Add renovate.json

Cleanup namespaces
Add a storage to the vaultwarden test
2024-09-11 14:23:48 +00:00 · 2024-06-22 13:28:53 +02:00 · 2024-06-21 17:23:33 +02:00 · 2024-06-15 20:45:50 +02:00 · 2024-06-15 12:20:06 +02:00 · 2024-05-18 15:36:38 +02:00
175 changed files with 3553 additions and 2266 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -17,18 +17,6 @@ trigger:
    - push

 steps:
-  - name: Apply arm-badhouseplants
-    image: ghcr.io/helmfile/helmfile:canary
-    environment:
-      SOPS_AGE_KEY:
-        from_secret: SOPS_AGE_KEY
-      KUBECONFIG_CONTENT:
-        from_secret: NEW_KUBE_CONFIG
-    commands:
-      - mkdir $HOME/.kube
-      - echo "$KUBECONFIG_CONTENT" > $HOME/.kube/config && chmod 0600 $HOME/.kube/config
-      - helmfile -e arm-badhouseplants apply --suppress-secrets
-  
  - name: Diff badhouseplants
    image: ghcr.io/helmfile/helmfile:canary
    environment:
@ -117,4 +105,16 @@ steps:
      SOPS_AGE_KEY:
        from_secret: SOPS_AGE_KEY
    commands:
-      - cdh --kind helmfile -p $DRONE_WORKSPACE/helmfile.yaml --helmfile-environment badhouseplants -o
+      - echo "Hey, bud, some helm releases are outdated:" > message_file.tpl
+      - cdh --kind helmfile -p $DRONE_WORKSPACE/helmfile.yaml --helmfile-environment badhouseplants -o >> message_file.tpl
+
+  - name: Send telegram notification
+    when:
+      status:
+        - failure
+    image: appleboy/drone-telegram
+    settings:
+      token:
+        from_secret: TELEGRAM_TOKEN
+      to: 131601077
+      message_file: message_file.tpl
--- a/.woodpecker/.cdh.yml
+++ b/.woodpecker/.cdh.yml
@ -0,0 +1,30 @@
+# ----------------------------------------------
+# -- Check da helm pipeline
+# ----------------------------------------------
+when:
+  - event: cron
+    cron: nightly
+steps:
+  check badhouseplants:
+    image: ghcr.io/allanger/check-da-helm-helmfile-secrets:stable
+    secrets:
+      - sops_age_key
+    environment:
+      RUST_LOG: info
+    commands:
+      - cdh --kind helmfile -p $CI_WORKSPACE/helmfile.yaml --helmfile-environment badhouseplants -o --output html >> result.html
+  notification:
+    image: deblan/woodpecker-email
+    settings:
+      dsn:
+        from_secret: smtp_dsn
+      from:
+        address: woody@badhouseplants.net
+        name: Woody Woodpecker
+      recipients:
+        - allanger@badhouseplants.net
+      subject: CDH result
+      target: main
+      attachment: result.html
+    when:
+      - status: [success, failure]
--- a/.woodpecker/.helmfile.yml
+++ b/.woodpecker/.helmfile.yml
@ -0,0 +1,44 @@
+when:
+  event: push
+
+
+.k8s-limits: &k8s-limits
+  backend_options:
+    kubernetes:
+      resources:
+        requests:
+          memory: 1024Mi
+          cpu: 1000m
+        limits:
+          memory: 1512Mi
+          cpu: 1500m
+
+matrix:
+  ENVIRONMENT:
+    - badhouseplants
+    - etersoft
+steps:
+  diff:
+    <<: *k8s-limits
+    image: ghcr.io/helmfile/helmfile:canary
+    secrets: [sops_age_key, kubeconfig_content]
+    when:
+      - branch:
+          exclude:
+            - main
+    commands:
+      - mkdir $HOME/.kube
+      - echo "$KUBECONFIG_CONTENT" > $HOME/.kube/config && chmod 0600 $HOME/.kube/config
+      - helmfile -e $ENVIRONMENT diff --suppress-secrets
+  apply:
+    <<: *k8s-limits
+    image: ghcr.io/helmfile/helmfile:canary
+    secrets: [sops_age_key, kubeconfig_content]
+    when:
+      - branch:
+          include:
+            - main
+    commands:
+      - mkdir $HOME/.kube
+      - echo "$KUBECONFIG_CONTENT" > $HOME/.kube/config && chmod 0600 $HOME/.kube/config
+      - helmfile -e $ENVIRONMENT apply
--- a/4
+++ b/4
@ -1,4 +0,0 @@
-create_crb:
-	kubectl create clusterrolebinding drone-deployer-workaround \
-		--clusterrole=cluster-admin  \
-  	--serviceaccount=drone-service:default
--- a/README.md
+++ b/README.md
@ -2,4 +2,4 @@
 [![Build Status](https://drone.badhouseplants.net/api/badges/badhouseplants/k8s-cluster-config/status.svg)](https://drone.badhouseplants.net/badhouseplants/k8s-cluster-config)

 # CRD hooks
-I'm using hooks to install CRDs, that doesn't wotk with apply on the first time. If you've added a release with CRDs, that are installed by hooks, you need to run `helmfile sync` first, so CRDs are installed and then diff will work again, hence the `apply` also will. 
+I'm using hooks to install CRDs, that doesn't wotk with apply on the first time. If you've added a release with CRDs, that are installed by hooks, you need to run `helmfile sync` first, so CRDs are installed and then diff will work again, hence the `apply` also will. 
--- a/arm-badhouseplants/helmfile.yaml
+++ b/arm-badhouseplants/helmfile.yaml
@ -1,91 +0,0 @@
---
-{{ readFile "../releases.yaml" }}
-
-releases:
-  - <<: *drone
-    installed: true
-    namespace: drone-service
-    createNamespace: true
-  
-  - <<: *longhorn
-    installed: true
-    namespace: longhorn-system
-    createNamespace: true
-
-  - <<: *argocd
-    installed: true
-    namespace: argo-system
-    createNamespace: true
-
-  - <<: *nrodionov
-    installed: true
-    namespace: nrodionov-application
-    createNamespace: true
-
-  - <<: *minecraft
-    installed: true
-    namespace: minecraft-application
-    createNamespace: true
-
-  - <<: *gitea
-    installed: true
-    namespace: gitea-service
-    createNamespace: true
-
-  - <<: *funkwhale
-    installed: true
-    namespace: funkwhale-application
-    createNamespace: true
-
-  - <<: *prometheus
-    installed: true
-    namespace: monitoring-system
-    createNamespace: true
-
-  - <<: *loki
-    installed: true
-    namespace: monitoring-system
-    createNamespace: true
-
-  - <<: *promtail
-    installed: true
-    namespace: monitoring-system
-    createNamespace: true
-
-  - <<: *bitwarden
-    installed: true
-    namespace: bitwarden-application
-    createNamespace: true
-
-  - <<: *redis
-    installed: true
-    namespace: database-service
-    createNamespace: true
-
-  - <<: *postgres
-    installed: true
-    namespace: database-service
-    createNamespace: true
-
-  - <<: *db-operator
-    installed: true
-    namespace: database-service
-    createNamespace: true
-
-  - <<: *db-instances
-    installed: true
-    namespace: database-service
-    createNamespace: true
-
-  - <<: *mysql
-    installed: true
-    namespace: database-service
-    createNamespace: true
-
-
-bases:
-  - ../environments.yaml
-  - ../repositories.yaml
-
-    #helmfiles:
-    #  - namespaces.yaml
--- a/arm-badhouseplants/namespaces.yaml
+++ b/arm-badhouseplants/namespaces.yaml
@ -1,10 +0,0 @@
---
-releases:
-  - name: namespaces
-    chart: bedag/raw
-    version: 2.0.0
-    values:
-      - ./values/values.namespaces.yaml
-bases:
-  - ../environments.yaml
-  - ../repositories.yaml
--- a/arm-badhouseplants/values/secrets.argocd.yaml
+++ b/arm-badhouseplants/values/secrets.argocd.yaml
@ -1,27 +0,0 @@
-server:
-    config:
-        dex.config: ENC[AES256_GCM,data:SExaFuvPjiyYUiqBivswX4dpPM+x/6OsmyC9FFpiX1TCDIsYNFakzW5ZwFk1XnS8OYzqksyoxAGGU2fmoTVpHXviDqSZ76g0AREH3OwtSlz2R8RwFU/zzgXeqoxw2rC2ij0t0Vg39BeltArIFBcrtTfDy7AjMqf/Qx29EAb9nnoTA/SPj33VzHbn+tJIHb/a2XExj6VAyVJoq+fqsdKmmbI0tb636V+Cq/+wj6WwGjhu/0PDtaMN9AWokMGgICLUbdtfocinvZ1gyv8+QDnczYonD+wFZdlaKDembGN3p0BggBCLOY1I9f3PHG9Yy5xpNtAGFjDYF3NLz1n1QjDwRo1La6EHmmd2pL3INtU++IGRkC64bzCKR7i429/il13MKvccBOBWiJpkf5L65Rluyb1WWNYBcI/SscfQo1CSL6zXuZtrxeWrRcySs9TjSAtwHrpuRm6hfwi1tUcUUEhu6c9uUYMhSoNug8/2vQjQiJcEdh9n+YCoUbPraAC/OSctrnmO/vsXY9CcXCWWR606Wwvr0RIX+wg4/5vCyecj+5nvhfaZvECXoCmKT8xtmVw6h2oYbAU4T7o9J93XNMVyhui4DM1JN4GYlTsfbpU1PBetUII+RO23rJDSRQdEq16Kk9RcNEUaJYcS4uH7AXvbJVeC6Cx2OwN7zSmOSbA9D2kYt7IVcnBQRGJ+cH6fy34KTwJ0def6Ze243LlHdA==,iv:c8cJLybNsyuAw/BFmKtNTBzXIl0vmeSuKW8j/aw8STw=,tag:URax9og6ZQRvWPtKVel4SQ==,type:str]
-configs:
-    credentialTemplates:
-        ssh-creds:
-            sshPrivateKey: ENC[AES256_GCM,data:qQZuWVqu3G59OLMTtYW3BDfoo/3+SvLgQYzv0Aa2NQGb/5wVFejPiJR0BAMYZjkDSVgUZl/oVCT55I41QeKcNYfHtGcrWIFvizg5jW+K0U3ZvgtnY56J1GsrKWQIC29U5EHz/7xXTnSJkkiiVEBGOjwQHpfCgsqR5/qhwnFx+idLsdJGasMYjIJZttTtLpPsY1tgUwTzqJGQptJHqG+/EDcmI9ms6383ltgc6xsmezJDyoG3A2cMNp22qctIuqTIM6ltL9iosBmMsPM1MaiZyJ7rG5zNPymTCFDQUXwlUwFoDKJnN3GkY4ApzRv43iAw2aIX8ykifZVGZOuvV/ifzUuDoemsGjD7X3GN+ngVNwdLm1qSkcnb21Q22kVmBxotIQaF9eN/LqDk2ULEMX3Yvml886yo4AnxlIA8zW8XzFfEILrEswv555P5p3Mswl0+KAIDo7cYav495U9cYrttHbU5wvr9br5JekNKVSgTigwFraq2ZUE8Za3Ru7VOuljywRwe0VEvhFv8SJoH9NZJyl8ME0+uH1R6YtIodkHpB6b6wtyCwtPXjkUkR8nzi4VU0L3zq90e/DvmX/a/q4uEHtLPiIEMFbKtUQ8v8mmscYEEvYIsIBO0VcY2CUFbEs7r56uFOiysqB4d4ySGFjdQceRTLhG7/kUjjYtGEByVcFXllhAV+1C0vXHgOXc4G+EowObbcyj+sA4hxFVL8/f0s7znVCQbZhztQsxfFr5+76X+nzkXkkhauUsMChybmVmGTU+hYnZ8XuOK6X+tRixoVNlcitFD+NxTksvDeJDIShaQvH2cjLLbkze9GmUVr3EvifQhXdw29rpgySVE0Tjn+YL23Ft8dToqR6QwTASLi/vcvbjpx5NtchuR5QFxwZYY8ROTljSQS61AMdszr5cR0BwtFY8j59Aj25sEJeasi44xzUlBxAGazHjzBDxDU7XIpGV/IkiMtaEuEXKGRpVqhQrszvuXOf9K4TwxuVvhlrSVvU7M/lQzJUzkSFOSvO9nzfnkVLwqTdTX56ODFs10vRowClKetC6PpuAclw85WlC1OTkkAL8RUCWyoPQUU+EYolUCW5nMp4P8X1XK3qvRpBU6BdjnnuLQAi1bYu8t0f4vTYoLvYTwlMGXizMHEks6me5pPD7mq5HvpR2e7i1ZzJ3oQaKPB9n8AsugFeRStAal7HHrfEA6NVXLlBYdiq9oRgwllZwi5dsw4m6ABhh+angCWkIsjB9+n9NKOdJowvyDDx1JE/Ai4wb+8hbTLtAold6YJgNA5aT7LeSVaxWVB+V8w1ghn3UJzI6SGdayJqUH+VAUDvBg4LeqGH2vrod57SF4FMmqGTQwN7cYxW0fDT9V8xnb2nQu7WaE04Miw5hlsB4uTRUfeMrXXvt3R2N8azqQDF9Himtl48U3by9vv8FPsNhq3XvAPY5/TCzHz93bnWWmdtyZlHTFz2wRAwaTwOfFpN7oMW6YyVo6UUpw10zap0Jfboq8szF////nwEHf8qGw3dxT85WwBR9KBPwFuHZQsoUOuy00PuAB5fVvXXWBiCnzYwWgY3NqTBkLYbV8D/6UnLlfAHhnEok7QXf7P4xqbB/6EmqCmGBw5ZgPqg0bY6mOTnMrfqiKV9+Q0Mhe8eFPNOr2zoR+VYRDnWX+rJu1+OAK8QegH1Jn3RlOg3lXoFDFLelq6GEq1Kdbr83goL59/uRu4VNvAArUJ9tk4Vn2vWEtnbpjRcyjwAHIc1YXphY53cPFdSjYCeoNv5MDEt3oJAKWhSX7Ql6ledftGWB4fhns0OK4+zLN6osqrPNtLyS7iqXhcwmUIx+b6jzblKt/FAssFOw6VVpi+nVrBWHDW4lhHiCu37VYS15Vtjw+JCPbAe30MOquhXn1CnEnoV8mDoDGTeMpvpP4BTTgsLmloXfv8/+TjNYfzSWivvXjY1K0P/KGqoEJfIyYDyuxi7t2qJ/CwdvBTJkF/cTX6yvX6IvijKuUco2aIgpoZfg4JR6VL7Gk3Cvf3YBvnvG8TspBOfO3ZhwTS6vfQeDLs6kf+gBtXduJTqAXuy8X8B4RZxsNGZZD8hsSVH6xP5akN6waGqG+xDQxKTT7FCpmi0igvvANRROF3+KxGigPTrIqa33WDglrD6tUfUKNUW/SuZXXjbrgo0lillsXj6i7esSLfgH9CjUfeVUW/mI7mvW+0xjV/eeZtxRnz3ADGgfObV0XakEFBDhDnXtmdN7RN+Q+UvtN0uYGYWYqnIPNewm5RYwVGtGNWOB42PdaKH0qRUdWvCAbsKflPxW5pJNZlejhoMm+3+j2UlrY59dGqTVPoXkWgIGxFkubrtN06zAhVEV6/PcCZoGJmZsPWIfiY5k/BZljtZLAa1e2cboD/0q8iX0VzyRSmuKzVYMa6/NTU3PQ8l2x5fQRRq5OR33P2N36Wb6cO7GB9mEKAElTnd8oLlJ3T27EBctdNf8gOBIYWtGo+lYtKeh/NJm5o7KGIdjhThi7Lrbyqaxb294yxydmrJBh64dws+f3IhUQBLz+6lk5PM7EtrBCGuN7PqdqQMHqWMcCvDCHxY5X/U4zrWMAClEifJfC0b+3HthLkBHb388nGMo2ymHq683s0PxmmY0lfpncUEGHu+1J5E3w2BEy5Qv83x0RQDoDFab5lxILo6VSmZru+Kj18yeqNiNw/CzHaMvID7Gio1jaq3DsuD4bA9ne5Je5yAK8INrYRDCSzMfQpc2QqE306tonmsu37EKGHTCOaaqfL8/f31nqZcdKAdidM4JBa+osYYVUCp50Nn8h94dczpjvC+M2hEQXbibUSwyPjDv7ptwfZSEPG1mjbrOEpRSbzh3lGbE5q9K7bNyt0aJRi2gOw/shU5rPxmJ5KoL0HUEc74pZRG+Csa3ZKruqYqOEezgZmVwo0E3NQD8u/y/oF/L8hgKj2jcRmJS/pKbr2Tv+Sde1ZYdZjsXW6tFRjPDZGyhjHBriPLikN097kmuPFWS3f4ZFPyHM/Az2uzPPBFGv7VchUbFScIDgBIq+fYnTPtjjST7FgsDxpzTkj8uliU9z7r0dTIawC8qSUYErsFYSvUITySWTam0R04yitaArcH5fLEhEeKKMjGUVkwwxGxfv9Fql6Zs1YSCKka9aynXDUmw6igbRJVIPtmEosrmFUzlX1OEiJrX5xWOVAv3wQ2vrxvwHlmOMtr/cQagvASds2kC4QJ4qSwc8YdpLAwrn4+h7uNP/QChAOVCiGQXpFqd5ab/LBc6Gc/1Zxilil1kecMFBc/XmVssw72XSVoXVJPlIyiSYOAtm1BGQHJXRspP06/M+/5ffaHoEevqB47kf6bE8c3F9SwksgwGtaqXdFBoKSQcret8Tww9C8ZwDji8v/woVu2COXWaF2HLg3r3vrXa+DVVz1ENtOmJEJYTCuLmdqpZsWv4olC2wcCUEA+po9kZbVcEAfKd0xe/0x2fzqQ==,iv:lDEAwKxgoRPH5AtF2kYxPQjHkw3/kbbpoz3jlUsEpTI=,tag:6dbL9WZoTZ2xSrSVE4Dlhg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxTWUxY2hYT0dId2hsR0x1
-            MXFtRjlSelgwdUcyVnBUdlJ6Nng1UkNJaHg4Ckc5NXBORjBCZHQyc0lDTiswazNF
-            cGhKVFFNdlZnRWlxS05OTklOUDJDQjQKLS0tIDNWNDVVWXcxUW8yUHgrOTNkRkQ1
-            MGNDV2cvUUF3dWZHSlZNeVFDNXhzalkKubKuiiZuqoZTvRMr2FiUxnFUu+Pvj3Wf
-            pZTfZg9rnUukmV+kmwqQKcfoPNfeShhoAsszWwPM628cV9pq87I2/A==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-04T16:16:37Z"
-    mac: ENC[AES256_GCM,data:4HhqNV9EIcBA/nzxuiS21TWe6BQ+anfEQOnfrYcZ2vVD2dTPzc0ztZ1Ihc2WX6sMCVFDpUJFEcr38Aj2tXnnS80kTsnznBsSFNLj2b857PWXNeoAuwiiY3XBq+Ndo7I5wCYgWyuaH8xWQtd5JVuZPpqdtjTkbWq3lj8aARJUuQw=,iv:Hlu6iaBBQovSaXYAEB7nWBL9OM1UXYxQ444s5ZrMtuo=,tag:N/znbxYVwFoJ1eYAS8PE4A==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.bitwarden.yaml
+++ b/arm-badhouseplants/values/secrets.bitwarden.yaml
@ -1,22 +0,0 @@
-env:
-    ADMIN_TOKEN: ENC[AES256_GCM,data:ea2lgOEYMi8Dsvun00YZR3PCE3ycNC4Mpe+xye9YL5CTtnyrDwV9Tw==,iv:28Tcn1/qIquS4jCNBTtspB9c+5U3Ut1zoY6gIez8fcs=,tag:POmhoUY3t4w+iTJKK2eHVQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKL3M4VWJBQzZQdHRDcXVw
-            VWIwcjd0Zm44V01DTW1aV2FhV1QvT2hpcUVZClJ2dHdvcDYxalEvMXB2a1F1WlRy
-            K1VOYmg4cWprSHpLSVJVK1lYVXR5cWMKLS0tIGJ3bHNIZE9zR3RuZmpmMlZBQ1Qr
-            dzNYMlRnUDIxK2padTRCSzR4UUpWQjQKxex3RqZGU7ekdNC3qIiqdFs7d7a0Pxa1
-            amLsaNnBfJ3OqjuD8atF2iCAXy1Q2BcXunkWi3wbzHb/DgYly3n9OQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-16T18:40:43Z"
-    mac: ENC[AES256_GCM,data:tbPAgDQGA8MPnG5mIZLfvsOKdSkpOTK1Oy7uIQJ3DsNtBIt9vSO+vYxNjvfjAHyB6vE1cfx8zJkRcUw8kPh485jOxsM9G1ms/sjZKyJwsJbMjiqxs5zs0E4X9sqpJWiIhILBreZ8IopK4hCd2uLvhoV/HPxW8FV/HnHoCQ5p2Do=,iv:FtgTWFdkxCPOsNiJQWWIUmwYgh5rqRcbM/ToShcSODY=,tag:yc54xWHdq4KnSNxT9breOQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.db-instances.yaml
+++ b/arm-badhouseplants/values/secrets.db-instances.yaml
@ -1,29 +0,0 @@
-dbinstances:
-    postgres:
-        secrets:
-            adminUser: ENC[AES256_GCM,data:pKbAQDiOs6k=,iv:yET0mJtdm2baDJHwq1uYEoxye48g2PrMqiOSO3POTBo=,tag:wuIxhHiRzjSRM+uaEo2KNQ==,type:str]
-            adminPassword: ENC[AES256_GCM,data:/U3q6RmOYLpxJBAYsJ8f4lV3MB0=,iv:dw7g0E4Gm0YqtgvdcC+bq+YbSRPop3BKLiJfwaz+1io=,tag:NAXnWj4AjgajN94ml/ENsA==,type:str]
-    mysql:
-        secrets:
-            adminUser: ENC[AES256_GCM,data:XFEGew==,iv:7aj2J7Qs9mHC5kRZGrg71hwEBP64vEz0qQ+qoPHSgrc=,tag:/Rx5yx7iMU5Gwcmbf5GVSg==,type:str]
-            adminPassword: ENC[AES256_GCM,data:vYIiHccMkX7yJ2gsVGcLTUO7Ers=,iv:uDlefG5I/cirIUal/phlHCNwYtcXYFBND54XJ+n7eug=,tag:YK7pdaohOZL9yg4OiPxbRg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVbENvMm1YQzlSV3UrSEJ4
-            VTZ1RWVKTlpsUDFzQlVjMlJEZmIvaldHVXlFCm9SVzN3Z0dwTGo1Y3dnaHhvSmpi
-            bDIrMlJhbHhKUmRZejdkTmJiSDYvY2MKLS0tIFpRbkwySVh2MDlNWEFNZHVtY2Ns
-            Wmh3Z29ZSlBhbmFJNkFQZlE3aXpMMk0K14rSXjSF08xkil+fFJpeMV+6XChTJ2/3
-            OQecJtg+0NQPyvC+kR5qKq8roiSzNNJgTVg2wwKMdukKVVTbEGi0gA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-30T15:07:28Z"
-    mac: ENC[AES256_GCM,data:/q/LG+CgBAm666nwu+QCw9beoC8m11R5OYspnUxdwTfAv4h0yqY0Hk599hy+Yqt0brpUpj8hwqCESkt6gufFAklilSYV8SWvea7FxA4Jdbfpj1kfty9d4qMxHrpggId/jPshVAVsF0Ezh1/XbPWpQnTiaAMu2JTVMR9cFR3xvyc=,iv:37EdIo9QoUemTvpHSKD2kdq1FnJpwNXGr8ym0dPX6w8=,tag:ri2ILtd9FvLJf0O5iKOdyg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.drone-runner-docker.yaml
+++ b/arm-badhouseplants/values/secrets.drone-runner-docker.yaml
@ -1,22 +0,0 @@
-env:
-    DRONE_RPC_SECRET: ENC[AES256_GCM,data:RAZbnTrv9PxiCLLqjKWBtFWd+Nzqma8Zw+NuKRLO,iv:IiFcTQGUmYa6UCBzx1yTDd0zwB6D1Cv0raXZxLXm1qA=,tag:83bnBW+MhkKehZfso3g+/g==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOVk0yaTlySHpuOWFFT3J5
-            Z210NzJPTmV0akdFQ1REM1JzK0pwTC9XWjJJCm54QmQ3ODJwakZuamMzYTBIeEJi
-            aUxKNmQ3dU52V2N2cjl5VTJpTTAwWGsKLS0tIDFyR2o2VnQ4QWFCWWRzZGNMZnNQ
-            em1VMlhBNGRrVFhXVUVRdU16Q1Q4bUEKvZ6UbZsfdvfCk37FlEN4vg0RTnPO2nwh
-            DY4klzcan+9DBRT2qdIIy6pj94GuSoXKXEYc9X0AvYab/HoLithMWA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-05-21T09:27:21Z"
-    mac: ENC[AES256_GCM,data:U2JETtW0lbb2znJBupGMPsab13y5M1v1N0wkFxEBs+YVNFhnkvIqSZiY5mq9KTYiY4tRzw1kV+jqP0jNsODekCI1++4NBuQsGSZFUoTERHgTRlnz1aAS+nf39lvYnWyQxsQmw9vY/GQ/yluBJkOEV/EoIF3wHjxZe1HCBIViPyk=,iv:WMj7aSgW8LdNQbOgC4FcyOtR/3gjckiHO8vlZGdiTeY=,tag:Xty2QVLJ/D2dlzQY13od5w==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.drone.yaml
+++ b/arm-badhouseplants/values/secrets.drone.yaml
@ -1,24 +0,0 @@
-env:
-    DRONE_RPC_SECRET: ENC[AES256_GCM,data:W1OAxQIUbVU8uYHtxujhPyww4jscNH4LwMAGOU5v,iv:ouToTniIMiy757x40MKMtmLFBVzpuGxSYOTMZmmN8ck=,tag:RZ/cb7cRXDQSAQwGqdX+zw==,type:str]
-    DRONE_GITEA_CLIENT_ID: ENC[AES256_GCM,data:7Ohn3nGR9VeIhAr9EdW1/juRFo3TXpKIwU07hD8mGoyBrbyn,iv:9/y3Ou8H/PL2hMsirJaqviKGQuzVlzL43iGAKQb9NII=,tag:EZoo2F4/HoOcacWOVU9yjA==,type:str]
-    DRONE_GITEA_CLIENT_SECRET: ENC[AES256_GCM,data:2wAbiSJdDb5lGUOocK14pZtwQI0EFmXGStAigKsPGAZUKyn7M0B6xBO1+B3wZYVnIKEohiNIZF7k,iv:Y9aCzdSH5cAIZfk84Clto/IrQMRaoH+bOkvbP+9CcLM=,tag:FVfLsEA56WGNCl/8ut4F/Q==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaREllV3RqUVg0anpIU1Rj
-            RFh3WkdGdEU5bWg0bWk3bWU5OHFkeFF6SGh3CmlOek9zL2w4a0ZHc0p0WTNucE1Q
