPklVMq18tLpOIh/YaXM34lsOutW0SIx7HWWQsyLmoolEoRVdkKvDhoh3FXjKqzGYlr1uKuqYG7pJPsxEpsTs2pZTUIlB2gVcEqb/ZXxgkj01GDYzB519swIOfYdISj7oCR8VG90M9iDrgmxsPkWozMDxFjNo5JR2dB9wvP7ptFex8JonbZZXYZD7tE+36U8iys6Cjh6JGwr9luN1AxYYSkRrNWJd2CuID+8ujWptoTvRSO0RwiVVp5LhXe1l2GxLsS2UVtO+nbWH6DGMJei4DQ+LAxDXFR8FAvi7615cneN0umQfF4ZMUJirvxHA3tFN42tbnRmSCbLAZLNLhQq8VbRmkYOAN6LCzSKYlyhSyA3NM2HjRTFkXGUhOPL+3tPZJB4v0QlEhlhy1Ffxh2mbUXgmQ+ZHGUsBXEHfc/Gba6gJhsj6S2DkiAeZUW6euY5/v4vpveWsS+YS+BxH441//8mOJnrpsWrcQbM5yCk4WMnmpETy/VFEkc3dqYfVWHDfvwAeqjVfXAovXBmwOoCASG6qDf0P7FdeLFTHUNuahyNhBzhBAQ/yNpOkbzKTJFBWwnM=
-    ACTUAL_OPENID_CLIENT_SECRET: AgAbJinP4E8rbGAw7BTfh/GB3XxQOfHiLFrgaikQbUIsmZu+Y6ktK7aJdcX2/g6yhHXX6z8p4xoYTaGgkpo8H0XWvUDT4ohqJVdJSWZgNx8MyzisVKi+51BEpslL4JvGo/ISjXT0hNeYGzFXlHnnr3LX+fuTVh3dKtk4t8nmR8SqaCCIyvKiBPmX/1QWo4Vrfw7OLpVlfGP0i3J7FrhjNgKMRWcQKQC4Ohk+NLHHghdtqzuFB8eKwcuBZmynKCVyblOhwZSL5WnyJPskWLMjNEizWuCubDdyHVY3ZqYLDe5dgoi7Gop5/xY7FEuEkmTL0g7LpKo4RkEKRLjsZwWtW+xN6HRRt7zGoUdIpo20ZnTtEH8C/qcxjHKUycFvzKLnk6ntq5rEdK2/MhBtMfd3a8pb4vpT9JNra1AWsB7zCUv4yc/FT0RpkL+1r1CVva4o+tzM8ojnm4o0ch6qsGb0IOYZvJx6sF7c6aj7c41YQK3ZrQF3bhhhEHYyWOBjy1V4T/GJPZ9CbhGG0PIsSvpW7d5pG5jNAwU/Xo6FL/vVUPwmSq/hCqYMSSSKNiMH/q/vzKyu5B5aQbNDAumzsLRqD/auJz8nAaUoLNBVHq+7zTs3wV7pEayY22teq/MN5PRtYOQLE5Ck60gv9Q70cfhgvTeK+eX4h9BbhfijCV/EiSYhLP7meeIpE80icdLUSkNROfW+0sf3RNbW5q3JX8PsW0h29VJgREJdlziLj2cCshe+ww==
-    ACTUAL_OPENID_DISCOVERY_URL: AgAQVZX6r8SPkwwBR1dmUF/ahuZKkGSsU/GULe5PF7Nm75UadtjPb5aHAZjWE59MdV61DQZDa4KJz1/fW4xDUrJBuUElIRQH4oyMTQG12MSMauQpLd25SVU8ex2NYyerbd85j521FSxujP0l3941KGsENLt5wCx/idXu47txhAHgS81mj3CLfWzT5yyG+V1i48a24xK905v+ft5ZKuNLOxvVb6yZSBt1j/3egx49eB49CRk/dxYQtPpSw8Zb6KgaN+skjq5HTH/Neb4J92nlJ1aFPVKbFLbtxyIHDSoO35U8ODHEJVGKBbZjjfrrjCpmQYnZPEWN9s+xj2NAXZ7qANcJfbFEF/3bOiKZhc0jLM5MyhiMZoytn4FvGM8zxINC3z8zqaWJm1wiMXEUH3/FLUa2UWeHKQB14h0f5XGwytb3s/nPCoBnHhtOK1y4utJ2APsQhRsxySZjgYNRaRCarp8PntY7yB7VHYlv5Mitx+qBWcAUmcKp1I4NTnm1LORRGzIFcrJJKtQfqcW7GNuZDA3AiLGyOMVigcA93GnPbppor5BItE9FK/BKqrR4Bz31jXSO8S7pjhi3JxBIKEMmMZRVbyelJ9o7gTpqrBvO7KZ5v/L+mlE0J8D2LZoEWPqxfa/BE+QZfwIS3wDWQl1GTruaAM4u0bp4i9GkyK3hPVXnml3dNMElSG3GvNqHhhy1Boo1cHXHbQ5YzbkGgzL9fLkigVQCi0FKItyBxdGsui9U0OU5LNi0EGKBibs22mdDkp6f051GWeMidtSwz9j5
-    ACTUAL_OPENID_SERVER_HOSTNAME: AgB+C31GqtPKbMifuTFYhwOgUwXph+RQYdnVQaVIaDiveE6Lydl/2HnTyFQIi2mhrbiCpDgegXuvGBoM7WHxlPepny5E66lY/cAdFaFDGMARqMXCRLVmvkt3U1IyNn9zPCPil0x+eAv2S/ETLm8Nj2OL9utxkdNBHub9xiGrE0d7qBeBfK1FNmainthYQUpnCsR7jowmmvYGuEyDwfG+suUooDdb5zaWmCJZRYk1jKD3zlu21N0sfciBJ/GpTdz/2V+NXqJJqs3r2zoB2GJPQ64pMuZHZ+yw8bYUkg7/QOHD2ofWmtzNOGGtiNRHAG8MtvF6ovc4Hgv5uu+4x413UP6pSIJsrHrXSHYP+mvu+ya3gNUn6YK2qymezrqbvUF/n7LoaDzTRqa0PmemtdskuABiwfqrdiOarxaWjomkXqnrBK6VkJ8PhOMDMv/j/c6zlXdhpnqlUyxMcjBjqicfNBWN8UByDIEw4D0rhibzOS4fIKjNHrmXHv39GNJsY90avhZqq42oTMJL0vcaj3v4pBZJdJ05TOvY7PQ/iUwnnczGqOtpAQtBKfCV2+PXp9o/64wOGc0Br322kSpzjIleWP9VWVgbqvwMjUGtlL+xTkCaOFpiYETxUim09c745WDc+YgU55rd5i/5t20wiKy7RSYnHvYOwvdjAlEgAnD0YZBXOQkL51nL9P+nOMAYBE0HiM1vYsd8R6h6Fk+G2gcs/2CLgwglqOtMwAm9A9+5qSqyMak6Z68=
-  template:
-    metadata:
-      creationTimestamp: null
-      name: actualbudget-oidc
-      namespace: finance
--- a/apps/grafana/grafana-admin.sealedsecret.yaml
+++ b/apps/grafana/grafana-admin.sealedsecret.yaml
@@ -1,17 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: grafana-admin-secret
-  namespace: grafana
-spec:
-  encryptedData:
-    password: AgAU6g/CwKj+1gPpt4DLvLsS0YCvJdVHWw4W4bRhibE9brVvcJtGB3D9MTJrSLVVwusaE6OR59og7oW5ge3yTd/9bbclXYLrxEi7OwvkQjCvo8MfD8yhJO9nV4Xs9Mjk2Z4SHGYuq6wvcssuJrpz5f0XEC7ocTRA+u0UaE+/b4FrYF71uyKGvj8GSXgLZUjGPFsGfPzwJn7cLBmlclVHx1xGbFpUc042m5Mulpn0QolFQnOwZiW4PL8pQyz1MXVRwCsz0RJd5apZL3XJ4X7BLMoAp+diHQ2xi3zoU9VScp+J2QgvFdRKgDa6v7Jz1f+HCwq5W/DoegwFXBrcMIfF2YrnvTnc1PCVwD9IHOeylO7J2hfi8teQiqTvvRlVgdBTLqoqlVovemf5k6ke6JfjTwnsJjTNnL7MKN5Qt0o7N2XRZ3ba9jp8cKbI7fyFQKaU2QEf2PIkp82kEnixmpA1aATgeA3W4E5Km7sKHUEB81+pwnOe54tzD2ShgQX/+UiswhWYTT+gdZKL1udBBemUDC0z9PSJNTPTy+hq+G4CIzVQUYxlioM3c+3geF7YLU8yXisj84pk44GN9KX3z5x+M2+LZL7agAWPUjxtrP2V+id7dNJQfCm0aSMeo57dVfb4zlBUAAgKIKjX+j1KqCVqE9zEO2F/QX7mY6MJTP2me3wmY7JAVRJ7d6bbkyyoDhs8JErLYLp0A+Eh+qx8nWgM9ErPVSA0
-    user: AgB8ZLG2EuERjg1nKdH/xadbUuIR2c8a9gF5fE8ctrp4DNDLLuuqmjyoHRiWpkrtfnE1yKg1rPP+asV9Lj5iVmE9J+OB3QUOeFS4MHciBNj7pa68zfFgnHP4kxMX6aXyKRQrYruYjHwfzCpOM1zyTEphuGlnokjQXxjF/mZsoM2NWn7WGReqfxqH95tJXfs9AUC5vVv/PHqd+KKRZH7+G1AnWVJ7RFQHedR7wyftO4/rkm8deMuZWtOLl25fAOyOr7+hSqT69s9/uTKSLJXjobSqtulqsR+v5lkwx2ThNKzmcEcuoenKG6lk8XLRSIscccZH3JTPh6IknQWUOC4nmYj+XUxE8Go0RX/4eL+D/6FrYrtp0gr3HOCLAGU4vAHMeKfJoyqykJVnvY6QY6bFgaziyOlWaoEHpg6g0vHHDwyX7HIDcQfJZGOLH9dhrWJ2sOkzyuuxfqWEgz/M2eBW4EUAudHwfTLPocSMUI+D6fjeciMojet5uxWMP7ZHh/E061f5+Vfk6CKYd9Kpi69Xah8KEyyHYP5NImkdIwjgllaEAd/FBE2+QJyTVZlUQC7y9ObagDMCUFaFbTS5QOLh5BOJDL5buEYFWG0IhoH47SC/pKeEOQH//uvoo27K9zvxTOQN1YOTrxCozmexMOsTIdhvU0dOnJDBrThSHKYLCeIokDOgUUT52FqDH51RoLoK3UkyGbMoq+M=
-  template:
-    metadata:
-      creationTimestamp: null
-      name: grafana-admin-secret
-      namespace: grafana
-    type: Opaque
--- a/apps/grafana/grafana-auth.sealedsecret.yaml
+++ b/apps/grafana/grafana-auth.sealedsecret.yaml
@@ -1,16 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: grafana-auth
-  namespace: grafana
-spec:
-  encryptedData:
-    client_secret: AgCEdC1/ERlPQyQP+bd9gcW33Yrvl4uRbx+RF5AY4vYAquOzxmLTygMl/WZlB5wlCE5idIHgto6/fUWVZrQbmfClRqsW2pFoddKQAtS9cQNXwMjLCm7e0lXk9GM9O3ZwktmklFbCu8XewHmefGHhoJ28vPxPMaINv1fM4zYKvNz5RHf0dJfTHgxb68wRYjAbE/eJpRcVE3a29Yw6Gfa8Mb+cFI7RTHvjuv9LBgWqM6b3qvvJ4wYR2WKuiQrnJ5xAtHpMAI/2R80qq151wlaZueDZ1PwjRBHURkmPTmwZnrMrmIugNge7Tpww+ArZlG9kDfSu1aTJidbXbcpN6fyt1qARTCYrBlbn60PTYLnPL/NObvMCpjS6DsYsYz7MJ7WoOupu46Ib5paZHmak+CilC6lb9LjJj4EKfRsagZmWT07JavhHBW/tqjB3GToccIz4fOAOdA9aU51J4wCL2ctp2SgzCEKe2EaBK/f9nDd9ASmmon9PDwRDVtG8yTukrNcZHNzodi09Af81DB0RNa36Z3Sjt5xu94paN+mjiOWGf2JduVEq+60NbPvDbPE9e1aVH3DdQcij2WGZaTE8dAGLSsLoOkIq3m2E+Mbk1Re1gI9H18xJM72ivb5uDe7pzReyvO5DY4Pfq8JgQhPxWcDq9ScmWS6Bb+jdCKytFq5NafSAl+akPbbwN+1GFu33if/P5D9I2TwOA8V1wyVU
-  template:
-    metadata:
-      creationTimestamp: null
-      name: grafana-auth
-      namespace: grafana
-    type: Opaque
--- a/apps/homeassistant/base/kustomization.yaml
+++ b/apps/homeassistant/base/kustomization.yaml
@@ -1,20 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  # - namespace.yaml # not managed by kustomize but created as needed by the argo app. creates conflicts otherwise since both overlays share the same namespace
-  - ingress.yaml
-  - pvc.yaml
-  - service.yaml
-  - deployment.yaml
-  - servicemonitor.yaml
-
-
-images:
-  - name: homeassistant
-    newName: homeassistant/home-assistant
-    newTag: "2025.11"
-