-            dVpDeW93QlNHZGY1dWhOc0FneUFjQUUKLS0tIEhuZE1CMmZLZFIxbXJTZmIzcEE4
-            QStxOG1iMWlxQ2dmOXRabXp4cm9NSU0K/+CRAc7DH4PgbQscXvDb7yLe8VoEpixr
-            icD3GL37kYE2D4h1cm+p+/b7BF4/yjNlCUvo5cITXRjZAuiWGwUixQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-05-18T17:11:19Z"
-    mac: ENC[AES256_GCM,data:d9G44MW63rUa/MQaW/rLQQ4dlgOOje6qaS1V7yWT3HrkRLOXRCfuK5E+XeWC1PuQwMk0ghaNYJDT0FTnBsoJbxlu+7Vb91qlItn+azvldOFDvtGTRpAK7bPjM+p+G4/gZsgarFxaTh7py6Z/HsoqP1RvaK8GWNhRl7VfTiFuUrA=,iv:e4IXbSSiHMTPc3WijuwgF8L5aG5iMMfu6P/IYD2cp5A=,tag:aGqcqjjrO+PfYxfIAgSmeQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.funkwhale.yaml
+++ b/arm-badhouseplants/values/secrets.funkwhale.yaml
@ -1,27 +0,0 @@
-djangoSecret: ENC[AES256_GCM,data:CxsJVhNxku3pohREaVs=,iv:KDupR8tZlPkPeRwGWzyz+eKtp1tfTdFWqXNuQW20oXo=,tag:lCHqv2CC8cXpnqTr8fGzPg==,type:str]
-postgresql:
-    auth:
-        password: ENC[AES256_GCM,data:UskyESNKl5iPjb7oIq5TfeqjNkO3nC+mfR0=,iv:vDmrY1vTg9g6X5WCk+2p5sVcpMPA6jpiEQARs1+Zk3M=,tag:ORgpVIrp9cI62XWT5F+6Mg==,type:str]
-redis:
-    auth:
-        password: ENC[AES256_GCM,data:fgxZMA13BpFf5FA8JwLUXjlelUgvR4qtg316OALq,iv:numLe3PrsToG0Fbl7+mdbWOBTb7XrgppF09pIVg+rrU=,tag:ivKuF0xFe/s4P1otjLML8g==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRL0l4OHh5TTd1UGoxZFcw
-            TUtNYkdYTzhRS3hpTHkyNlhoT2hTek54RlJnCktpZmpDNk9mYThyUVZOUTAvanBL
-            VElHYjR6T2QrV3N2c08vZ3JHVWdjSHMKLS0tIE5nREIyVlJ1d29UVzE2aFl2Q21Y
-            dWdMUFpOOVJYSXdBbzJiSzhQM0VmbWMKUqdIpfa8i7vASIga8HFurrPf1RgA+WVA
-            GZiG+M0i4yc3SooTIwbDzH0orfaEHueKdNTGOXMgxNiRIt2q9BG76g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-08-11T08:34:32Z"
-    mac: ENC[AES256_GCM,data:AikzAts99EflYORsPmCmrybJNFCiGGJ0hzucdm63W18yLwMtWBcPByWSvBI4PTKORA48qoU5IqjwdekfsgE85j8n3/q5tCXPukrKZaUqpJVvxqcR85/u3Ij25eLpo8vpcFMqAl+y/5xpTovACO5tNO426GXwZQSAB3868jkRNNk=,iv:29rkrbhKSm8HhXHtADjJkcHc3aKVt0Y/r5cjdMQbBik=,tag:tXqfRwupjW1YJp0iN7vZSw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.gitea.yaml
+++ b/arm-badhouseplants/values/secrets.gitea.yaml
@ -1,40 +0,0 @@
-gitea:
-    admin:
-        username: ENC[AES256_GCM,data:f4o3zs74rjY=,iv:t5Cx0suxiZduwL2bsfNyxOVI8RZH1ytEGUdOF2nONco=,tag:mo/BwFwzw7e8tAX6LyaIQg==,type:str]
-        password: ENC[AES256_GCM,data:TnIUSnX7Lj+2N6mWWOvVVmc96DQ=,iv:vjow//IrtvdmTg4jYenwTyUnuBhq7witfzugbE0uq9c=,tag:L5UPa9UK4aB1wY1ilZntzg==,type:str]
-    config:
-        mailer:
-            ENABLED: ENC[AES256_GCM,data:C2qWn4E=,iv:APUvrTInDdxf1tJ5eFSgxUej8e085HZalsiHY6/Fryc=,tag:MW3KhfU+25EWDzM/+QOZ5A==,type:bool]
-        database:
-            PASSWD: ENC[AES256_GCM,data:bWegcAAPRzXxPv6bt7lK5hshA8QPOjQ+Tw==,iv:f5xXyu9hZD8ZNLhzWs2FACs2Mr4cEjcQMxtBEyOn+Gg=,tag:K/Cx7csHeXVwAC225MM6aw==,type:str]
-        session:
-            PROVIDER_CONFIG: ENC[AES256_GCM,data:i/N01zYx1H1D1eFiZKOmf4e1LoDBJE5AoN4eZl3h/QKwOEy5x4LNQoF7CbGguCBMvITtYbzXr12VzQ8pxEf17z6nssQ2nNiz84zuBOY9DQqxZLkxS5AmKKgk7XKF/YYYDaavMdJj54gtXoCrDZ58z5Tw8FM0ScTRp2+4RXGMwg==,iv:dKZhe9cOPDhdtK9sJKzCHmimV1vcuAebY8DfaJMqk2Q=,tag:ZhyEepW4wIM1Dv97xn5xBA==,type:str]
-        cache:
-            HOST: ENC[AES256_GCM,data:UI4Dgb4qajStyDcpuJaoJTaTo3vowWQw272Y4C5q3DuV9DarChv4Qvxh9ZJwYsPSgO9G/3eI+mLldipW98HLfATMCHR+DicM7ymI0nGwxeliyj7sOVGFS2dU4zF1kNyhFCqrjMfQzTRQbfOTiB+QyfhluMfrDbOjOAAuLlsdWQ==,iv:WOlGAxAtIS12vCGIUmxMhO3UIsoUuD3xluZbBThugW4=,tag:Y0Amh1HEtYcg+9JvROM1eQ==,type:str]
-        queue:
-            CONN_STR: ENC[AES256_GCM,data:kpqTpJVI/8790Ho2/U8YTC2Sc/d7v8mc33PsG7vNO52d9vMCOgsb+GQldWlfMPdf1H09axJxdFc5SIvsWWD8FoaXvtktlz4yk6fL9YxEXnkpn72VSiNe+ajUu6diP4gYWw2cUhyKt3ss/Gx70bKMEyE5g/ecZG3S+NZPFxPSTw==,iv:T69ou0uBg5CrseI0VwB2sSKRDknXrlUVPb/igGI/1H0=,tag:Y42Wa4QVt8k6AmhDC5bOAg==,type:str]
-    oauth:
-        - name: ENC[AES256_GCM,data:iR9QX2Si,iv:B+4ixm+dOwAnXFCYq2BnExnfVDGooonBCiHpyxfkLP0=,tag:r7CZbpL9uQ1QjAFNiFfOsw==,type:str]
-          provider: ENC[AES256_GCM,data:byE4rELH,iv:lcvbNSZMD9EMA4CmJF2mvN33a5fmXWzP4++PnNPK+fg=,tag:2wfHrpp/bJJOImBq5ULzqw==,type:str]
-          key: ENC[AES256_GCM,data:hiIl59SdN8usULpHhPX8XhMckZI=,iv:8aycsJVxbyK+Rlor8AsYKb6xjjSaS9Y5pRC/hoHzuKs=,tag:tBhMPj+AF86TaLkxF0+6Og==,type:str]
-          secret: ENC[AES256_GCM,data:JfoXbQW4G3QdDsb4WxbMOIBvsEVYXsdK06s2TLO6ojtgprYUb0ZKHA==,iv:n1SYPP3tnUCNuKET0PS9kIHcRSDMDqWtysjwbSI8O3A=,tag:EJ3gKUsCG9O218yS0sw9EA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkMCtwL0h3aGtNQlYzVC94
-            QVFvQ3VsTnVuckt1eW80RXFkTUw2VzdzMTBjCjMvSDFlZXpyM2RQRTFTTTJrL3Zu
-            LzNlRy9ZVTY5cWh1WmxmbzdwZVNHQm8KLS0tIDdxNGlxbnk1SDc2R0IrcmFHMmo4
-            Ym5KMWw5ZDBBZzJBcHBXdFZiaDZpU0UKNl/GkGP25D7z5a8mVBmoSTfOM3EzymPN
-            WW62zIoBHlwLxF9nwj1xCCtcL1XKgiB8nnn4IrY3ljqFc0VkxD9dnQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-08-11T08:34:06Z"
-    mac: ENC[AES256_GCM,data:e9mVJNxq1ZrBN1MI/1tYQXvdEB3z7F5j6FGEYDw4y0Ig6X5ns/degTBWmqL5KKsIpvD2j6t4m+GGZ2v4/OBIN/Er+zA3pSFA9lvT40XitfMkg21vfNRGir5KhWZIVIIZLNvPpKefyESApvMIQPlKwuH3/jcmlbI1SiRUaqXw/Oc=,iv:te16mZan48whDcl4q1N/V0jemzkWlW8T652W9iI44b4=,tag:xw+Se750BqakVBYlqx5knQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.iredmail.yaml
+++ b/arm-badhouseplants/values/secrets.iredmail.yaml
@ -1,25 +0,0 @@
-config:
-    env:
-        FIRST_MAIL_DOMAIN_ADMIN_PASSWORD: ENC[AES256_GCM,data:dcrMgiX2egbSllo4esVRcJ340oQBRpVkRA==,iv:NQpe96WmGRAnLmeAK0VT/zdJ8MS/8RfAJIwNsL8alHY=,tag:CjppOC4SEW7a9u4Q2xlm8g==,type:str]
-        MLMMJADMIN_API_TOKEN: ENC[AES256_GCM,data:OxsD/v9ACQuoyHrxZmIdq8TUqmbWCh8GhGaSQTBGfS+vp+v2rdfKIm4WTnI=,iv:68Vli4aaCOiFixooz5cHABuRLuOrw9/HNpBNQzVwAkg=,tag:RXBXFzGCOO6MhoeNhES/+w==,type:str]
-        ROUNDCUBE_DES_KEY: ENC[AES256_GCM,data:RZni9nCThb9xzzNrN6JTQsLetnMB9cSo1L7hwLERnbA=,iv:L3r0I8sQkoicwy6odvuF3HfIEDQVgnOtn/OMpF16Dis=,tag:ZFaoIywA+FJ/GHAZAGjU2g==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZlAvUXJBdzM3RjJMdHNG
-            SjRpSTBYNUs5NEoxRFdLZDN0a2IyQlp1ODB3CnQycFk3SkM2Ny82U1RZZmE1cWxG
-            TTQxUzhWRWlPQmxYUnN5dVJpb0FWa1EKLS0tIDZSK1NvSmNUQkZucFJCM3FiRHlI
-            L0VKb2JCc29XWjVkODJxTmxPZXZJc3MKyDy9BH0W1OgEONm3PLCskOWtIr2YW2V8
-            3Lc0Au6lLYetVCvSB82/uylZBHc9yQ2rNdLBUrm1zyDZJW/BmNpVLQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-17T05:06:27Z"
-    mac: ENC[AES256_GCM,data:WP9F1N5ZTYwJk3UfiSwf/QJHp06pawdbu6kUBOMTq1tWOZ/zhCRe0vJzU7alUxhw1RZu8f6tUNeh6qXxt/4mrSuy5dRjOKOJyRioIcRCdg4Z+2jVycDAA2VlPB1oDQj0CIdrW4hvM02KZKxcOy9KP8iRQaYqLlhvWrTAQZ9HAIA=,iv:d/wZUbaU9EkBPRIxqCDDXpp8AMjjHnXxej726q37Ni4=,tag:AC4FvAFBTYOcI02bFD+MHw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.mailu.yaml
+++ b/arm-badhouseplants/values/secrets.mailu.yaml
@ -1,38 +0,0 @@
-secretKey: ENC[AES256_GCM,data:yL0+ORBJ4ZWHrmoNvVowEA==,iv:XJuY89wtdz8b+9SnTMro33Ka/pBOymyhN3MLJOyujAA=,tag:hSXjKC6+6NLgCoiHlbqtxQ==,type:str]
-initialAccount:
-    enabled: ENC[AES256_GCM,data:MvyEVw==,iv:ICIPR4oJW6pCRUks7Rk70NqdxVTXYqmM2qjQetppmEY=,tag:1FOK5MyPSTaiDayAAaPPuQ==,type:bool]
-    username: ENC[AES256_GCM,data:qSsqS5iQAyNzAQ+ZOLSWsie3k04b7qPUpcfU,iv:sXe2sjo4XesoEmjI9tY8gYd2psUlZCltBtLlIyE+v8w=,tag:uZeXnjU+7aLHI87qW+tiGw==,type:str]
-    domain: ENC[AES256_GCM,data:T5w/nPrq36iwZQdYHMQkisY1,iv:7EskbKJfRXMhkKZBgHy6nP8r1epcf7bNi8gAp4qY5TI=,tag:nZ+0BhvIy9Ap88SHaKhSvw==,type:str]
-    password: ENC[AES256_GCM,data:dki7Cw2n5FxYsINS+aap4u8hkQBl4RUVW2KxSXrQ,iv:XxUHdy5xAWoH00yxItL9P5YuCJtCG4pfRUhZdOr0EWw=,tag:Lo7ahX7CAXS31lFDKEYRww==,type:str]
-postgresql:
-    auth:
-        password: ENC[AES256_GCM,data:o2KghCpri6cUbGeh3LIjUO6TXBz4nrZSaU8tW7PD,iv:KNp+FM1DqC2h1/F2cudAQfQZA6UAD833SQbEQ/oKkTM=,tag:oHZzKLzZ+IIJDrjFDX/3cA==,type:str]
-        postgresPassword: ENC[AES256_GCM,data:2+RrJdHwGQVU910BkXH5ZogDfh8zoOPDcJazg7Iv,iv:CKH/lhkTYNbJ0sKQCwgZ4CDg+7ITsbJq3wcQiJWogtI=,tag:xZX3HSfpC2Wrz1sCOtQwYQ==,type:str]
-    secretKeys:
-        adminPasswordKey: ENC[AES256_GCM,data:LbBjpvmdVgIDLtlL5ccufC7Pe28ZVO5CYxTzVoZD,iv:dsVuk1ZluIAhtYN1s9xH+2Jk2CyVYGRU2LoxnC5Lgb0=,tag:lWZohYLUyVnrMKhvwIz7uw==,type:str]
-        replicationPasswordKey: ENC[AES256_GCM,data:asv/FCVAPir07vw5kW1uqSPGEKTR/ukwtOXY5q8j,iv:SnEftPnqXdPK3Zw9nd8Qnj412tHrPSK6hR0V3rLfn3A=,tag:xKqOjOuSyMKSo02r8GyVbg==,type:str]
-        userPasswordKey: ENC[AES256_GCM,data:NNUZ8zVSem5Aov/PxFbc7OjANRVa5g5WjyMLRX1V,iv:c3XDq6nyea5ErJZHMKwxEqNfpjBYVGiqbAgqko5nsjI=,tag:HrhLvBxraIKFhNPaulM+uQ==,type:str]
-global:
-    database:
-        roundcube:
-            password: ENC[AES256_GCM,data:V7Ml++sPS94LzA==,iv:aQ36cTMR5ArSows/3+z10nFIRppCkSvQx6VwtB30hno=,tag:2yVIXNHJ3HbA/sr6vnX7XA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGa1lRY0tQUk05WmpINVVw
-            YkJkVDA0QlZibHFmbDdPTHpGTTY5N0JodXljCm14aVVSUm43MXo3d0ZlYWRUMXhh
-            b1VqRHZXUTArbDNpRG9VY1U1a281ZW8KLS0tIHV6NWZQdzVzWFdJU0ErQy9WTFMv
-            RjVVYmRKcERYZVhMT0ViZzR5cm8rMTgKizZBRrU/WauUmFYm9fnouiegNkYZkudp
-            QpOha6CggN8rItelbnWMHlzGZBzM+77mFocuGmvNuTY/YGSkXfLjLA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-28T08:37:51Z"
-    mac: ENC[AES256_GCM,data:NtXsrrs9yWlVO6oBQuJKHKPlmFMkqmu5BqOrYjdj9R7KdYycIWRDlNojieP9lghjSllgjkR3N4DpST9n6r6GHOkrpCl0eX12AsY0GUhSwaJzMgvX34Kzo+BjtISvODy0UzEVb9qKzbFuO9R4FMqyxBjTJirJVFT1EIB7Hxbb5Zc=,iv:OFKLvj96oRasDg5sYbJNS5KvZnxOXhh36Nwjl2gA1v0=,tag:aWsKrlbubuh+xTnyxvWeRg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.minio.yaml
+++ b/arm-badhouseplants/values/secrets.minio.yaml
@ -1,35 +0,0 @@
-rootPassword: ENC[AES256_GCM,data:7baD0HwMztU27TymEWp+Ad1s8Zc=,iv:CXiTBEGU1tr99ibNxcFO6RtiC7gjtqSqYrtfmbwocIQ=,tag:ravi1nGLEVSqELVskv71CA==,type:str]
-users:
-    - accessKey: ENC[AES256_GCM,data:9ZhHOes+vQM=,iv:ltKbQ0KW8/Jmn7kmTaGaDcerlkquTXhGr0wbMMwxNgA=,tag:X6n+44dvPAm4v2rcxYkPEQ==,type:str]
-      secretKey: ENC[AES256_GCM,data:mzWBQcPitrpwIMqBrbtBs3RBDg==,iv:cLA6Wvmf5il54DFkNbwQ27wPxAm/eqSrxAc3MVELero=,tag:nUc83Ctqw4PTwirkUr803A==,type:str]
-      policy: ENC[AES256_GCM,data:szr/D/u/ng0=,iv:jzm7Q4zdKQpNV0FgJ4jA9CuN7r912ySBJHmxKeQGS2I=,tag:cKarFmhIbBEtslSxOc4mcA==,type:str]
-oidc:
-    enabled: ENC[AES256_GCM,data:lK45+A==,iv:NcoTJPt4XZGRlVRwpsmuI5nu66cGVksQBRAwRval5JY=,tag:kjtPLITQLBOqjF3IaJAL8w==,type:bool]
-    configUrl: ENC[AES256_GCM,data:ZNVvWPlFPA1xgfysavsEusfxE2ySIM9FYatYqfWPnUrHKMtCxYlrn1ip3nTYL2JHvjM3yltLBNbqWMCGlgtw,iv:p1F2DqCFaKvjYKhMieFytnMuggrec8DmBzDATLTVe+8=,tag:3EtpPSyRlGThov5OcZfV+g==,type:str]
-    clientId: ENC[AES256_GCM,data:kO7PkjN+5GqZCxChvtbTQb/5zo7nVxfh7MZqbDoJLIKMEfth,iv:ti3Xlc3sRVOVGtxGw/pT5iBy5rBqV2v+MhiNF3Krb9U=,tag:3LUDIkq08zGmvjJtSnE/jA==,type:str]
-    clientSecret: ENC[AES256_GCM,data:PVe+8SlNrznBiFVNpuQXIcuPkUXyUJ7DObZpRvlgA8JjUHXTy3VY7soyJVBZEMfYbNjSLLcKcWM=,iv:fbh2RcQdPf3jUt2AOI3xp09SSEaWzI4rLGZmlZY46uM=,tag:wvEBkkPsXoQXAP7fN1iDMA==,type:str]
-    claimName: ENC[AES256_GCM,data:+XEw9sQ5,iv:DgGZf/GwkJsk4lfI8TBBaGfwN8YESMu9BSOBLJkbz78=,tag:A4hvQYEaZxPNf9CZp9+YUQ==,type:str]
-    redirectUri: ENC[AES256_GCM,data:+Q8cNCvslAcO4m7VJwNe/CpEntyHfuHOrHqqtlrDILkfc0IRAA8aSbZwbA2v+So=,iv:GwzNILyqLuAYUQFKbt5WE+VCdOzSTBmGCAHcCAnzxXk=,tag:p9/86/r2DfT1mkQu+aQJfQ==,type:str]
-    comment: ENC[AES256_GCM,data:TO3kA0i503ZA+EFhKa2AZw==,iv:Cl3NvvgXz71AaCgMl062urNtcBtgk832vtxTs9MJwik=,tag:JwerK2q1L7xMv/NIoWkESw==,type:str]
-    claimPrefix: ""
-    scopes: ENC[AES256_GCM,data:TuXqq8d+Xo/1ZNi036wx1GhbNPSF2sv8uYUy,iv:u9VfqbAGR94vLPD7nnsKuz5b2sbpUhs1TT7Ah8quX7c=,tag:jZplD/t4rA+p7TtisrC9mg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4VjY3eWQ4V29rQ2VUejA5
-            cG1JTTBCVWY5WGpaVFpDNU8yRTJaUEcwYTI4CnhHVjZrSFVnTGg1Yyt2ekM2YkRr
-            RzljT003RFVURFVRaThaNnYyOTZka1UKLS0tIFYyd1JIQzQ2VEZ2b2xabXM4TFVp
-            NFd0WDBXRERZc2ZDbWhDTFhnZExjVmcKDKHKoouDK66AYXenznGjTMnahqIwbp1y
-            zA+MZx0FPO7xm9UCGaxIFzdLXK6O2ctw9fDceR6oMj+YehLOKwEmoA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-13T07:52:39Z"
-    mac: ENC[AES256_GCM,data:ognemBsF32MrBDoUTcmwW1W5VI//FADb/p0Do8aQttsikYMVLcFZqWx7Dyhu8CfOWsXL/atVLh2Gj3dkxjsmDFI8uUd4gwq0oMYtk7gR09WrrigDtV1UPgDgyLO3nW4/YmTYGx0fLcsFyGJMm1Pp08Sk+oGcP2Xt+zBAch6/xyE=,iv:Q6dAGFlaTQL7zbR1Z868zo3HbWW4/xpoaWdyw/k/c0U=,tag:I6X2USyt1AhgzjlY469jOA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.nrodionov.yaml
+++ b/arm-badhouseplants/values/secrets.nrodionov.yaml
@ -1,28 +0,0 @@
-wordpressPassword: ENC[AES256_GCM,data:yYE91wuc9uOzIQ==,iv:jLqs0BZcEIG73roA/wxtK74xX+osePoIaKhg6XvuAXE=,tag:9a3n1tbRAy4TaU0OE8uZcQ==,type:str]
-wordpressEmail: ENC[AES256_GCM,data:Fy6mIfhu0DuO+MSp1TPN7On6cFZk,iv:bxYiJBYgbuQsWPRWKfubmNZ/jShMBLeiPDyw7XtOAkY=,tag:RyBuqoNGoTzKR68RNSgumA==,type:str]
-mariadb:
-    auth:
-        rootPassword: ENC[AES256_GCM,data:oex+HDJ5SnaYrw==,iv:5HfGr27bpbXTROVMIWodMUe0WN6T3tXEESYSXwUUxw0=,tag:K83scpenVclwsEnGolsQiQ==,type:str]
-        database: ENC[AES256_GCM,data:xqBbXrRmtrUPaCZBC4NTelk=,iv:HOQHpilfi5TpD1jqI8XaEzO6W4CfdLBsTn+ACFWNhdE=,tag:EnsdqkExZi7PE7X4LlwBxA==,type:str]
-        username: ENC[AES256_GCM,data:oxVjkciMzifFIuhF,iv:kQsEGv9HIB+RTs54KfU8s/fpp1ooyzLK5lBQJZGSvy0=,tag:Y0uzVdsGb6McWRGPk2dNBQ==,type:str]
-        password: ENC[AES256_GCM,data:HV2d0nHUrOdE2Suju6/EUQ==,iv:HLOoCUdtOhm7ss8WSBkEAT4ulR+fwSNF4Oqv1XwDfrU=,tag:BBlW+z5LLmvtIwG69+De0Q==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1V2tQdkFWenZWZU1pT1JY
-            cXpVV3UxNnN6and1R0lBd1NrcXdWNTdibkFnCkJxeERBYyt4ZUtabWl5dlIxNmJZ
-            blhSUHZWTk1PVS9RUThlNFRBREh0T1UKLS0tIENKK200NnRDNUJCeGNTeFB5Z1BI
-            a2l5SG4yTjhmUlorWlJNbmFDekN5LzgKCS8nqMu72GDYjuSrfgbp/KZbHfhOdpyu
-            WpT0T6pk/oOc9ohQKGD/jvcjrMW7OZ5uYpZc/4gPdLKcOnNB+BEo/g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-02-19T20:44:54Z"
-    mac: ENC[AES256_GCM,data:ZCsQBgVwgAEfVh3Qhyiq7WDbthwliLqDzy4cyfpRN54oQ1SfuTofLKJmdPgmdraDJaCjxgb9zM0RfXS9x2wcFXWc2Q8I06TmWIEbZ1jehSqlQk1WmWWP7P6LqIvA0AY/c32tUhO9kmuftiOcT8sDmiFB/MqHBahAmdTT+0vo4LI=,iv:gcSDUwTMmuNtNTf4wtmSlXSvbje25wd288gnLEQx294=,tag:lcwpAyfDRgGfZ+H07ZkcZw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.prometheus.yaml
+++ b/arm-badhouseplants/values/secrets.prometheus.yaml
@ -1,26 +0,0 @@
-grafana:
-    adminPassword: ENC[AES256_GCM,data:AuPGLXN861DvndWdecukXKzt91sGGIMBToj7tO3J,iv:gKmj0gurV77e/jbxdyxhaxkmmsp738vB6ZAfzRFf45M=,tag:rKOkedx87g4MlRk6npgXiA==,type:str]
-    adminUser: ENC[AES256_GCM,data:Esh/6bXMez8=,iv:cRdvkpnO8gNOaKy+4kPcq69ksdXxuZClnjSvBp4yto8=,tag:ZgycOsDXJIT1mrN6nJHw3g==,type:str]
-    grafana.ini:
-        auth.generic_oauth:
-            client_secret: ENC[AES256_GCM,data:+4Qfo4aR9TMZprWL9U6lFx4B86d3ywH2O5K6rM5hmv2gROeFinp7k5p9C2pgNubIK9W3TlWSZAw=,iv:uFX2Lz3s2/aR5rcwsDvfuUGbKHNxh43ZiuCNaT5b1dw=,tag:8YdsVMaHbP6wqjubb9Ab2w==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXeTlhQ2xpK0dvMU00ejh4
-            bjZxZVMvMEFobGFqYU55a3dxcTlnRitkS2wwCmJVNHhQNHJHTVBxbk4xQ1RWbkFv
-            TUNGY3YvQUIyTUJYNEZmOWRYd3JaUHcKLS0tIHJ5STVXV0hxRUdYQmNXSFR2U0Vv
-            NXQ5SjNQUW9JOStDclZuYUlqV3FaWWsKvu2T2LmDjuJgnB0djjhJczsvDjFsH/D/
-            QDPkkl2G1luDoIjBj21uoy0daqfyskd4Yw2ZsPsZU6zuEGdFj52Qbw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-05-29T11:41:00Z"
-    mac: ENC[AES256_GCM,data:7Xs7W6smDPr8fp4AapKcUvHUsYRKkTQ3wb4CuDmL0ziQs2d73ueezEembp7RRaBQ/Q5jACY1dHQg42+4YymcTt8NqJ6SE4G7f9iqJu3rr5g5lh8mYP8ft8J1/l2jrQtCSfxyzuG2CPZRycQIo+0Tq++w6iK0iy6ExPt8cDNR2Ao=,iv:v8m4CEW6FG5rWV8fKsqACh37X9yzsB/Bl1wh+4348rI=,tag:Up71zDf12JMDjK8uIxnsLA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/secrets.redis.yaml
+++ b/arm-badhouseplants/values/secrets.redis.yaml
@ -1,26 +0,0 @@
-global:
-    redis:
-        #ENC[AES256_GCM,data:QRLnzdJ/lmaItppUMOZO33kySISWDfMdjr2nrEjBuhucnoglEVNF9Wy5IVbt5CNERajCADTVWNy/N40uCv+9n3PQVKl+Ki6YV+Q24Bzy,iv:8PvJ2yU7AW+/XkP+/9OQcrdCVAomnRexkNNw+2rjoho=,tag:U4gbrqqBwvXC63qn7jFmPQ==,type:comment]
-        #ENC[AES256_GCM,data:69gagNeejZaafGWo/Rll,iv:kW13FOrc/j//BxVj4JgEC0G/DQIOPHil0uNXpOM2/W0=,tag:sqviMlgQHiN397ukswoNsg==,type:comment]
-        #ENC[AES256_GCM,data:C8ta7Vtb3LpOotE=,iv:Kdat2trhQIQHxIpD7xhUoLRYo+a4PgzpB+S0w32somA=,tag:jgH656M8a14QhA//sN6MGg==,type:comment]
-        password: ENC[AES256_GCM,data:qdV5FH2K4w9gj4SFznfflY8Uw3ohSCO4lOE4Hea4,iv:/XYT2xiHlfRB1NLkw+Qm/QaWehvs9v8PUp2ZfMxeyRA=,tag:06XSi3K7y+9a50nZK1LAfQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxTWUxY2hYT0dId2hsR0x1
-            MXFtRjlSelgwdUcyVnBUdlJ6Nng1UkNJaHg4Ckc5NXBORjBCZHQyc0lDTiswazNF
-            cGhKVFFNdlZnRWlxS05OTklOUDJDQjQKLS0tIDNWNDVVWXcxUW8yUHgrOTNkRkQ1
-            MGNDV2cvUUF3dWZHSlZNeVFDNXhzalkKubKuiiZuqoZTvRMr2FiUxnFUu+Pvj3Wf
-            pZTfZg9rnUukmV+kmwqQKcfoPNfeShhoAsszWwPM628cV9pq87I2/A==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-29T20:22:15Z"
-    mac: ENC[AES256_GCM,data:DIdcvQXu7rivXdPFPjfzs1AeJ5bRvUBD+Hq9mH7Hp/+iqrG03fWSF2NF1ra8KfEIg6TDsyMnQLWvipxBlA654BLBNrABFoGwLsdVsATBORz0kNNY862qfyhSOaaTBHTWhPVpbjGnYav+bi5pfvbLC9yJm3SjIRtUbnaNVWvqMq0=,iv:d7SaPZLb/px7fy+bGJnH3bfNBmqbhwMijyNB0jfYgLE=,tag:LT5hJoDcSiP5FVgj0M2sCA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
--- a/arm-badhouseplants/values/values.argocd.yaml
+++ b/arm-badhouseplants/values/values.argocd.yaml
@ -1,108 +0,0 @@
---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: argocd-http
-      gateway: badhouseplants-net
-      kind: http
-      hostname: argo.badhouseplants.net
-      service: argocd-server
-      port: 80
-
-controller:
-  resources:
-    limits:
-      memory: 512Mi
-      cpu: 200m
-    requests:
-      cpu: 100m
-      memory: 512Mi
-  metrics:
-    enabled: true
-    applicationLabels:
-      enabled: false
-      labels: []
-    service:
-      annotations: {}
-      labels: {}
-      servicePort: 8082
-      portName: http-metrics
-    serviceMonitor:
-      enabled: false
-      interval: 30s
-      relabelings: []
-      metricRelabelings: []
-      selector: {}
-      scheme: ""
-      tlsConfig: {}
-      additionalLabels: {}
-    rules:
-      enabled: false
-      spec: []
-dex:
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: false
-redis:
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: false
-server:
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: false
-  rbacConfig:
-    policy.default: role:readonly
-    scopes: "[email, group]"
-    policy.csv: |
-      g, allanger@zohomail.com, role:admin
-      g, rodion.n.rodionov@gmail.com, role:admin
-      p, drone, applications, *, badhouseplants/*,allow
-  config:
-    exec.enabled: "true"
-    url: https://argo.badhouseplants.net
-    kustomize.buildOptions: "--enable-alpha-plugins"
-    accounts.drone: apiKey, login
-    accounts.drone.enabled: "true"
-
-  extraArgs:
-    - --insecure
-
-repoServer:
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: false
-
-  imagePullSecrets:
-    - name: regcred
-
-configs:
-  credentialTemplates:
-    ssh-creds:
-      url: git@github.com
-
-applicationSet:
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: false
-
-  repositories:
-    argo-deployment:
-      url: git@github.com:allanger/argo-deployment.git
-      name: argo-deployment
-      insecure: "true"
-      type: git
-    cluster-config:
-      url: git@github.com:allanger/cluster-config.git
-      name: cluster-config
-      insecure: "true"
-      type: git
--- a/arm-badhouseplants/values/values.bitwarden.yaml
+++ b/arm-badhouseplants/values/values.bitwarden.yaml
@ -1,37 +0,0 @@
---
-image:
-  repository: vaultwarden/server
-  tag: 1.28.1
-
-istio:
-  enabled: true
-  istio:
-    - name: bitwarden-http
-      gateway: badhouseplants-net
-      kind: http
-      hostname: bitwarden.badhouseplants.net
-      service: bitwarden-vaultwarden
-      port: 80
-
-  # pathType is only for k8s >= 1.1=
-  pathType: Prefix
-
-env:
-
-  SIGNUPS_ALLOWED: false
-  DOMAIN: "https://bitwarden.badhouseplants.net"
-  # YUBICO_CLIENT_ID
-  # YUBICO_SECRET_KEY
-  # DATA_FOLDER
-  # DATABASE_URL
-  # ATTACHMENTS_FOLDER
-  # ICON_CACHE_FOLDER
-  # ROCKET_LIMITS
-  # ROCKET_WORKERS
-  WEB_VAULT_ENABLED: true
-
-persistence:
-  enabled: true
-  accessMode: ReadWriteOnce
-  size: 800Mi
-  storageClass: longhorn
--- a/arm-badhouseplants/values/values.db-instances.yaml
+++ b/arm-badhouseplants/values/values.db-instances.yaml
@ -1,22 +0,0 @@
---
-dbinstances:
-  postgres:
-    monitoring:
-      enabled: false
-    adminSecretRef:
-      Name: postgres-secret
-      Namespace: database-service
-    engine: postgres
-    generic:
-      host: postgres-postgresql
-      port: 5432
-  mysql:
-    monitoring:
-      enabled: false
-    adminSecretRef:
-      Name: mysql-secret
-      Namespace: database-service
-    engine: mysql
-    generic:
-      host: mysql
-      port: 3306
--- a/arm-badhouseplants/values/values.drone-runner-docker.yaml
+++ b/arm-badhouseplants/values/values.drone-runner-docker.yaml
@ -1,16 +0,0 @@
---
-env:
-  DRONE_RPC_HOST: drone.badhouseplants.net
-  DRONE_RPC_PROTO: https
-  DRONE_NAMESPACE_DEFAULT: drone-service
-rbac:
-  buildNamespaces:
-    - drone-service
-dind:
-  resources:
-    limits:
-      cpu: 2000m
-      memory: 2024Mi
-    requests:
-      cpu: 100m
-      memory: 512Mi
--- a/arm-badhouseplants/values/values.drone.yaml
+++ b/arm-badhouseplants/values/values.drone.yaml
@ -1,18 +0,0 @@
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: drone-http
-      gateway: badhouseplants-net
-      kind: http
-      hostname: drone.badhouseplants.net
-      service: drone
-      port: 8080
-env:
-  DRONE_SERVER_HOST: drone.badhouseplants.net
-  DRONE_SERVER_PROTO: https
-  DRONE_GITEA_SERVER: https://git.badhouseplants.net
-  DRONE_USER_CREATE: username:allanger,admin:true
--- a/arm-badhouseplants/values/values.funkwhale.yaml
+++ b/arm-badhouseplants/values/values.funkwhale.yaml
@ -1,55 +0,0 @@
---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: funkwhale-http
-      gateway: badhouseplants-net
-      kind: http
-      hostname: funkwhale.badhouseplants.net
-      service: funkwhale
-      port: 80
-
-ext-database:
-  enabled: true
-  name: funkwhale-postgres
-  instance: postgres
-
-replicaCount: 1
-celery:
-  worker:
-    replicaCount: 1
-  beat:
-    resources:
-      limits:
-        cpu: 100m
-        memory: 512Mi
-      requests:
-        cpu: 10m
-        memory: 75Mi
-extraEnv:
-  FUNKWHALE_HOSTNAME: funkwhale.badhouseplants.net
-  FUNKWHALE_PROTOCOL: https
-persistence:
-  enabled: true
-  accessMode: ReadWriteMany
-  size: 10Gi
-s3:
-  enabled: false
-ingress:
-  enabled: false
-postgresql:
-  enabled: false
-  host: postgres-postgresql.database-service.svc.cluster.local
-  auth:
-    username: funkwhale-application-funkwhale-postgres
-    database: funkwhale-application-funkwhale-postgres
-
-redis:
-  enabled: false
-  host: redis-master.database-service.svc.cluster.local
-  auth:
-    enabled: true
--- a/arm-badhouseplants/values/values.gitea.yaml
+++ b/arm-badhouseplants/values/values.gitea.yaml
@ -1,115 +0,0 @@
---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: gitea-http
-      kind: http
-      gateway: badhouseplants-net
-      hostname: git.badhouseplants.net
-      service: gitea-http
-      port: 3000
-    - name: gitea-ssh
-      kind: tcp
-      gateway: badhouseplants-ssh
-      hostname: "*"
-      port_match: 22
-      service: gitea-ssh
-      port: 22
-# ------------------------------------------
-# -- Database extension is used to manage
-# --  database with db-operator
-# ------------------------------------------
-ext-database:
-  enabled: true
-  name: gitea-postgres
-  instance: postgres
-# ------------------------------------------
-# -- Kubernetes related values
-# ------------------------------------------
-replicaCount: 1
-clusterDomain: cluster.local
-
-resources:
-  limits:
-    cpu: 300m
-    memory: 512Mi
-  requests:
-    cpu: 50m
-    memory: 128Mi
-
-persistence:
-  enabled: true
-  size: 6Gi
-  accessModes:
-    - ReadWriteOnce
-
-ingress:
-  enabled: false
-# ------------------------------------------
-# -- Main Gitea settings
-# ------------------------------------------
-gitea:
-  metrics:
-    enabled: true
-    serviceMonitor:
-    # -- TODO(@allanger): Enable it once prometheus is configured
-      enabled: false
-  config:
-    database:
-      DB_TYPE: postgres
-      HOST: postgres-postgresql.database-service.svc.cluster.local
-      NAME: gitea-service-gitea-postgres
-      USER: gitea-service-gitea-postgres
-    APP_NAME: Bad Houseplants Gitea
-    ui:
-      meta:
-        AUTHOR: Bad Houseplants
-        DESCRIPTION: ...by allanger
-    repository:
-      DEFAULT_BRANCH: main
-      MAX_CREATION_LIMIT: 0
-      DISABLED_REPO_UNITS: repo.wiki
-    service:
-      DISABLE_REGISTRATION: false
-    server:
-      DOMAIN: git.badhouseplants.net
-      ROOT_URL: https://git.badhouseplants.net
-      LFS_START_SERVER: true
-      LANDING_PAGE: explore
-      START_SSH_SERVER: true
-    admin:
-      DISABLE_REGULAR_ORG_CREATION: true
-    packages:
-      ENABLED: true
-    cron:
-      enabled: true
-    attachment:
-      MAX_SIZE: 100
-    actions:
-      ENABLED: true
-    oauth2_client:
-      REGISTER_EMAIL_CONFIRM: false
-      ENABLE_AUTO_REGISTRATION: true
-    session:
-      PROVIDER: redis
-    cache:
-      ENABLED: true
-      ADAPTER: redis
-    queue:
-      TYPE: redis
-service:
-  ssh:
-    type: ClusterIP
-    port: 22
-    clusterIP:
-# ------------------------------------------
-# -- Disabled dependencies
-# ------------------------------------------
-postgresql-ha:
-  enabled: false
-redis-cluster:
-  enabled: false
--- a/arm-badhouseplants/values/values.iredmail.yaml
+++ b/arm-badhouseplants/values/values.iredmail.yaml
@ -1,4 +0,0 @@
-config:
-  env:
-    HOSTNAME: mail.badhouseplants.net
-    FIRST_MAIL_DOMAIN: badhouseplants.net
--- a/arm-badhouseplants/values/values.istio-ingressgateway.yaml
+++ b/arm-badhouseplants/values/values.istio-ingressgateway.yaml
@ -1,64 +0,0 @@
---
-service:
-  type: LoadBalancer
-  ports:
-    - name: minecraft
-      port: 25565
-      protocol: TCP
-      targetPort: 25565
-    - name: ssh-gitea
-      port: 22
-      protocol: TCP
-      targetPort: 22
-    - name: http2
-      port: 80
-      protocol: TCP
-      targetPort: 80
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: 443
-    - name: tcp
-      port: 1194
-      protocol: TCP
-      targetPort: 1194
-    # -----------
-    # -- Email
-    # -----------
-    - name: smtp
-      port: 25
-      protocol: TCP
-      targetPort: 25
-    - name: smtps
-      port: 465
-      protocol: TCP
-      targetPort: 465
-    - name: smtp-startls
-      port: 587
-      protocol: TCP
-      targetPort: 587
-    - name: imap
-      port: 143
-      protocol: TCP
-      targetPort: 143
-    - name: imaps
-      port: 993
-      protocol: TCP
-      targetPort: 993
-    - name: pop3
-      port: 110
-      protocol: TCP
-      targetPort: 110
-    - name: pop3s
-      port: 995
-      protocol: TCP
-      targetPort: 995
-podAnnotations:
-  proxy.istio.io/config: '{"gatewayTopology" : { "numTrustedProxies": 0, "forwardClientCertDetails": SANITIZE } }'
-resources:
-  requests:
-    cpu: 100m
-    memory: 128Mi
-  limits:
-    cpu: 200m
-    memory: 1024Mi
--- a/arm-badhouseplants/values/values.istiod.yaml
+++ b/arm-badhouseplants/values/values.istiod.yaml
@ -1,14 +0,0 @@
---
-pilot:
-  resources:
-    requests:
-      cpu: 50m
-      memory: 2048Mi
-global:
-  proxy:
-    resources:
-      requests:
-        cpu: 100m
-        memory: 128Mi
-      limits:
-        memory: 128Mi
--- a/arm-badhouseplants/values/values.loki.yaml
+++ b/arm-badhouseplants/values/values.loki.yaml
@ -1,11 +0,0 @@
---
-singleBinary:
-  replicas: 1
-loki:
-  auth_enabled: false
-  commonConfig:
-    replication_factor: 1
-compactor:
-  retention_enabled: true
-limits_config:
-  retention_period: 2d
--- a/arm-badhouseplants/values/values.mailu.yaml
+++ b/arm-badhouseplants/values/values.mailu.yaml
@ -1,181 +0,0 @@
---
-certificate: 
-  enabled: true
-  certificate: 
-    - name: mailu
-      secretName: mailu-certificate
-      issuer:
-        kind: ClusterIssuer
-        name: badhouseplants-issuer
-      dnsNames:
-        - badhouseplants.net
-        - "email.badhouseplants.net"
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: mailu-web
-      kind: http
-      gateway: badhouseplants-net
-      hostname: email.badhouseplants.net
-      service: mailu-front
-      port: 80
-    # - name: mailu-smpt
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # service: mailu-front
-      # hostname: email.badhousplants.net
-      # port_match: 25
-      # port: 25
-    # - name: mailu-smpts
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # port_match: 465
-      # hostname: email.badhousplants.net
-      # service: mailu-front
-      # port: 465
-    # - name: mailu-smpt-startls
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # hostname: email.badhousplants.net
-      # port_match: 587
-      # service: mailu-front
-      # port: 587
-    # - name: mailu-imap
-      # kind: tcp
-      # hostname: email.badhousplants.net
-      # gateway: badhouseplants-mail
-      # port_match: 143
-      # service: mailu-front
-      # port: 143
-    # - name: mailu-imaps
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # hostname: email.badhousplants.net
-      # port_match: 993
-      # service: mailu-front
-      # port: 993
-    # - name: mailu-pop3
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # port_match: 110
-      # hostname: email.badhousplants.net
-      # service: mailu-front
-      # port: 110
-    # - name: mailu-pop3s
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # port_match: 993
-      # hostname: email.badhousplants.net
-      # service: mailu-front
-      # port: 993
-subnet: 10.1.0.0/16
-sessionCookieSecure: true
-hostnames:
-  - post.badhouseplants.net
-domain: badhouseplants.net
-persistence:
-  single_pvc: false
-limits:
-  messageRatelimit:
-    value: "10/day"
-tls:
-  outboundLevel: secure
-ingress:
-  enabled: false
-  tls: false
-  tlsFlavorOverride: mail
-  selfSigned: false
-  existingSecret: mailu-certificate
-admin:
-  resources:
-    requests:
-      memory: 100Mi
-      cpu: 70m
-    limits:
-      memory: 700Mi
-      cpu: 400m
-  persistence:
-    size: 1Gi
-redis:
-  resources:
-    requests:
-      memory: 100Mi
-      cpu: 70m
-    limits:
-      memory: 200Mi
-      cpu: 200m 
-  persistence:
-    size: 1Gi
-postfix:
-  resources:
-    requests:
-      memory: 1024Mi
-      cpu: 200m
-    limits:
-      memory: 1024Mi
-      cpu: 200m 
-  persistence:
-    size: 1Gi
-dovecot:
-  logLevel: DEBUG
-  resources:
-    requests:
-      memory: 100Mi
-      cpu: 70m
-    limits:
-      memory: 400Mi
-      cpu: 300m 
-  persistence:
-    size: 1Gi
-roundcube:
-  resources:
-    requests:
-      memory: 100Mi
-      cpu: 70m
-    limits:
-      memory: 200Mi
-      cpu: 200m 
-  persistence:
-    size: 1Gi
-mysql:
-  enabled: false
-postgresql:
-  enabled: true
-  auth:
-    enablePostgresUser: true
-    username: mailu
-    database: mailu
-  persistence:
-    enabled: false
-    storageClass: ""
-    accessMode: ReadWriteOnce
-    size: 2Gi
-front:
-  logLevel: DEBUG
-  hostPort:
-    enabled: true
-rspamd:
-  resources:
-    requests:
-      memory: 100Mi
-      cpu: 100m
-    limits:
-      memory: 500Mi
-      cpu: 400m
-  startupProbe: 
-    periodSeconds: 30
-    failureThreshold: 900
-    timeoutSeconds: 20
-  livenessProbe: {}
-  readinessProbe: {}
-webmail:
-  persistence:
-    size: 2Gi
-    storageClass: ""
-    accessModes: [ReadWriteOnce]
-    claimNameOverride: ""
-    annotations: {}
--- a/arm-badhouseplants/values/values.minecraft.yaml
+++ b/arm-badhouseplants/values/values.minecraft.yaml
@ -1,115 +0,0 @@
---
-# --------------------------------------------------
-# -- Extensions values
-# --------------------------------------------------
-service-account:
-  enabled: true
-  resources:
-    - name: minecraft-exporter
-      label:
-        app: minecraft-minecraft-metrics
-      endpoints:
-        port: metrics
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: minecraft-tcp
-      gateway: badhouseplants-minecraft
-      kind: tcp
-      port_match: 25565
-      hostname: "*"
-      service: minecraft-minecraft
-      port: 25565
-# --------------------------------------------------
-# -- Main values
-# --------------------------------------------------
-image:
-  tag: java17-graalvm-ce
-  pullPolicy: Always
-resources:
-  requests:
-    memory: 512Mi
-    cpu: 50m
-  limits:
-    memory: 3Gi
-
-lifecycle:
-  postStart:
-    - bash
-    - -c
-    - for i in {1..100}; do mc-health && break || sleep 20; done && mc-send-to-console setpassword 11223345
-readinessProbe:
-  command:
-    - mc-health
-  periodSeconds: 20
-  failureThreshold: 50
-  timeoutSeconds: 10
-livenessProbe:
-  timeoutSeconds: 10
-minecraftServer:
-  eula: "TRUE"
-  onlineMode: false
-  difficulty: hard
-  hardcore: true
-  version: 1.20.1
-  maxWorldSize: 90000
-  type: "PAPER"
-  paperDownloadUrl: https://api.papermc.io/v2/projects/paper/versions/1.20.1/builds/100/downloads/paper-1.20.1-100.jar
-  gameMode: survival
-  pvp: true
-  memory: 2512M
-  extraPorts:
-    - name: metrics
-      containerPort: 9225
-      protocol: TCP
-      service:
-        enabled: true
-        embedded: false
-        labels:
-          exporter: minecraft
-        type: ClusterIP
-        port: 9925
-      ingress:
-        enabled: false
-persistence:
-  dataDir:
-    enabled: true
-    Size: 15Gi
-initContainers:
-  - name: install-prometheus-exporter
-    image: alpine/curl
-    command:
-      - curl
-      - -L