-configurations:
-  # allow nameReference to work with different mentions of the same resource as well
-  - name_reference.yaml
--- a/apps/homeassistant/base/name_reference.yaml
+++ b/apps/homeassistant/base/name_reference.yaml
@@ -1,32 +0,0 @@
-nameReference:
-  # Tie target Service metadata.name to other ingressroute fields
-  - kind: Service
-    fieldSpecs:
-      # rewrite the backend service name
-      - kind: IngressRoute
-        group: traefik.io
-        version: v1alpha1
-        path: spec/routes/services/name
-
-      # adapt the ingress url
-      # DOES NOT WORK
-      - kind: IngressRoute
-        group: traefik.io
-        version: v1alpha1
-        path: /spec/routes/match
-        create: false
-
-      # adapt any middleware names
-      - kind: IngressRoute
-        group: traefik.io
-        version: v1alpha1
-        path: spec/routes/middlewares/name
-
-  # Update deployment volume mounts according to name changes in the sealedsecret
-  - kind: SealedSecret
-    fieldSpecs:
-      # volume mounts:
-      - kind: Deployment
-        group: apps
-        version: v1
-        path: spec/template/spec/volumes/secret/secretName
--- a/apps/homeassistant/base/deployment.yaml
+++ b/apps/homeassistant/base/deployment.yaml
@@ -14,7 +14,7 @@ spec:
    spec:
      containers:
        - name: homeassistant
-          image: homeassistant
+          image: homeassistant/home-assistant
          ports:
            - containerPort: 8123
          env:
@@ -34,3 +34,4 @@ spec:
        - name: config-dir
          persistentVolumeClaim:
            claimName: config
+
--- a/apps/homeassistant/base/ingress.yaml
+++ b/apps/homeassistant/base/ingress.yaml
@@ -1,17 +1,17 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: homeassistant
+  name: homeassistant-ingress
 spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`homeassistant.kluster.moll.re`)
+    - match: Host(`home.kluster.moll.re`) && !Path(`/api/prometheus`)
      middlewares:
-        - name: homeassistant
+        - name: homeassistant-websocket
      kind: Rule
      services:
-        - name: homeassistant
+        - name: homeassistant-web
          port: 8123
  tls:
    certResolver: default-tls
@@ -19,7 +19,7 @@ spec:
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
-  name: homeassistant
+  name: homeassistant-websocket
 spec:
  headers:
    customRequestHeaders:
--- a/apps/homeassistant/kustomization.yaml
+++ b/apps/homeassistant/kustomization.yaml
@@ -1,17 +1,18 @@
-
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+
+namespace: homeassistant
+
 resources: 
  - namespace.yaml
-  - pvc.yaml
-  - stump-config.configmap.yaml
-  - deployment.yaml
-  - service.yaml
  - ingress.yaml
+  - pvc.yaml
+  - service.yaml
+  - deployment.yaml
+  - servicemonitor.yaml

-namespace: stump

 images:
-  - name: stump
-    newName: aaronleopold/stump
-    newTag: "0.0.12"
+  - name: homeassistant/home-assistant
+    newName: homeassistant/home-assistant
+    newTag: "2024.10"
--- a/apps/homeassistant/base/namespace.yaml
+++ b/apps/homeassistant/base/namespace.yaml
--- a/apps/homeassistant/overlays/flat/ingress.patch.yaml
+++ b/apps/homeassistant/overlays/flat/ingress.patch.yaml
@@ -1,3 +0,0 @@
- op: replace
-  path: /spec/routes/0/match
-  value: Host(`home.kluster.moll.re`)
--- a/apps/homeassistant/overlays/flat/kustomization.yaml
+++ b/apps/homeassistant/overlays/flat/kustomization.yaml
@@ -1,17 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../base
-
-namespace: homeassistant
-nameSuffix: -flat
-labels:
-  - includeSelectors: true
-    pairs:
-      env: flat
-
-patches:
-  - path: ingress.patch.yaml
-    target:
-      kind: IngressRoute
--- a/apps/homeassistant/overlays/house/ingress.patch.yaml
+++ b/apps/homeassistant/overlays/house/ingress.patch.yaml
@@ -1,3 +0,0 @@
- op: replace
-  path: /spec/routes/0/match
-  value: Host(`home-house.kluster.moll.re`)
--- a/apps/homeassistant/overlays/house/kustomization.yaml
+++ b/apps/homeassistant/overlays/house/kustomization.yaml
@@ -1,28 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../base
-  - wireguard-config.sealedsecret.yaml
-
-
-namespace: homeassistant
-nameSuffix: -house
-labels:
-  - includeSelectors: true
-    pairs:
-      env: house
-
-images:
-  - name: wireguard
-    newName: ghcr.io/linuxserver/wireguard
-    newTag: "1.0.20250521"
-
-patches:
-  - path: wireguard.deployment.yaml
-    target:
-      kind: Deployment
-      name: homeassistant
-  - path: ingress.patch.yaml
-    target:
-      kind: IngressRoute
--- a/apps/homeassistant/overlays/house/wireguard-config.sealedsecret.yaml
+++ b/apps/homeassistant/overlays/house/wireguard-config.sealedsecret.yaml
@@ -1,17 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  # WARNING - the originial secret was named wireguard-config-house, but we remove the suffix here, anticipating that it will be created by the kustomization overlay
-  name: wireguard-config
-  namespace: homeassistant
-spec:
-  encryptedData:
-    wireguard.conf: AgAz726k7X6IsabWUPX8kQ8r19mBq/N+YytlFS1gW2LUiYqc6H/O5/tqma5lLcazuxtsQhebeoitp2SkH7jTU8vRxn2tDWpyzcJr+BW4vKnghw5NhMbkNOzl7mvc7QIJk6rmRyD1umu33v6x8u3St9TVsUOI1zXJyXHxlbLdHVCORhgV79CGLjghpi23KyyFu6LzNrE5rhpB0Q7NzPUmbm5MHPNbtLsmImd/CZ9XjbyXSq0be8BgpUtGDE/NMx65G2+lLIw3EgbNwlirw/XKrM+pUIvEI6CxuNhbEM7KxCYlq2Du6bm7XsKHRzNu9oSfH+P4DaDoDt+M5k5miv4B8TIKXg7piy5mThXSTcVf5YpLJCiTfMDZOriG1ygr9gbJPYY1jumZA+vsZCvBx1o21BlNycWZWKBeYZZh47Hz9FGI/Smn8dOs5exZ34MrQtM4OuEqC/cJY8fdQ+nmGMezL0IKdbtpWgq5UqNH/wWv3F9kItB4KlSD4YtEGaY2z68BJG6t+9igSJCWmVca0EbOzhV0s5rI39ASVXOO50x774EEWUueoyfI+l5vwtQhc96I5Qn3kbFhwov0tHMg/IGBtS/7XdBBtOBx9KbcUHq1GlwWzQdw8WnRB6yyUVCqXyuExRhMPz5orqkTQwiUM2Fjse7xxnaEA0mbi0TVPKV/sFgWixvHqy3VAc1Jj6MEAWFAu+kPVlOFFCckEC5kPhNPFhBMeYX/3IblRjly/EHvrbrW/eFjNYE7bqpSCVhkB8bOXbJqt29V3+ffM1z/RkdSusgqdwid9CXhQw6SKAI/vcAqqxXdzcsbG1wsgP9bJ1Gk/i9ch8zUn7MwcFe6Tla86+xeiDIAmQmA7rhtmWhyyuxXdw+HXAFNhrbxHaUw3LZOExM+RzhWNepjSLnCBqnrtPkzFrHE02JKebWzX+IRZIOsEXJVhKTiSSjoB2v8h956kO+C7bdHz8GbxoJKJ7anrqFG13A//XLy5PvKr50qs/gQptrl9UtR7oj981bSDTVVa8h3OXbGLkZXly/qxsh5DlEjwnw2/2UqS+5yTT4FO/dNVtHryJ2tbc8ZuIHb6C/pQygqpseagthkm5T+Dv0T2xWpXFrvuktGNm58Cwg9bwNMcC6iofcjQP5JeNcat3RwzbJ9xwU4Nm8xLRMMc0ul6xUHRrL3ZjDfWHLuSuTp28HqXZ6xSKLlrRVjwZ6Mp/hhxj58SfVfLVIQxatGkwnIaHEFWE2n3S7m/iQO9tZIWCx5Yfs15atb1Ze8HjKjQ4o3sfaMD8Eokj9aFnXQQxpnOuSI3NLETe79QQ==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: wireguard-config-house
-      namespace: homeassistant
-    type: Opaque
--- a/apps/homeassistant/overlays/house/wireguard.deployment.yaml
+++ b/apps/homeassistant/overlays/house/wireguard.deployment.yaml
@@ -1,24 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: homeassistant
-spec:
-  template:
-    spec:
-      containers:
-      - name: wireguard-sidecar
-        image: wireguard
-        securityContext:
-          privileged: true
-
-
-        volumeMounts:
-        - name: wireguard-config
-          mountPath: /config/wg_confs/
-
-      volumes:
-      - name: wireguard-config
-        secret:
-          secretName: wireguard-config
-
-
--- a/apps/homeassistant/base/pvc.yaml
+++ b/apps/homeassistant/base/pvc.yaml
--- a/apps/homeassistant/base/service.yaml
+++ b/apps/homeassistant/base/service.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: homeassistant
+  name: homeassistant-web
  labels:
    app: homeassistant
 spec:
@@ -10,4 +10,4 @@ spec:
  ports:
  - port: 8123
    targetPort: 8123
-    name: http
+    name: http
--- a/apps/homeassistant/base/servicemonitor.yaml
+++ b/apps/homeassistant/base/servicemonitor.yaml
--- a/apps/immich/immich.postgres.yaml
+++ b/apps/immich/immich.postgres.yaml
@@ -1,39 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: immich-postgresql
-spec:
-  instances: 1
-  imageName: ghcr.io/tensorchord/cloudnative-vectorchord:16-0.3.0
-
-  bootstrap:
-    initdb:
-      owner: immich
-      database: immich
-      secret:
-        name: postgres-password
-      dataChecksums: true
-      postInitApplicationSQL:
-        - ALTER USER immich WITH SUPERUSER;
-        - CREATE EXTENSION IF NOT EXISTS vchord CASCADE;
-        - CREATE EXTENSION IF NOT EXISTS "cube";
-        - CREATE EXTENSION IF NOT EXISTS "earthdistance";
-
-  postgresql:
-    shared_preload_libraries:
-      - "vchord.so"
-
-  storage:
-    size: 5Gi
-    storageClass: nfs-client
-
-  monitoring:
-    enablePodMonitor: true
-
-  resources:
-    limits:
-      cpu: '2'
-      memory: 1Gi
-    requests:
-      cpu: 50m
-      memory: 512Mi
--- a/apps/immich/ingress.yaml
+++ b/apps/immich/ingress.yaml
@@ -18,7 +18,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`immich.kluster.moll.re`) || Host(`photos.kluster.moll.re`)
+    - match: Host(`immich.kluster.moll.re`)
      kind: Rule
      services:
        - name: immich-server
--- a/apps/immich/kustomization.yaml
+++ b/apps/immich/kustomization.yaml
@@ -1,12 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources:
+resources: 
  - namespace.yaml
  - ingress.yaml
  - pvc.yaml
-  - immich.postgres.yaml
+  - postgres.yaml
  - postgres.sealedsecret.yaml
-  # - servicemonitor.yaml


 namespace: immich
@@ -15,13 +14,20 @@ namespace: immich
 helmCharts:
  - name: immich
    releaseName: immich
-    version: 0.10.3
+    version: 0.8.4
    valuesFile: values.yaml
    repo: https://immich-app.github.io/immich-charts


 images:
  - name: ghcr.io/immich-app/immich-machine-learning
-    newTag: v2.3.1
+    newTag: v1.120.0
  - name: ghcr.io/immich-app/immich-server
-    newTag: v2.3.1
+    newTag: v1.119.1
+
+
+patches:
+  - path: patch-redis-pvc.yaml
+    target:
+      kind: StatefulSet
+      name: immich-redis-master
--- a/apps/immich/patch-redis-pvc.yaml
+++ b/apps/immich/patch-redis-pvc.yaml
@@ -0,0 +1,17 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: immich-redis-master
+spec:
+  volumeClaimTemplates:
+  - apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: redis-data
+    spec:
+      storageClassName: nfs-client
+      accessModes:
+        - ReadWriteMany
+      resources:
+        requests:
+          storage: 2Gi
--- a/apps/immich/renovate.json
+++ b/apps/immich/renovate.json
@@ -1,10 +0,0 @@
-{
-  "packageRules": [
-    {
-      "matchDatasources": ["docker"],
-      "matchPackagePrefixes": ["ghcr.io/immich-app/"],
-      "groupName": "Immich containers",
-      "groupSlug": "immich-app-images"
-    }
-  ]
-}
--- a/apps/immich/servicemonitor.yaml
+++ b/apps/immich/servicemonitor.yaml
@@ -1,14 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: immich-service-monitor
-spec:
-  endpoints:
-  - port: metrics-api
-    scheme: http
-    path: /metrics
-  selector:
-    matchLabels:
-      # app.kubernetes.io/name: server
-      app.kubernetes.io/service: immich-server
-      app.kubernetes.io/instance: immich
--- a/apps/immich/values.yaml
+++ b/apps/immich/values.yaml
@@ -4,30 +4,26 @@

 # These entries are shared between all the Immich components

-
-controllers:
-  main:
-    containers:
-      main:
-        env:
-          # some non-default vars
-          DB_HOSTNAME: "immich-postgresql-rw"
-          DB_USERNAME:
-            valueFrom:
-              secretKeyRef:
-                name: postgres-password
-                key: username
-          DB_DATABASE_NAME:
-            valueFrom:
-              secretKeyRef:
-                name: postgres-password
-                key: database
-          DB_PASSWORD:
-            valueFrom:
-              secretKeyRef:
-                name: postgres-password
-                key: password
-          IMMICH_METRICS: true
+env:
+  REDIS_HOSTNAME: '{{ printf "%s-redis-master" .Release.Name }}'
+  DB_HOSTNAME: "immich-postgres-rw"
+  DB_USERNAME: 
+    valueFrom:
+      secretKeyRef:
+        name: postgres-password
+        key: username
+  DB_DATABASE_NAME:
+    valueFrom:
+      secretKeyRef:
+        name: postgres-password
+        key: database
+  DB_PASSWORD:
+    valueFrom:
+      secretKeyRef:
+        name: postgres-password
+        key: password
+  IMMICH_MACHINE_LEARNING_URL: '{{ printf "http://%s-machine-learning:3003" .Release.Name }}'
+  IMMICH_METRICS: true

 immich:
  metrics:
@@ -41,15 +37,17 @@ immich:
      existingClaim: data

 # Dependencies
-valkey:
+
+postgresql:
+  enabled: false
+
+redis:
  enabled: true
-  persistence:
-    data:
-      enabled: true
-      size: 1Gi
-      # Optional: Set this to persistentVolumeClaim to keep job queues persistent
-      type: emptyDir
-      accessMode: ReadWriteOnce
+  architecture: standalone
+  auth:
+    enabled: false
+
+# Immich components

 server:
  enabled: true
--- a/apps/kitchenowl/deployment.yaml
+++ b/apps/kitchenowl/deployment.yaml
@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kitchenowl
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: kitchenowl
-  template:
-    metadata:
-      labels:
-        app: kitchenowl
-    spec:
-      containers:
-        - name: kitchenowl
-          image: kitchenowl
-          ports:
-            - containerPort: 8080
-          env:
-          - name: TZ
-            value: Europe/Berlin
-          envFrom:
-            - configMapRef:
-                name: kitchenowl-config