-      - "https://github.com/sladkoff/minecraft-prometheus-exporter/releases/download/v2.5.0/minecraft-prometheus-exporter-2.5.0.jar"
-      - -o
-      - /data/plugins/prometheus-exporter.jar
-    volumeMounts:
-      - name: plugins
-        mountPath: /data/plugins
-        readOnly: false
-  - name: install-password-plugin
-    image: alpine/curl
-    command:
-      - curl
-      - -L
-      - "https://github.com/timbru31/PasswordProtect/releases/download/PasswordProtect-3.1.0/PasswordProtect.jar"
-      - -o
-      - /data/plugins/PasswordProtect.jar
-    volumeMounts:
-      - name: plugins
-        mountPath: /data/plugins
-        readOnly: false
-extraVolumes:
-  - volumeMounts:
-      - name: plugins
-        mountPath: /data/plugins
-        readOnly: false
-    volumes:
-      - name: plugins
-        emptyDir:
-          sizeLimit: 500Mi
--- a/arm-badhouseplants/values/values.minio.yaml
+++ b/arm-badhouseplants/values/values.minio.yaml
@ -1,121 +0,0 @@
---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: minio-http
-      gateway: badhouseplants-net
-      kind: http
-      hostname: minio.badhouseplants.net
-      service: minio-console
-      port: 9001
-    - name: s3-http
-      gateway: badhouseplants-net
-      kind: http
-      hostname: s3.badhouseplants.net
-      service: minio
-      port: 9000
-
-rootUser: 'overlord'
-replicas: 1
-mode: standalone
-environment:
-  MINIO_SERVER_URL: "https://s3.badhouseplants.net:443"
-tls:
-  enabled: false
-  certSecret: ''
-  publicCrt: public.crt
-  privateKey: private.key
-persistence:
-  enabled: true
-  accessMode: ReadWriteOnce
-  size: 10Gi
-service:
-  type: ClusterIP
-  clusterIP: ~
-  port: '9000'
-consoleService:
-  type: ClusterIP
-  clusterIP: ~
-  port: '9001'
-resources:
-  requests:
-    memory: 2Gi
-buckets:
-  - name: badhouseplants-net
-    policy: download
-    purge: false
-    versioning: false
-  - name: badhouseplants-js
-    policy: download
-    purge: false
-    versioning: false
-  - name: badhouseplants-net-main
-    policy: download
-    purge: false
-    versioning: false
-  - name: sharing
-    policy: download
-    purge: false
-    versioning: false
-  - name: allanger-music
-    policy: download
-    purge: false
-    versioning: false
-  - name: badhouseplants-brew
-    policy: download
-    purge: false
-    versioning: false
-metrics:
-  serviceMonitor:
-    enabled: false
-    public: true
-    additionalLabels: {}
-policies:
-  - name: allanger
-    statements:
-      - resources:
-          - 'arn:aws:s3:::*'
-        actions:
-          - "s3:*"
-      - resources: []
-        actions:
-          - "admin:*"
-      - resources: []
-        actions:
-          - "kms:*"
-  - name: badhouseplants:owners
-    statements:
-      - resources:
-          - 'arn:aws:s3:::*'
-        actions:
-          - "s3:*"
-      - resources: []
-        actions:
-          - "admin:*"
-      - resources: []
-        actions:
-          - "kms:*"
-  - name: badhouseplants
-    statements:
-      - resources:
-          - 'arn:aws:s3:::badhouseplants-net'
-        actions:
-          - "s3:*"
-      - resources:
-          - 'arn:aws:s3:::badhouseplants-net/*'
-        actions:
-          - "s3:*"
-  - name: sharing
-    statements:
-      - resources:
-          - 'arn:aws:s3:::sharing'
-        actions:
-          - "s3:*"
-      - resources:
-          - 'arn:aws:s3:::sharing/*'
-        actions:
-          - "s3:*"
--- a/arm-badhouseplants/values/values.mysql.yaml
+++ b/arm-badhouseplants/values/values.mysql.yaml
@ -1,7 +0,0 @@
-primary:
-  persistence:
-    size: 500Mi
-
-auth:
-  createDatabase: false
-  
--- a/arm-badhouseplants/values/values.namespaces.yaml
+++ b/arm-badhouseplants/values/values.namespaces.yaml
@ -1,11 +0,0 @@
---
-ns:
-  - name: monitoring-system
-templates:
-  - |
-    {{ range .Values.ns }}
-    apiVersion: v1
-    kind: Namespace
-    metadata:
-      name: {{ .name }}
-    {{ end }}
--- a/arm-badhouseplants/values/values.nrodionov.yaml
+++ b/arm-badhouseplants/values/values.nrodionov.yaml
@ -1,58 +0,0 @@
---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: nrodionov-http
-      gateway: nrodionov-info
-      kind: http
-      hostname: dev.nrodionov.info
-      service: nrodionov-wordpress
-      port: 8080
-
-ext-database:
-  enabled: true
-  name: nrodionov-mysql
-  instance: mysql
-
-wordpressBlogName: Николай Николаевич Родионов
-wordpressUsername: admin
-wordpressFirstName: Nikolai
-wordpressLastName: Rodionov
-wordpressTablePrefix: wp_
-wordpressScheme: http
-existingWordPressConfigurationSecret: ""
-resources:
-  requests:
-    memory: 300Mi
-    cpu: 10m
-service:
-  type: ClusterIP
-  ports: 
-    http: 8080
-    https: 8443
-
-persistence:
-  enabled: true
-  storageClass: ""
-  accessModes:
-    - ReadWriteOnce
-  accessMode: ReadWriteOnce
-  size: 2Gi
-  dataSource: {}
-  existingClaim: ""
-  selector: {}
-
-mariadb:
-  enabled: true
-  primary:
-    persistence:
-      enabled: true
-      storageClass: ""
-      accessModes:
-        - ReadWriteOnce
-      size: 3Gi
-  
--- a/arm-badhouseplants/values/values.openvpn.yaml
+++ b/arm-badhouseplants/values/values.openvpn.yaml
@ -1,24 +0,0 @@
---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: openvpn-tcp
-      gateway: badhouseplants-vpn
-      kind: tcp
-      port_match: 1194
-      hostname: "*"
-      service: openvpn
-      port: 1194
-
-storageClassName: longhorn
-openvpn:
-  server: "tcp://195.201.250.50:1194"
-service:
-  type: ClusterIP
-  port: 1194
-  targetPort: 1194
-  protocol: TCP
--- a/arm-badhouseplants/values/values.prometheus.yaml
+++ b/arm-badhouseplants/values/values.prometheus.yaml
@ -1,146 +0,0 @@
---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: grafana-https
-      gateway: badhouseplants-net
-      kind: http
-      hostname: "grafana.badhouseplants.net"
-      service: prometheus-grafana
-      port: 80
-
-coreDns:
-  enabled: false
-kubeEtcd:
-  enabled: false
-kubelet:
-  enabled: false
-kubeApiServer:
-  enabled: false
-
-prometheus-node-exporter:
-  prometheus:
-    monitor:
-      enabled: true
-      jobLabel: jobLabel
-      interval: 60s
-
-defaultRules:
-  create: true
-  rules:
-    alertmanager: true
-    etcd: false
-    configReloaders: false
-    general: true
-    k8s: true
-    kubeApiserverAvailability: false
-    kubeApiserverBurnrate: false
-    kubeApiserverHistogram: false
-    kubeApiserverSlos: false
-    kubeControllerManager: false
-    kubelet: false
-    kubeProxy: false
-    kubePrometheusGeneral: false
-    kubePrometheusNodeRecording: false
-    kubernetesApps: true
-    kubernetesResources: true
-    kubernetesStorage: true
-    kubernetesSystem: true
-    kubeSchedulerAlerting: false
-    kubeSchedulerRecording: true
-    kubeStateMetrics: true
-    network: false
-    node: true
-    nodeExporterAlerting: true
-    nodeExporterRecording: true
-    prometheus: true
-    prometheusOperator: true
-    windows: false
-
-prometheus:
-  prometheusSpec:
-    enableAdminAPI: true
-    retentionSize: 10GB
-    podMonitorNamespaceSelector:
-      any: true
-    podMonitorSelector: {}
-    podMonitorSelectorNilUsesHelmValues: false
-    ruleNamespaceSelector:
-      any: true
-    ruleSelector: {}
-    ruleSelectorNilUsesHelmValues: false
-    serviceMonitorNamespaceSelector:
-      any: true
-    serviceMonitorSelector: {}
-    serviceMonitorSelectorNilUsesHelmValues: false
-    storageSpec:
-      volumeClaimTemplate:
-        spec:
-          accessModes: ["ReadWriteOnce"]
-          resources:
-            requests:
-              storage: 10Gi
-
-grafana:
-  persistence:
-    enabled: true
-    size: 2Gi
-  grafana.ini:
-    server:
-      root_url: https://grafana.badhouseplants.net
-    auth.generic_oauth:
-      name: Gitea
-      icon: signin
-      enabled: true
-      allow_sign_up: true
-      auto_login: false
-      client_id: 0ce70a7d-f267-44cc-9686-71048277e51d
-      scopes: openid profile email groups
-      empty_scopes: false
-      auth_url: https://git.badhouseplants.net/login/oauth/authorize
-      token_url: https://git.badhouseplants.net/login/oauth/access_token
-      api_url: https://git.badhouseplants.net/login/oauth/userinfo
-      tls_skip_verify_insecure: false
-      use_pkce: true