-            - secretRef:
-                name: kitchenowl-oauth
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "100Mi"
-            limits:
-              cpu: "100m"
-              memory: "1Gi"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: kitchenowl-data
-
--- a/apps/kitchenowl/ingress.yaml
+++ b/apps/kitchenowl/ingress.yaml
@@ -1,29 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: kitchenowl-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`kitchen.kluster.moll.re`)
-    middlewares:
-      - name: kitchenowl
-    kind: Rule
-    services:
-    - name: kitchenowl-web
-      port: 8080
-
-  tls:
-    certResolver: default-tls
---
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: kitchenowl
-spec:
-  headers:
-    customRequestHeaders:
-      X-Forwarded-Proto: "https"
-      Upgrade: "websocket"
--- a/apps/kitchenowl/kitchenowl-config.configmap.yaml
+++ b/apps/kitchenowl/kitchenowl-config.configmap.yaml
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kitchenowl-config
-data:
-  FRONT_URL: https://kitchen.kluster.moll.re
-  DISABLE_USERNAME_PASSWORD_LOGIN: "true"
--- a/apps/kitchenowl/kitchenowl-oauth.sealedsecret.yaml
+++ b/apps/kitchenowl/kitchenowl-oauth.sealedsecret.yaml
@@ -1,19 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: kitchenowl-oauth
-  namespace: kitchenowl
-spec:
-  encryptedData:
-    JWT_SECRET_KEY: AgAclRIJS25ACVe4NqLQbAree6c6WpTBHnLpe3ZQJ0ScHG/EbW/ooABZj7y1ABAn/mCc+hBYXYHm81FNUfUtSuLKi2UlORbTCsfmisYH49WX0Lpku9LTM/8az9tjE0tjUUrJZcRUuJfdNJMDPQx7IPjUQ7sKk/exFnkPEbK98+AElXyHpPKXd9dxiCgll0n+ksbF9BDUR8KY8IB2Zvh4cXPww578qe/9XYnxLV8uY9K8KPvhl7NI40SIaL4PX8KmsDlBh1bpOR/OxhIwAGEZDQp/KROy6msrIOYW4SHM9nlSUSD4WvV8UjcbV1oNnYpE1usFOuxSfQlJ1zlFepKUv40JykyunvQv9nqVbEogsrS4o5N3gNEaB9yyFSHIlevp32LVpAuZu3cNplmT+Zg7+ODpCWIcVgmOAeapvB+X7H4ScbKVcYLAzrRFDtnS4Vo1M+RERhr0AuMU/tz0lGs99oRkCw2ZIg015R125u0VcRNqzgCtbBM5BFiKiP2kYrHn02Q6o5tRWxDQfrfb0mnfD5c/gM4+btlfM6DZMpr/l1kLlm8PDEpPGbkhK1XiAyJ4erHPDMLcmZXrSyxX9R1g8n7vnLnkqx5LkGmnltQI2FM7StxC6IrMlxY0nPnkq1lHhTz7yCpQJNXgfXZLVvov+f6jlD6WJhYHZCL/hIFfx3ybjGYZwJ0m84lH0OQJQw5dtsbPVqqoYZIPieqdRmHw7M7TTmFuQJXD94lZj5gsln1sMqs=
-    OIDC_CLIENT_ID: AgDOxWtGCiFrIP5aWHimrR6bu0uMS1/i1v1Kzo1lIR3j3zlw/Da2oCPNx1ZuhNAp9UMIs2euc8mtrWkyv4R6pcci+IxXiGzlQNBSkMfWu4DwhwlEdnVyCVehfE00t0ytBxX6NeLfS1b8JOtH9yo3e22fdaeTwn/iwGLNwi1BJxMmzk9pVp7jzXH09Zia8UvUmXw5GyGpIOIiGcIfaXkr1ZnY2l30jTw8eS7HaouzfWHWTpNXkMLN3qim4vs/B1Sgz/y9tUyVo/qMhWLdEcVklYHT7xHx03SPD7RtK+zdYZCqvDtj+tsdpYHt05zeGV+wflNQuiocjwP8TW7vhtbjKrf9lQIxB5CErju178ELOVrpsPBAYMgdEl7qZeKdSpydIwe3VbOg3XJ7O/Ps1KSnRYwrCvgE4ZCMm3geHyJxSiKRhBcuVYz5JkNd5ylD0Eq9NL5RCqJ4szL9NaGNPbzkvcdZzAnbTYFTzyqZ+XHX/BUFisXl5bKNHtaqAsOK8woGYnxJiawKRrwDUmHXU4RB3QiPCPhHSLU7OkvU+XDhyQqLa8bKEQzj9dUf4bX3Savk4noiRsXMYJznAlgMPo0Q4taxVIoyQHELYwIIdP5YRuw27B9wKUR7e2hhu4FTOEcyhwuFql3OuAjq8HJCDX6+COkL2WYFFxWBnbSCYEdzfbMBCHjrUUonijcQluU2VbaHODNMAvB16MRKapAW
-    OIDC_CLIENT_SECRET: AgAylnSUXwInlh/WvyCiFz+8asbCSZA6kk84Rt6l7bHVYw34c58lJHsZK2OvOIlHuaMe/ewnTqxVd0hI1Azl+wd/5NygMYlntKquq0vuzlhLrGc3u+0SOn9N2P6quA3slF9KR94CYsDx9ogy+EsEoA1yrsydB8S0g9W8syraR1MtpM0ZkcJ/D78OZ6qzyXUuBNAZc+iX/r96NvoMiGNYavgG7npOJh/pkKNYPuNkt4zpbAFjVyoCfgZd4V2nmZ6dhEVy8odW+jcsMn6OJ1OZVlPb1beq49lBEcaJqk83ZtKbq2evtBYHw9YAnENVq92ecenw/YL5LXUhOxeN0M9Amo99/O6pQwwrT1mtZqhTTeTIZTAxqmJKgyxGhE4DJUR/s71bc7K9hd2WvdAYnCyVC2uGa0MwXp4V7UuaN9GerldT8lcFxOpRnD7yroqVTqebjAJIkIinp5NNZ2ZP/LCiCwKKHHT19Pchn615WOPTofC6es/spIdQ8a1Nf2J5YzvRjsduFS55U6tMaC7cuV8kqKH9xTTf/sDHt+68wVEAO9koAe1zpO+zR2Pq3VuCnvcDGIwXopXjvyjfujEEhEWZl51PVJLZqtkP5Wg2wHvlgjJBbbIGTrqh4xa9pK7wLDM2hUFx1q/YKqwfP0EGVTc96G8Wermj0DtIqclqFLr54DtxVe+Rr8J4edG6YQ26/seYsrZ1Oq2PejHQt8u9EzQYAtYYlBsw2ujCWys6KrbhaVr3
-    OIDC_ISSUER: AgA2JPd5axkL5YIRA95qm/iH8wgM2J0AjKjgGClWabYJ3UKIk0hi/L/zR+1Pw9Z+6amYXj7Q0FxLqCcNYG+H5ABxnqUi7Gl8gvfVbegaO3q5QiO27g18RMDssNHDSun8PPaxHBvBD68hxgsaXntu8sZavCGdwEK0TzLJi7eH/4jtHlofzfYgaCsGqeOBgvs/q87PVJ/qxazXlY9e7abbRAKl9ZMY7Wga58/IU2HhWwYMvI53yQyGMcKf3XiI9iNHgIcj1+TmlgQo+PRKyopNfzgFbey7on8woQXphY+ioqQ0hyworpxAVoWlvzKKopt1xBDr4zxzkzbWyxtjwPVOOH3iyenZz8tZa/JkNYWxkWHbh0KCs9yUIji3D3shQOFM/NtE17THsQm3NgpZ2lg9ET1v6uXqwfOLiQ+J1JQLwNFnYeruH2lK4EGt2nDCq2VycOIjW4kMpiJ4LiT8gap9HwYjTpAn+opicYn5e9fmpgiHdMPvrsG1m9edg0cbwdSpEelliHnAUfKsxMV2e1fLsga6yrhBLSXIQs8rbURRa6wqVvGoLB86a9Q5Rm94Jfm0Sa9v5LMGRYvqO5LbLrjrR8e/2r17pHQE8ynMQCAW1yVTe09FcgRwYhDUohfThtjIh16sdoC97eUel7fo/POt3atP69JsCIBZstprhVtBIBssmavpIotVqi8F2/yUkhrZR26mH3gsOxkNTEk6XzHHtJRu0cU+BmObTvYgMi3DHg==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: kitchenowl-oauth
-      namespace: kitchenowl
-    type: Opaque
--- a/apps/kitchenowl/kustomization.yaml
+++ b/apps/kitchenowl/kustomization.yaml
@@ -1,17 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources: 
-  - namespace.yaml
-  - pvc.yaml
-  - kitchenowl-oauth.sealedsecret.yaml
-  - kitchenowl-config.configmap.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-
-namespace: kitchenowl
-
-images:
-  - name: kitchenowl
-    newName: tombursch/kitchenowl
-    newTag: v0.7.4
--- a/apps/kitchenowl/namespace.yaml
+++ b/apps/kitchenowl/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder
--- a/apps/kitchenowl/pvc.yaml
+++ b/apps/kitchenowl/pvc.yaml
@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: kitchenowl-data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
--- a/apps/kitchenowl/service.yaml
+++ b/apps/kitchenowl/service.yaml
@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: kitchenowl-web
-spec:
-  selector:
-    app: kitchenowl
-  ports:
-  - port: 8080
-    targetPort: 8080
--- a/apps/linkding/kustomization.yaml
+++ b/apps/linkding/kustomization.yaml
@@ -13,4 +13,4 @@ namespace: linkding
 images:
  - name: linkding
    newName: sissbruecker/linkding
-    newTag: "1.44.1"
+    newTag: "1.36.0"
--- a/apps/media/kustomization.yaml
+++ b/apps/media/kustomization.yaml
@@ -12,4 +12,4 @@ resources:
 images:
  - name: jellyfin/jellyfin
    newName: jellyfin/jellyfin
-    newTag: 10.11.3
+    newTag: 10.10.0
--- a/apps/minecraft/README.md
+++ b/apps/minecraft/README.md
@@ -1,11 +1,3 @@
-## Setup
-Because minecraft is quite sensitive to io performance, we want the data to be stored on a local disk. But hostpath is not well supported in talos (and is not persistent), so we use an ephemeral volume instead. In order to do this, we create an emptyDir volume and mount it to the pod.
-
-We use an initContaier that copies the data to the local storage. Afterwards, copying from the local storage back to the persistent storage is handled by a preStop lifecycle event.
-
-This way, we can have the best of both worlds: fast local storage and persistent storage.
-
-
 ## Sending a command
 ```
 kubectl exec -it -n minecraft deploy/minecraft-server -- /bin/bash
--- a/apps/minecraft/curseforge.sealedsecret.yaml
+++ b/apps/minecraft/curseforge.sealedsecret.yaml
@@ -7,7 +7,7 @@ metadata:
  namespace: minecraft
 spec:
  encryptedData:
-    key: AgDG6apUvB38rB9tH+/ya5Af/32IUJjHiEGZFdYYqesuqyPB/qf99EtC/7CwqD6bDQQPVycJVcxwZuF8QtYfPXzv//yMkqEUJ2G1/Q5J8I6bjNGLR636UhliUpCkH1QDOspWJUjwKDVxlFN9l0g9UajvxnqLyGzbWPeay0sJEBvAY8ltEZpLP21V+GD+HgPk3HIfSFFBMsULS6GPCjMaFxkxQb6cG3K4Ej4NHCHRGOmax+4Rk7lwMyAHlXLlrwj/ytxrnHDWrugLIJE9KKmJn6UVNTuk6olgkhleg2PixV7oOiDVyu9ZQP8wbdppzRix6dnIcFEYJ1ZDK1rNF5QErYO0gBytiJnSsdFO0jUMsdBrho2FgUc5GgIdmgXWJJz3lrGFqXaRVvbPsBZTUAsQRh2+4IfqfWmAkEjBcjs1K8WWJfS+rO9e02KoHBT4decdsd8Qfr5EFdPIzMrkUoRMI9CJnIa5u2nR08Hhd9iojbL64FZ26kXMODtEdKmlo+HwjufLX5rYJVSfOyZYzivd/kgKA87YTFaMLKej07w3ofGrPYSoCnmLfJyoQdNyJhdonBDsgM1GgRWQZDpgJ1df0SB02A5lZ4V7lHWr8KlANv9YLuMoZnVehsH1NZjNQHDInIRiTLahEBbjcJzQz4vU1UWG100ATszEYKOUVkzPnTgkqKYU99ZQ23bHP8z7iAWQeumb6V84NTi6jNITBvU4yTFLuAiI3nW34Vb1mFVLwfWqMjEYX8gBB4yMSaVshB/japfkyXU0pYg4mK9gsB4=
+    key: AgBYeAiejdmxDBorvgnxQX5YvUhR3NId2vfWybMKlc27e6D/bKglLNyZMk70xSnFAPjcDmZ20mYjFPYvDOr9T6IU/REJ8QlzoKAn0xW779R4SkIxRToT+dJv+OM2avgQ9uqp7vja29xeXMjYAnQML+QGZKcrT8mE04G/Ty8rdUiv3yUXK5HFAR3SUF35aVLdlthLjpRkv1s0R7GAP4L2pNzBJNV3i37viceUSSjU0zpOa23fsQOkPAs67AIukAJBqh/hyF/hR9H1GeYZNTI3OcHcvC2iNk/XGstvv0Zy6ApzoebsfWGdsbVn+QUI0EBw+mSTPqpl71cbkz0v4S4XAVndosxWpe6AIgm5MBTU0FXIyGyoFDe1aMPq8BXiQikYVwB48oVNh9KF0xXX5AOG0whB/FEsL3OJsiNQvQ3R/Hru43JBn64oxjVtLfM3E7u8v/xr1VQahX8dylDmb4s5EV01U6O4y19Ou4td1eEMlhpJb0fBPDRUYuWxZAEDGmp+U4tAakyPed11VkcZPPn9fKAAcv8sGs3TYAbbF18hqsBnv2Wd+i7ZEvKwmdmfR/T0r1TJGsvKI7jaW0QtH256XrSxQp7a52qMKMVQWOSKw2k27t/IkRhxT2Prw4GfJvaVr4RozUaBf3LV/hfDWlDfmM2zg3X9W8HkzjotGg021OLxsa0Wzmhffvb8h4bvZwxeq3U1xaJocqXui7z0rT2pF4z3wYHR/lPtexHcOA2M8gfBGKb1rBKh+kW+N+/ZfVLNI0mokg5vrTO2nR2rb4c=
  template:
    metadata:
      creationTimestamp: null
--- a/apps/minecraft/job.yaml
+++ b/apps/minecraft/job.yaml
@@ -4,27 +4,14 @@ metadata:
  name: start-server
 spec:
  template:
-    metadata:
-      labels:
-        app: minecraft-server
    spec:
      restartPolicy: OnFailure
-      initContainers:
-      - name: copy-data-to-local
-        image: alpine
-        command: ["/bin/sh"]
-        args: ["-c", "cp -r /data/* /local-data/"]
-        volumeMounts:
-        - name: local-data
-          mountPath: /local-data
-        - name: minecraft-data
-          mountPath: /data
      containers:
      - name: minecraft-server
        image: minecraft
        resources:
          limits:
-            memory: "11000Mi"
+            memory: "10000Mi"
            cpu: "5"
          requests:
            memory: "1500Mi"
@@ -42,13 +29,13 @@ spec:
              name: curseforge-api
              key: key
        - name: CF_PAGE_URL
-          value: "https://www.curseforge.com/minecraft/modpacks/vault-hunters-1-18-2/files/6807187"
+          value: "https://www.curseforge.com/minecraft/modpacks/vault-hunters-1-18-2/files/5413446"
        - name: VERSION
          value: "1.18.2"
        - name: INIT_MEMORY
          value: "1G"
        - name: MAX_MEMORY
-          value: "10G"
+          value: "8G"
        - name: MOTD
          value: "VaultHunters baby!"
        - name: ENABLE_RCON
@@ -56,37 +43,15 @@ spec:
        - name: CREATE_CONSOLE_IN_PIPE
          value: "true"
        - name: ONLINE_MODE
-          value: "false"
+          value: "true"
        - name: ENABLE_AUTOSTOP
          value: "true"
-        - name: AUTOSTOP_TIMEOUT_EST
-          value: "1800" # stop 30 min after last disconnect
+        
        volumeMounts:
-        - name: local-data
-          mountPath: /data
-
-      - name: copy-data-to-persistent
-        image: rsync
-        command: ["/bin/sh"]
-        # args: ["-c", "sleep infinity"]
-        args: ["/run-rsync.sh"]
-        volumeMounts:
-        - name: local-data
-          mountPath: /local-data
        - name: minecraft-data
-          mountPath: /persistent-data
-        - name: rsync-config
-          mountPath: /run-rsync.sh
-          subPath: run-rsync.sh
-
+          mountPath: /data

      volumes:
      - name: minecraft-data
        persistentVolumeClaim:
          claimName: minecraft-data
-      - name: local-data
-        emptyDir: {}
-      - name: rsync-config
-        configMap:
-          name: rsync-config
-          defaultMode: 0777
--- a/apps/minecraft/kustomization.yaml
+++ b/apps/minecraft/kustomization.yaml
@@ -8,7 +8,6 @@ resources:
  - pvc.yaml
  - job.yaml
  - service.yaml
-  - rsync.configmap.yaml
  - curseforge.sealedsecret.yaml


@@ -16,9 +15,3 @@ images:
  - name: minecraft
    newName: itzg/minecraft-server
    newTag: java21
-  - name: alpine
-    newName: alpine
-    newTag: "3.22"
-  - name: rsync
-    newName: eeacms/rsync
-    newTag: "3.0"
--- a/apps/minecraft/rsync.configmap.yaml
+++ b/apps/minecraft/rsync.configmap.yaml
@@ -1,42 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: rsync-config
-data:
-  run-rsync.sh: |-
-    #!/bin/sh
-    set -eu
-    echo "Starting rsync..."
-
-    no_change_count=0
-
-    while [ "$no_change_count" -lt 3 ]; do
-      # use the i flag to get per line output of each change
-      rsync_output=$(rsync -avzi --delete /local-data/ /persistent-data/)
-      # echo "$rsync_output"
-
-      # in this format rsync outputs at least 4 lines:
-      # ---
-      # sending incremental file list
-      #
-      # sent 145,483 bytes  received 717 bytes  26,581.82 bytes/sec
-      # total size is 708,682,765  speedup is 4,847.35
-      # ---
-      # even though a non-zero number of bytes is sent, no changes were made
-
-      line_count=$(echo "$rsync_output" | wc -l)
-
-      if [ "$line_count" -eq 4 ]; then
-        echo "Rsync output was: $rsync_output"
-        no_change_count=$((no_change_count + 1))
-        echo "No changes detected. Incrementing no_change_count to $no_change_count."
-      else
-        no_change_count=0
-        echo "Changes detected. Resetting no_change_count to 0."
-      fi
-
-      echo "Rsync completed. Sleeping for 10 minutes..."
-      sleep 600
-    done
-
-    echo "No changes detected for 3 consecutive runs. Exiting."
--- a/apps/monitoring/grafana-admin.sealedsecret.yaml
+++ b/apps/monitoring/grafana-admin.sealedsecret.yaml
@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: grafana-admin-secret
+  namespace: monitoring
+spec:
+  encryptedData:
+    password: AgAwMLnsYN1y8JQSqgGQbNG/8jKensTDsEw6ogITdkhDRlJcg8HQ5t7a6xLzNCrLHLJiQW8YOoyLT4lvFkBRMOa2EYcrDvBiRD0PjygWLIscKa7dA+jpAUf/icD9zsiDnTym2yf+VUANcmEgE6DiNvlcsrcmYqiR4pKVUTDlKPNOjOpTJ3nXETb3/sbt69E0JSGwtkvusYQSXKLU9KLbciihv+ycdkdlC9xy9myd4+vYZYXSh/eAvyZeb/hsmdSX7yaASmupMvet6Qsdt99PNzFQxtbQH+LQvYalVZ8bjWZQvCN/p0bA4H15otKBfe8rtEwVthgvyEvo6TK0Mg0pFY/b3AOGFmImnT3rDmgG6S8KTZH0Jce17ksFqvELQmHjqHuYpQsPDl44glM8kWRJ9Mf/Z424LRwZlJNVcOkuVl4qFqPUjzd2rWIyF0RaD0BE012C0ThJxKn2l17lVJbNtdUiR3qNpW01ot2m0CgKd2kXbjDmgRgAll4WgrukfCIn9ZnE0gVCFLJuK3MOQAaipFYy/bDO0izwl9T8nldgcI8OfiC3NTk2O+Es5jJRXu0oJGaC3HrTB7wXiwOoELvAsxLTPxKBiN9mCHCMtZX0PEtrio0dFRQ6Pi5xPng0KVT0I9dvGNsPdhPETNOB913WEvbgP8Gt3cj016nCzk51eUsYbXPpNL2B4kmbIhecqW/8kwKQPwYjVlBSXj3NxjzwMY6PvOl1
+    user: AgBqmjCYGMqy5zBE+vhtsynOvhWdHWDJDyl1D+laBtLjXTJwzRbNTdunHYo1ekwyqQ6Cr5pi4YMiLxAl1LIHF+Lfsp2QlY+ResAGzp9WgSBtNQDX3EmLDQofeWxMUDdMtMsE9wiKLCfNGDkRDsGquXTz+YFq03m1vH9cB8Bp+1ClWOTui+/Ce0MZlWsJZX1W8WXH7XTirtwUo0s53pc4AplUUH97ZEK3KSIxWa3gLCn0sAPDDLPX+JVA2xtpMq1XuVFiFifjzEtG2h0dejiF35FtSAR+rR4YmEfimk3QpRDfOqV5QUxvjCG+dTV49upSevF2mvbHW+o+lB6vEc6l9cZXvlbnMdaep3NmOsJcJ8wQIdFpFK4iVzFOTKSEbzLPlZ/J+sjS5vDXsfthorIO2faMA1iIf+I663zNxQU5btaK4TNYOZQlrFVjAmioRLkDhGZ6tDUPX/zMv+Crt+0HCwyEyhmvFZckDvezTZrxARSXXMKBVcvjHCyUNkz7ubZRiMU0PGM7fYuHr659e+XMRvj+LFA68ZaEIzCQpCFJenWWYAXgUdRG4LQ1LP2MwvRHpkOYSoRkHIpX7jOfhX82A60h/ta/CdbWifqNyL9OecvE3FKsZu/Kr0taw9W6nm6FBhQLgFkOnFrqp9dWnxfHruXuDBgcn0iE8nR7Ht2zS7hfQPeR4a3Y0xK3Plqbzdrb9HKnWQQhf14=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: grafana-admin-secret
+      namespace: monitoring
+    type: Opaque
--- a/apps/monitoring/grafana-auth.sealedsecret.yaml
+++ b/apps/monitoring/grafana-auth.sealedsecret.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: grafana-auth
+  namespace: monitoring
+spec:
+  encryptedData:
+    client_secret: AgCcKsnS3u2eI+fNVC9hAZ3QRFOHFErAzs5aQgX51CSdJwM03SZUoTyrDi5JPcHUVyS3MbevFH5piMhDTARMI3bLOjYlcwMbpf77JCPa7o95Y9asA/FW3lXicYt3biN9xBXJBz7Ws3fVRtEzyf6DmbGedT9gaX8aPwrUVbP19RdyJiuu76oB1A/jdUkX4K+X6kVvmoP/BWdypk/kdQJrzBNt00DIXF4NHfYey36AuhpBtqYZs4faA/tBXMXLE4RxPNtcHwNfVjnRj3v3qzNufD1fnweJvLq2UfLMrQjoR9XDVnM0zkpautylkI7yrvcoEH7ljnf6b1FMogOEZUfH1BIdqTd/WwrrlCqE58OPfJWthIfN+pQ8LvdHsGo3jc9gXvfXS2cStyhP06eTZ4D79kG+RtDQGOsD/Wpx7EcM6hbB3+dIjcs3wEAIGjpIVtY9JayW8YeRnFApMuhDST1+hscm+LdoGvaSTlAuGzv9BbVrPX/Fo9XKeYHlbG/x71Er+vF8WbW0wUa46MHLvbEy376XIdJDYi+vjl4eqznZ6YhvPbawhoKXT8ZcKUcUAjVcMue/O/jCSPZplbn3vdSCeqPTiqVqDw9PTMIeWFUepgPMxiGpFRAqdwIecFBnYItq0dXoGlFrZpo0S6AECgZjxzUR5EgdkdPlDDs2CN+d9yP7f2S+gmL7AIlQr74NW1GrTGw2x/rD4IJhunh7
+  template:
+    metadata:
+      creationTimestamp: null
+      name: grafana-auth
+      namespace: monitoring
+    type: Opaque
--- a/apps/monitoring/grafana.ingress.yaml
+++ b/apps/monitoring/grafana.ingress.yaml
--- a/apps/monitoring/grafana.values.yaml
+++ b/apps/monitoring/grafana.values.yaml
@@ -35,17 +35,13 @@ datasources:
  datasources.yaml:
    apiVersion: 1
    datasources:
-      - name: Prometheus
-        type: prometheus
-        url: http://prometheus.monitoring.svc:9090
-        isDefault: true
      - name: Thanos
        type: prometheus
-        url: http://thanos-querier.monitoring.svc:10902
-        isDefault: false
-      - name: Loki
-        type: loki
-        url: http://loki.monitoring.svc:3100
+        url: http://thanos-querier.prometheus.svc:10902
+        isDefault: true
+      - name: Prometheus
+        type: prometheus
+        url: http://prometheus.prometheus.svc:9090
        isDefault: false

 dashboardProviders:
@@ -85,15 +81,13 @@ grafana.ini:
  auth.generic_oauth:
    name: Authelia
    enabled: true
-    icon: signin
+    allow_sign_up: true
    client_id: grafana
    client_secret: ${AUTH_GRAFANA_CLIENT_SECRET}
    scopes: openid profile email groups
-    empty_scopes: false
    auth_url: https://auth.kluster.moll.re/api/oidc/authorization
    token_url: https://auth.kluster.moll.re/api/oidc/token
-    api_url: https://auth.kluster.moll.re/api/oidc/userinfo
+    api_url: https://auth.kluster.moll.re/api/oidc/authorization/userinfo
    tls_skip_verify_insecure: true
    auto_login: true
-    use_pkce: true
-    role_attribute_path: contains(groups[*], 'apps_admin') && 'Admin' || 'Editor'
+    use_pkce: true
--- a/apps/monitoring/kustomization.yaml
+++ b/apps/monitoring/kustomization.yaml
@@ -1,7 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

-namespace: grafana
+namespace: monitoring

 resources: 
  - namespace.yaml
@@ -17,5 +17,5 @@ helmCharts:
  - releaseName: grafana
    name: grafana
    repo: https://grafana.github.io/helm-charts
-    version: 10.2.0
+    version: 8.5.12
    valuesFile: grafana.values.yaml
--- a/apps/code-server/namespace.yaml
+++ b/apps/code-server/namespace.yaml
--- a/apps/musicassistant/deployment.yaml
+++ b/apps/musicassistant/deployment.yaml
@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: musicassistant
-spec:
-  selector:
-    matchLabels:
-      app: musicassistant
-  template:
-    metadata:
-      labels:
-        app: musicassistant
-    spec:
-      containers:
-      - name: musicassistant
-        image: musicassistant
-        resources:
-          limits:
-            memory: "2Gi"
-            cpu: "2"
-          requests:
-            memory: "128Mi"
-            cpu: "250m"
-        ports:
-        # ports required for musicassistant
-        - containerPort: 80
-        - containerPort: 443
-        - containerPort: 8097
-        - containerPort: 8095
-          # name: musicassistant-web
-        - containerPort: 1704
-        - containerPort: 1705
-
-        env:
-        - name: TZ
-          value: Europe/Berlin
-        volumeMounts:
-        - name: data
-          mountPath: /data
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: data
--- a/apps/musicassistant/ingress.yaml
+++ b/apps/musicassistant/ingress.yaml
@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: musicassistant-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`musicassistant.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: musicassistant-web
-      port: musicassistant-web
-
-  tls:
-    certResolver: default-tls
--- a/apps/musicassistant/kustomization.yaml
+++ b/apps/musicassistant/kustomization.yaml
@@ -1,17 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: musicassistant
-
-resources:
-  - namespace.yaml
-  - pvc.yaml
-  - deployment.yaml
-  - service.yaml
-  # - ingress.yaml
-
-
-images:
-  - name: musicassistant
-    newName: ghcr.io/music-assistant/server
-    newTag: 2.6.0
--- a/apps/musicassistant/namespace.yaml
+++ b/apps/musicassistant/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder
--- a/apps/musicassistant/pvc.yaml
+++ b/apps/musicassistant/pvc.yaml
@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
--- a/apps/musicassistant/service.yaml
+++ b/apps/musicassistant/service.yaml
@@ -1,41 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: musicassistant
-spec:
-  selector:
-    app: musicassistant
-  ports:
-  - port: 80
-    targetPort: 80
-    name: required-first
-  - port: 443
-    targetPort: 443
-    name: required-second
-  - port: 8097
-    targetPort: 8097
-    name: required-third
-  - port: 8095
-    targetPort: 8095
-    name: required-fourth
-  - port: 1704
-    targetPort: 1704
-    name: required-fifth
-  - port: 1705
-    targetPort: 1705
-    name: required-sixth
-  type: LoadBalancer
-  loadBalancerIP: 192.168.3.5
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: musicassistant-web
-spec:
-  selector:
-    app: musicassistant
-  ports:
-  - port: 8095
-    targetPort: 8095
-    name: musicassistant-web
-  type: ClusterIP
--- a/apps/ntfy/kustomization.yaml
+++ b/apps/ntfy/kustomization.yaml
@@ -13,4 +13,4 @@ resources:
 images:
  - name: binwiederhier/ntfy
    newName: binwiederhier/ntfy
-    newTag: v2.15.0
+    newTag: v2.11.0
--- a/apps/paperless/deployment.yaml
+++ b/apps/paperless/deployment.yaml
@@ -55,7 +55,7 @@ spec:
              memory: "200Mi"
            limits:
              cpu: "2"
-              memory: "4Gi"
+              memory: "1Gi"
      volumes:
        - name: data
          persistentVolumeClaim:
--- a/apps/paperless/kustomization.yaml
+++ b/apps/paperless/kustomization.yaml
@@ -14,14 +14,14 @@ namespace: paperless
 images:
  - name: paperless
    newName: ghcr.io/paperless-ngx/paperless-ngx
-    newTag: "2.20.0"
+    newTag: "2.13.4"


 helmCharts:
  - name: redis
    releaseName: redis
    repo: https://charts.bitnami.com/bitnami
-    version: 24.0.0
+    version: 20.1.5
    valuesInline:
      auth:
        enabled: false
--- a/apps/recipes/kustomization.yaml
+++ b/apps/recipes/kustomization.yaml
@@ -13,5 +13,5 @@ resources:

 images:
  - name: mealie
-    newTag: v3.5.0
+    newTag: nightly
    newName: ghcr.io/mealie-recipes/mealie
--- a/apps/snapcast/deployment.yaml
+++ b/apps/snapcast/deployment.yaml
@@ -1,101 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: snapcast
-spec:
-  selector:
-    matchLabels:
-      app: snapcast
-  template:
-    metadata:
-      labels:
-        app: snapcast
-    spec:
-      containers:
-      - name: snapcast
-        image: snapcast
-        resources:
-          limits:
-            memory: "2Gi"
-            cpu: "2"
-          requests:
-            memory: "128Mi"
-            cpu: "250m"
-        ports:
-        # snapcast ports
-        - containerPort: 1704
-        - containerPort: 1705
-        # web interface
-        - containerPort: 1780
-        - containerPort: 1788
-        # avahi
-        - containerPort: 5353
-        # airplay
-        - containerPort: 3689
-        - containerPort: 5000
-        - containerPort: 6000
-        - containerPort: 6001
-        - containerPort: 6002
-        - containerPort: 6003
-        - containerPort: 6004
-        - containerPort: 6005
-        - containerPort: 6006
-        - containerPort: 6007
-        - containerPort: 6008
-        - containerPort: 6009
-        - containerPort: 7000
-        - containerPort: 319
-        - containerPort: 320
-
-        env:
-        - name: TZ
-          value: Europe/Berlin
-        - name: AIRPLAY_CONFIG_ENABLED
-          value: "0"
-        - name: SPOTIFY_CONFIG_ENABLED
-          value: "0"
-        volumeMounts:
-        - name: pipe
-          mountPath: /mnt/pipe
-
-
-      - name: librespot
-        image: librespot
-        resources:
-          limits:
-            memory: "2Gi"
-            cpu: "2"
-          requests:
-            memory: "128Mi"
-            cpu: "250m"
-        # ports:
-        env:
-        - name: BACKEND
-          value: pipe
-        - name: DEVICE
-          value: /mnt/pipe/spotipipe
-        volumeMounts:
-        - name: pipe
-          mountPath: /mnt/pipe
-      volumes:
-      - name: pipe
-        emptyDir: {}
-
-
-        # - name: SPOTIFY_ACCESS_TOKEN
-        #   value: BQBxGPPPXZTXF7WTBzJItu3KNkeoZu2j2-Rlk1RmtnmXvzPh1fWFpOT2VeXwWxMJXlBYwxSOTo1ZKk3hAr08OhDhbQChi6KDl6qEmK-Y8Wq8g3EoP7M-oRnHt4WFMg1zC1C37t90nQUKZ-F9UdSuL9A6Ny6V6pYsai1bUspOU0q5UHn6-Dv9E8gwEKXOPMlBKEXNi1D0sT2m9rzwI7UK1g7ToRPn03eqGe41RRvlfrSCgf41tg
-
-
-        # - name: SPOTIFY_EXTRA_ARGS
-        #   value: " --disable-discovery --access-token BQBxGPPPXZTXF7WTBzJItu3KNkeoZu2j2-Rlk1RmtnmXvzPh1fWFpOT2VeXwWxMJXlBYwxSOTo1ZKk3hAr08OhDhbQChi6KDl6qEmK-Y8Wq8g3EoP7M-oRnHt4WFMg1zC1C37t90nQUKZ-F9UdSuL9A6Ny6V6pYsai1bUspOU0q5UHn6-Dv9E8gwEKXOPMlBKEXNi1D0sT2m9rzwI7UK1g7ToRPn03eqGe41RRvlfrSCgf41tg"
-      #   volumeMounts:
-      #   - name: config
-      #     mountPath: /config
-      #   - name: snapserver-config
-      #     mountPath: /root/.config/
-      # volumes:
-      # - name: config
-      #   secret:
-      #     secretName: snapcast-config
-      # - name: snapserver-config
-      #   emptyDir: {}
--- a/apps/snapcast/kustomization.yaml
+++ b/apps/snapcast/kustomization.yaml
@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: snapcast
-
-resources:
-  - namespace.yaml
-  - deployment.yaml
-  - service.yaml
-  - snapcast-config.secret.yaml
-
-images:
-  - name: snapcast
-    newName: ghcr.io/firefrei/snapcast/server
-    newTag: latest
-  - name: librespot
-    newName: giof71/librespot
-    newTag: latest
--- a/apps/snapcast/namespace.yaml
+++ b/apps/snapcast/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder
--- a/apps/snapcast/pvc.yaml
+++ b/apps/snapcast/pvc.yaml
@@ -1,11 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
--- a/apps/snapcast/service.yaml
+++ b/apps/snapcast/service.yaml
@@ -1,86 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: snapcast
-spec:
-  selector:
-    app: snapcast
-  ports:
-  - name: snapcast
-    port: 1704
-    targetPort: 1704
-    protocol: TCP
-  - name: snapcast-ctl
-    port: 1705
-    targetPort: 1705
-    protocol: TCP
-  - name: web
-    port: 1780
-    targetPort: 1780
-    protocol: TCP
-  - name: web-alt
-    port: 1788
-    targetPort: 1788
-    protocol: TCP
-  # - name: airplay-3689
-  #   port: 3689
-  #   targetPort: 3689
-  #   protocol: TCP
-  # - name: airplay-5000
-  #   port: 5000
-  #   targetPort: 5000
-  #   protocol: TCP
-  # - name: airplay-6000
-  #   port: 6000
-  #   targetPort: 6000
-  #   protocol: TCP
-  # - name: airplay-6001
-  #   port: 6001
-  #   targetPort: 6001
-  #   protocol: TCP
-  # - name: airplay-6002
-  #   port: 6002
-  #   targetPort: 6002
-  #   protocol: TCP
-  # - name: airplay-6003
-  #   port: 6003
-  #   targetPort: 6003
-  #   protocol: TCP
-  # - name: airplay-6004
-  #   port: 6004
-  #   targetPort: 6004
-  #   protocol: TCP
-  # - name: airplay-6005
-  #   port: 6005
-  #   targetPort: 6005
-  #   protocol: TCP
-  # - name: airplay-6006
-  #   port: 6006
-  #   targetPort: 6006
-  #   protocol: TCP
-  # - name: airplay-6007
-  #   port: 6007
-  #   targetPort: 6007
-  #   protocol: TCP
-  # - name: airplay-6008
-  #   port: 6008
-  #   targetPort: 6008
-  #   protocol: TCP
-  # - name: airplay-6009
-  #   port: 6009
-  #   targetPort: 6009
-  #   protocol: TCP
-  # - name: airplay-7000
-  #   port: 7000
-  #   targetPort: 7000
-  #   protocol: TCP
-  # - name: airplay-319
-  #   port: 319
-  #   targetPort: 319
-  #   protocol: UDP
-  # - name: airplay-320
-  #   port: 320
-  #   targetPort: 320
-  #   protocol: UDP
-  type: LoadBalancer
-  loadBalancerIP: 192.168.3.5
--- a/apps/stump/deployment.yaml
+++ b/apps/stump/deployment.yaml
@@ -1,48 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: stump
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: stump
-
-  template:
-    metadata:
-      labels:
-        app: stump
-
-    spec:
-      containers:
-      - name: stump
-        image: stump
-
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "250m"
-          limits:
-            memory: "128Mi"
-            cpu: "500m"
-        
-        ports:
-        - containerPort: 10801
-
-        envFrom:
-        - configMapRef:
-            name: stump-config
-
-        volumeMounts:
-        - name: stump-data
-          mountPath: /data
-        - name: stump-config
-          mountPath: /config
-        
-      volumes:
-      - name: stump-config
-        persistentVolumeClaim:
-          claimName: stump-config
-      - name: stump-data
-        persistentVolumeClaim:
-          claimName: stump-data
--- a/apps/stump/ingress.yaml
+++ b/apps/stump/ingress.yaml
@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: stump-ingressroute
-
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`stump.kluster.moll.re`)
-    kind: Rule
-    services:
-    - name: stump-web
-      port: 10801
-
-  tls:
-    certResolver: default-tls 
--- a/apps/stump/namespace.yaml
+++ b/apps/stump/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: placeholder
--- a/apps/stump/pvc.yaml
+++ b/apps/stump/pvc.yaml
@@ -1,23 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: stump-data
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
---
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: stump-config
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
--- a/apps/stump/service.yaml
+++ b/apps/stump/service.yaml
@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: stump-web
-spec:
-  selector:
-    app: stump
-  ports:
-  - port: 10801
-    targetPort: 10801
--- a/apps/stump/stump-config.configmap.yaml
+++ b/apps/stump/stump-config.configmap.yaml
@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: stump-config
-data:
-  STUMP_ENABLE_UPLOAD: "true"
-  STUMP_CONFIG_DIR: /config
-  ENABLE_KOREADER_SYNC: "true"
--- a/apps/todos/deployment.yaml
+++ b/apps/todos/deployment.yaml
@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: todos
-  labels:
-    app: todos
-spec:
-  selector:
-    matchLabels:
-      app: todos
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: todos
-    spec:
-      containers:
-      - name: todos
-        image: todos
-        resources:
-          requests:
-            cpu: 100m
-            memory: 100Mi
-          limits:
-            cpu: 200m
-            memory: 200Mi
-
-        ports:
-        - containerPort: 3456
-          name: web
-        volumeMounts:
-        - name: data
-          mountPath: /db
-        - name: config
-          mountPath: /app/vikunja/config.yml
-          subPath: config.yml
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: data
-      - name: config
-        secret:
-          secretName: todos-config
--- a/apps/todos/ingress.yaml
+++ b/apps/todos/ingress.yaml
@@ -7,11 +7,15 @@ spec:
  entryPoints:
    - websecure
  routes:
-
-    - match: Host(`todos.kluster.moll.re`)
+    - match: Host(`todos.kluster.moll.re`) && PathPrefix(`/api/v1`)
      kind: Rule
      services:
-        - name: todos-web
+        - name: todos-api
          port: 3456
+    - match: Host(`todos.kluster.moll.re`) && PathPrefix(`/`)
+      kind: Rule
+      services:
+        - name: todos-frontend
+          port: 80
  tls:
    certResolver: default-tls
--- a/apps/todos/kustomization.yaml
+++ b/apps/todos/kustomization.yaml
@@ -6,13 +6,13 @@ namespace: todos
 resources:
  - namespace.yaml
  - pvc.yaml
-  - todos-config.sealedsecret.yaml
-  - deployment.yaml
-  - service.yaml
  - ingress.yaml


-images:
-  - name: todos
-    newName: vikunja/vikunja
-    newTag: 0.24.6
+# helmCharts:
+#   - name: vikunja
+#     version: 0.1.5
+#     repo: https://charts.oecis.io
+#     valuesFile: values.yaml
+#     releaseName: todos
+# managed by argocd directly
--- a/apps/todos/service.yaml
+++ b/apps/todos/service.yaml
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: todos-web
-spec:
-  selector:
-    app: todos
-  ports:
-  - name: todos
-    port: 3456
-    targetPort: 3456
--- a/apps/todos/todos-config.sealedsecret.yaml
+++ b/apps/todos/todos-config.sealedsecret.yaml
@@ -1,16 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: todos-config
-  namespace: todos
-spec:
-  encryptedData:
-    config.yml: AgBRKmf5GSn6EcCH4r+I/lJkNiwZp0Pa/TFloYlPzqJ1aQWrTRDCLiljHYs1n/PTBWWv5SdWj+3Uvx4M+tzTXpRTp1dWomJ1C8pUDpf4N7SSZeAMoJxz5/mSUpA1YsYwiy/jhOzSsaeC80JX9WTXhCE5cnox/OUjcDf62vVg/7kgy8tHYpCSRmTGMah82642gP0/rlLpp+ctb29oYttmL0fWafHMRHgZYwkO1Ol7tmfbVOfr/bQljTQD3h/f0+ef2s3kDNtAkXSBAwHo6TfukB5bZi+pj3q3TLHAWU/belC38RZtIYW7trJf20WzbxxWKcS7rnQ8GHJqpbNgoWdnBQgP5OGHzySnQrdIAWLvOxw3JdJ8S1ZMbZfWASGpeIdfTI1p99Bhu1MGE3nnAzUCM93sLySE/mjjGDPdA9+Q7orgLGX3ct+w4deu1ABLR/HWxFYvPah11xs+MyzBFVh2rRj+MMzSWwQmbo+widmHWnzx6fjTiLd8eyGmvz1M9hBwFjqUTjbAR70S4xx2ALlYqAtbmJUk07PmTdTMhvokvaY5NX7Ylahx2oFE2q/FxMBwvPZVyI9tSbrZHEK9a67QaXnnwyfSqj3nErNkpdAa/zSJ9M6SG5cJrJvZCBn5cFg6pxtY65wZoj0GWMZ5kF2oqxDuekdjitWGMTp5q6ROJYSs/o3Lc/Abga9pSZYEtNrHr68tJuSeO61s9TjUftbkxkJ97/dwTfVQOd7aJui2EDp8NVcZg0CkEOgI7tt0nOEsll30RWS46QJwUbJM34FD646bpEk50K/GsIvFovKjZjtoCjeKczGdMpYS2XFwEMb8UjgSATxcVYjSWwvx+7prEChvoyVcg8Bi8ZEGcBVxSAD9fJu8PtyPBeijs7ZVwVyGGxiSafd3gAPU8spSuvbEDl/VZAKy9k2vrI2c/gtTqwaIasnBHudIbbNqDHlTlH8dk0z+kuNg/AzqheZWireMvBvgQ3TlHan0RN6+vVpZCY5XbzWkj/DEmoor8UfeuYt3GD7/JHniAorMPj61n2od7TLXmLunPG/B/zNpJCgJ8LgtUriDDZno99IDCXaZ/MO2+jppMaKizl83axxrv9HUTYDDgtX4RqLLdutd4i/AsOe0GgayFrOjUtDVOL6MKhX7dRJfbNsL5IcGEVZ1cdzcjjazoDpSlDdMC6E1XNS1NWprqUpmfjFPtFk1FWW3oRF3iEYUimngYvy6oTx3d70EZ+eOdEvp6A+aHbmG6fyEQb3AKYhMIOsn4AbKpDLjTsHiqWNGwT9ummS5kOLhnWBBB4ohDpCl4UMCtP61+1lhtx//Jne8QFAoq31MMFcCO2X3b2JfD6egLDc8Vwju6NHNy7jrmkponKqKxQPSs0w9Aj2biUBuFkMCiAik0Cf1fPk59bjJqs2ypwURDPAs1ShPoSU=
-  template:
-    metadata:
-      creationTimestamp: null
-      name: todos-config
-      namespace: todos
-    type: Opaque
--- a/apps/todos/values.yaml
+++ b/apps/todos/values.yaml
@@ -0,0 +1,51 @@
+######################
+# VIKUNJA COMPONENTS #
+######################
+# You can find the default values that this `values.yaml` overrides, in the comment at the top of this file.
+api:
+  enabled: true
+  image:
+    tag: 0.22.1
+  persistence:
+    # This is your Vikunja data will live, you can either let
+    # the chart create a new PVC for you or provide an existing one.
+    data:
+      enabled: true
+      existingClaim: data
+      accessMode: ReadWriteOnce
+      size: 10Gi
+      mountPath: /app/vikunja/files
+
+  ingress:
+    main:
+      enabled: false
+
+  configMaps:
+    # The configuration for Vikunja's api.
+    # https://vikunja.io/docs/config-options/
+    config:
+      enabled: true
+      data:
+        config.yml: |
+          service:
+              frontendUrl: https://todos.kluster.moll.re
+          database:
+            type: sqlite
+            path: /app/vikunja/files/vikunja.db
+          registration: false
+  env:
+
+frontend:
+  enabled: true
+  image:
+    tag: 0.22.1
+  ingress:
+    main:
+      enabled: false
+
+postgresql:
+  enabled: false
+redis:
+  enabled: false
+typesense:
+  enabled: false
--- a/default.nix
+++ b/default.nix
@@ -1,16 +0,0 @@
-{ pkgs ? import <nixpkgs> {} }:
-pkgs.mkShell {
-  name = "infra-shell";
-
-
-  buildInputs = with pkgs; [
-    kubeseal
-    yq
-    jq
-    kubernetes-helm-wrapped
-  ];
-
-  env = {
-  };
-
-}
--- a/infrastructure/argocd/argocd-cmd-params.configmap.yaml
+++ b/infrastructure/argocd/argocd-cmd-params.configmap.yaml
@@ -3,6 +3,4 @@ kind: ConfigMap
 metadata:
  name: argocd-cmd-params-cm
 data:
-  # server.insecure: "true"
-  # DID NOT FIX RELOAD LOOPS
-  # application.namespaces: "*"
+  server.insecure: "true"
--- a/infrastructure/argocd/argocd-oauth.configmap.yaml
+++ b/infrastructure/argocd/argocd-oauth.configmap.yaml
@@ -12,11 +12,13 @@ data:
    # If you want to store sensitive data in another Kubernetes Secret, instead of argocd-secret. ArgoCD knows to check the keys under data in your Kubernetes Secret for a corresponding key whenever a value in a configmap or secret starts with $, then your Kubernetes Secret name and : (colon).
    clientSecret: $argocd-oauth:client-secret

+    skipAudienceCheckWhenTokenHasNoAudience: true

    # Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]
    requestedScopes: ["openid", "profile", "email", "groups"]

    # Optional set of OIDC claims to request on the ID token.
    requestedIDTokenClaims: {"groups": {"essential": true}}
-
+    allowedAudiences:
+    - argocd
  
--- a/infrastructure/argocd/argocd-rbac.configmap.yaml
+++ b/infrastructure/argocd/argocd-rbac.configmap.yaml
@@ -6,6 +6,4 @@ data:
  policy.csv: |
    # use oidc group apps_admin as admin group in argocd
    g, apps_admin, role:admin
-    g, argocd, role:readonly
-  # all other user that might have entered via oidc, are blocked: deny everything
-  policy.default: deny
+  policy.default: role:readonly
--- a/infrastructure/argocd/argocd.configmap.yaml
+++ b/infrastructure/argocd/argocd.configmap.yaml
@@ -3,9 +3,7 @@ kind: ConfigMap
 metadata:
  name: argocd-cm
 data:
-  # enable helm when using kustomize
  kustomize.buildOptions: --enable-helm
-  # disable admin user - use oidc
-  admin.enabled: "false"
-  # show neat status badges in the UI or as embeds
-  statusbadge.enabled: "true"
+  # switch to annotation based resource tracking as per
+  # https://argo-cd.readthedocs.io/en/stable/user-guide/resource_tracking/
+  application.resourceTrackingMethod: annotation+label
--- a/infrastructure/argocd/ingress.yaml
+++ b/infrastructure/argocd/ingress.yaml
@@ -10,8 +10,8 @@ spec:
    - kind: Rule
      match: Host(`argocd.kluster.moll.re`)
      services:
-        - name: argocd-server
-          port: 443
-          scheme: https
+      - name: argocd-server
+        port: 80
+
  tls:
-    certResolver: default-tls
+    certResolver: default-tls
--- a/infrastructure/argocd/kustomization.yaml
+++ b/infrastructure/argocd/kustomization.yaml
@@ -4,13 +4,14 @@ kind: Kustomization
 namespace: argocd
 resources:
  - namespace.yaml
-  - https://github.com/argoproj/argo-cd//manifests/cluster-install?timeout=120&ref=v3.2.0
+  - https://raw.githubusercontent.com/argoproj/argo-cd/v2.12.6/manifests/install.yaml
  - ingress.yaml
  - argo-apps.application.yaml
  - bootstrap-repo.sealedsecret.yaml
  - argocd-oauth.sealedsecret.yaml
-  - servicemonitor.yaml

+components:
+  - https://github.com/argoproj-labs/argocd-extensions/manifests

 patches:
  - path: argocd.configmap.yaml
--- a/infrastructure/argocd/servicemonitor.yaml
+++ b/infrastructure/argocd/servicemonitor.yaml
@@ -1,77 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: argocd-metrics
-  labels:
-    release: prometheus-operator
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-metrics
-  endpoints:
-  - port: metrics
---
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: argocd-server-metrics
-  labels:
-    release: prometheus-operator
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-server-metrics
-  endpoints:
-  - port: metrics
---
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: argocd-repo-server-metrics
-  labels:
-    release: prometheus-operator
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-repo-server
-  endpoints:
-  - port: metrics
---
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: argocd-applicationset-controller-metrics
-  labels:
-    release: prometheus-operator
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-applicationset-controller
-  endpoints:
-  - port: metrics
---
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: argocd-dex-server
-  labels:
-    release: prometheus-operator
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-dex-server
-  endpoints:
-    - port: metrics
---
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: argocd-redis-haproxy-metrics
-  labels:
-    release: prometheus-operator
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: argocd-redis-ha-haproxy
-  endpoints:
-  - port: http-exporter-port
--- a/Show More
+++ b/Show More