-      role_attribute_path: contains(groups, 'badhouseplants:owners') && 'Admin' || 'Viewer'
-  
-  dashboardProviders:
-    dashboardproviders.yaml:
-      apiVersion: 1
-      providers:
-        - name: 'default'
-          orgId: 1
-          folder: ''
-          type: file
-          disableDeletion: true
-          editable: false
-          options:
-            path: /var/lib/grafana/dashboards/default
-  
-  dashboards:
-    default:
-      gitea-dashboard:
-        gnetId: 13192
-        revision: 1
-        datasource: Prometheus
-      argo-dashboard:
-        gnetId: 14584
-        revision: 1
-        datasource: Prometheus
-  
-  datasources:
-    loki.yaml:
-      apiVersion: 1
-      datasources:
-      - name: Loki
-        type: loki
-        access: proxy
-        uid: loki
-        editable: false
-        url: http://loki.monitoring-system:3100/
-        jsonData:
-          maxLines: 1000
--- a/arm-badhouseplants/values/values.promtail.yaml
+++ b/arm-badhouseplants/values/values.promtail.yaml
@ -1,5 +0,0 @@
---
-config:
-  clients:
-    #    - url: http://loki.monitoring-system:3100
-    - url: http://loki-gateway/loki/api/v1/push
--- a/arm-badhouseplants/values/values.redis.yaml
+++ b/arm-badhouseplants/values/values.redis.yaml
@ -1,7 +0,0 @@
-metrics:
-  enabled: false
-
-architecture: standalone
-master:
-  persistence:
-    enabled: false
--- a/badhouseplants/helmfile.yaml
+++ b/badhouseplants/helmfile.yaml
@ -2,15 +2,21 @@
 {{ readFile "../releases.yaml" }}

 releases:
-  - <<: *drone
+  - <<: *namespaces
+    installed: true
+  - <<: *roles
+    installed: true
+  - <<: *coredns
+    installed: true
+  - <<: *cilium
    installed: true
-    namespace: drone-service
-    createNamespace: false
  
-  - <<: *longhorn
+  - <<: *local-path-provisioner
+
+  - <<: *zot
    installed: true
-    namespace: longhorn-system
-    createNamespace: false
+  - <<: *keel
+  - <<: *traefik

  - <<: *argocd
    installed: true
@ -22,11 +28,6 @@ releases:
    namespace: nrodionov-application
    createNamespace: false

-  - <<: *minecraft
-    installed: true
-    namespace: minecraft-application
-    createNamespace: false
-
  - <<: *gitea
    installed: true
    namespace: gitea-service
@ -37,23 +38,8 @@ releases:
    namespace: funkwhale-application
    createNamespace: false

-  - <<: *prometheus
-    installed: true
-    namespace: monitoring-system
-    createNamespace: true
-
-  - <<: *loki
-    installed: false
-    namespace: monitoring-system
-    createNamespace: false
-
-  - <<: *promtail
-    installed: false
-    namespace: monitoring-system
-    createNamespace: false
-
  - <<: *bitwarden
-    installed: true
+    installed: false
    namespace: bitwarden-application
    createNamespace: true

@ -62,7 +48,7 @@ releases:
    namespace: database-service
    createNamespace: true

-  - <<: *postgres
+  - <<: *postgres16
    installed: true
    namespace: database-service
    createNamespace: true
@ -78,14 +64,46 @@ releases:
    createNamespace: true

  - <<: *mysql
-    installed: true
+    installed: false
    namespace: database-service
    createNamespace: true

+  - <<: *woodpecker-ci
+    installed: true
+    namespace: woodpecker-ci
+    createNamespace: true
+
+  - <<: *vaultwarden
+    createNamespace: true
+    installed: true
+    namespace: vaultwarden-application
+  
+  - <<: *vaultwardentest
+    createNamespace: false
+    installed: true
+    namespace: applications
+
+  - <<: *openvpn-xor
+    installed: true
+    namespace: openvpn-service
+    createNamespace: false
+
+  - <<: *docker-mailserver
+    installed: true
+    namespace: applications
+    createNamespace: true
+
+  - <<: *mailu
+    installed: false
+    namespace: mailu-application
+    createNamespace: false
+
+  - <<: *longhorn
+    installed: true
+    namespace: longhorn-system
+    createNamespace: false

 bases:
  - ../environments.yaml
  - ../repositories.yaml

-    #helmfiles:
-    #  - namespaces.yaml
--- a/badhouseplants/values/secrets.argocd.yaml
+++ b/badhouseplants/values/secrets.argocd.yaml
@ -1,10 +1,9 @@
-server:
-    config:
-        dex.config: ENC[AES256_GCM,data:SExaFuvPjiyYUiqBivswX4dpPM+x/6OsmyC9FFpiX1TCDIsYNFakzW5ZwFk1XnS8OYzqksyoxAGGU2fmoTVpHXviDqSZ76g0AREH3OwtSlz2R8RwFU/zzgXeqoxw2rC2ij0t0Vg39BeltArIFBcrtTfDy7AjMqf/Qx29EAb9nnoTA/SPj33VzHbn+tJIHb/a2XExj6VAyVJoq+fqsdKmmbI0tb636V+Cq/+wj6WwGjhu/0PDtaMN9AWokMGgICLUbdtfocinvZ1gyv8+QDnczYonD+wFZdlaKDembGN3p0BggBCLOY1I9f3PHG9Yy5xpNtAGFjDYF3NLz1n1QjDwRo1La6EHmmd2pL3INtU++IGRkC64bzCKR7i429/il13MKvccBOBWiJpkf5L65Rluyb1WWNYBcI/SscfQo1CSL6zXuZtrxeWrRcySs9TjSAtwHrpuRm6hfwi1tUcUUEhu6c9uUYMhSoNug8/2vQjQiJcEdh9n+YCoUbPraAC/OSctrnmO/vsXY9CcXCWWR606Wwvr0RIX+wg4/5vCyecj+5nvhfaZvECXoCmKT8xtmVw6h2oYbAU4T7o9J93XNMVyhui4DM1JN4GYlTsfbpU1PBetUII+RO23rJDSRQdEq16Kk9RcNEUaJYcS4uH7AXvbJVeC6Cx2OwN7zSmOSbA9D2kYt7IVcnBQRGJ+cH6fy34KTwJ0def6Ze243LlHdA==,iv:c8cJLybNsyuAw/BFmKtNTBzXIl0vmeSuKW8j/aw8STw=,tag:URax9og6ZQRvWPtKVel4SQ==,type:str]
 configs:
+    cm:
+        dex.config: ENC[AES256_GCM,data:/5fVXmrlrI+A9VkyXXXEyout6crDfLKvEHRgSak3tZn90aVm/SrSsq/mJHO4k79zVPz/BBF8/RIt2rD1TJsBNWsTFfKJuCkSN7kjUIE1Blch9ju2MOOmtWR8NIi98k/t5D/kfF6JhAw3hTv6nOkaz6P9eJgAEawdNeaNZS2i/6s5UdJkTpZWCOD+3DJezYhWS9dePrWldRGzYNVc25wAbDF6jRrtXbF2aC/z/cuhcCEEgsncFAYz1lN8sKpdMXIZzBqvugYGUZHPkWAi8fsLRM818jA736NoT55d7yO2hR0RzbIEbr0Edbk9eeofAty5WEPBhop9OUJJFKeRq2AXgdY6Y98BH1Yn1X1PmkpV4Tu+S49q3jRC4g2dIttywA3waqdGSsXVI5q9sVSJTCN5gsHXM298K1hb0hCgIv4WAv/09BvOOxocTbz06c1zB/ZFxhJJ1Fv3wSPFiY011y8StMgEvBmh84ERK703Sn8jFrT31eujpF6saM8fER/1W7acOrGZTTCirXcm2Cp4QPS6LILeANcD6S6gFvITKxCa/Dzkk4OV3uB2KqpTX13IrbnMm+oYGM573QAJzuRBfGtFBggX6GHM1jGnPZ/s2n+BRrhKhZRofVommLMSl2mTyWRsLwJ8XzXIDZlQT8MrkCZX8EorQmUS3NPM5oTgxpq4dtGbwVmKh2i2ZcmwGK7AwB5OtLXeyLe/MbOikQKCig==,iv:xuTDUZWDWtzZwTOvfzGRNsqpPx+rxtTVs1C0gOjB+Pw=,tag:CLGA9kgSoWBFCJRW/s3MAg==,type:str]
    credentialTemplates:
        ssh-creds:
-            sshPrivateKey: ENC[AES256_GCM,data:qQZuWVqu3G59OLMTtYW3BDfoo/3+SvLgQYzv0Aa2NQGb/5wVFejPiJR0BAMYZjkDSVgUZl/oVCT55I41QeKcNYfHtGcrWIFvizg5jW+K0U3ZvgtnY56J1GsrKWQIC29U5EHz/7xXTnSJkkiiVEBGOjwQHpfCgsqR5/qhwnFx+idLsdJGasMYjIJZttTtLpPsY1tgUwTzqJGQptJHqG+/EDcmI9ms6383ltgc6xsmezJDyoG3A2cMNp22qctIuqTIM6ltL9iosBmMsPM1MaiZyJ7rG5zNPymTCFDQUXwlUwFoDKJnN3GkY4ApzRv43iAw2aIX8ykifZVGZOuvV/ifzUuDoemsGjD7X3GN+ngVNwdLm1qSkcnb21Q22kVmBxotIQaF9eN/LqDk2ULEMX3Yvml886yo4AnxlIA8zW8XzFfEILrEswv555P5p3Mswl0+KAIDo7cYav495U9cYrttHbU5wvr9br5JekNKVSgTigwFraq2ZUE8Za3Ru7VOuljywRwe0VEvhFv8SJoH9NZJyl8ME0+uH1R6YtIodkHpB6b6wtyCwtPXjkUkR8nzi4VU0L3zq90e/DvmX/a/q4uEHtLPiIEMFbKtUQ8v8mmscYEEvYIsIBO0VcY2CUFbEs7r56uFOiysqB4d4ySGFjdQceRTLhG7/kUjjYtGEByVcFXllhAV+1C0vXHgOXc4G+EowObbcyj+sA4hxFVL8/f0s7znVCQbZhztQsxfFr5+76X+nzkXkkhauUsMChybmVmGTU+hYnZ8XuOK6X+tRixoVNlcitFD+NxTksvDeJDIShaQvH2cjLLbkze9GmUVr3EvifQhXdw29rpgySVE0Tjn+YL23Ft8dToqR6QwTASLi/vcvbjpx5NtchuR5QFxwZYY8ROTljSQS61AMdszr5cR0BwtFY8j59Aj25sEJeasi44xzUlBxAGazHjzBDxDU7XIpGV/IkiMtaEuEXKGRpVqhQrszvuXOf9K4TwxuVvhlrSVvU7M/lQzJUzkSFOSvO9nzfnkVLwqTdTX56ODFs10vRowClKetC6PpuAclw85WlC1OTkkAL8RUCWyoPQUU+EYolUCW5nMp4P8X1XK3qvRpBU6BdjnnuLQAi1bYu8t0f4vTYoLvYTwlMGXizMHEks6me5pPD7mq5HvpR2e7i1ZzJ3oQaKPB9n8AsugFeRStAal7HHrfEA6NVXLlBYdiq9oRgwllZwi5dsw4m6ABhh+angCWkIsjB9+n9NKOdJowvyDDx1JE/Ai4wb+8hbTLtAold6YJgNA5aT7LeSVaxWVB+V8w1ghn3UJzI6SGdayJqUH+VAUDvBg4LeqGH2vrod57SF4FMmqGTQwN7cYxW0fDT9V8xnb2nQu7WaE04Miw5hlsB4uTRUfeMrXXvt3R2N8azqQDF9Himtl48U3by9vv8FPsNhq3XvAPY5/TCzHz93bnWWmdtyZlHTFz2wRAwaTwOfFpN7oMW6YyVo6UUpw10zap0Jfboq8szF////nwEHf8qGw3dxT85WwBR9KBPwFuHZQsoUOuy00PuAB5fVvXXWBiCnzYwWgY3NqTBkLYbV8D/6UnLlfAHhnEok7QXf7P4xqbB/6EmqCmGBw5ZgPqg0bY6mOTnMrfqiKV9+Q0Mhe8eFPNOr2zoR+VYRDnWX+rJu1+OAK8QegH1Jn3RlOg3lXoFDFLelq6GEq1Kdbr83goL59/uRu4VNvAArUJ9tk4Vn2vWEtnbpjRcyjwAHIc1YXphY53cPFdSjYCeoNv5MDEt3oJAKWhSX7Ql6ledftGWB4fhns0OK4+zLN6osqrPNtLyS7iqXhcwmUIx+b6jzblKt/FAssFOw6VVpi+nVrBWHDW4lhHiCu37VYS15Vtjw+JCPbAe30MOquhXn1CnEnoV8mDoDGTeMpvpP4BTTgsLmloXfv8/+TjNYfzSWivvXjY1K0P/KGqoEJfIyYDyuxi7t2qJ/CwdvBTJkF/cTX6yvX6IvijKuUco2aIgpoZfg4JR6VL7Gk3Cvf3YBvnvG8TspBOfO3ZhwTS6vfQeDLs6kf+gBtXduJTqAXuy8X8B4RZxsNGZZD8hsSVH6xP5akN6waGqG+xDQxKTT7FCpmi0igvvANRROF3+KxGigPTrIqa33WDglrD6tUfUKNUW/SuZXXjbrgo0lillsXj6i7esSLfgH9CjUfeVUW/mI7mvW+0xjV/eeZtxRnz3ADGgfObV0XakEFBDhDnXtmdN7RN+Q+UvtN0uYGYWYqnIPNewm5RYwVGtGNWOB42PdaKH0qRUdWvCAbsKflPxW5pJNZlejhoMm+3+j2UlrY59dGqTVPoXkWgIGxFkubrtN06zAhVEV6/PcCZoGJmZsPWIfiY5k/BZljtZLAa1e2cboD/0q8iX0VzyRSmuKzVYMa6/NTU3PQ8l2x5fQRRq5OR33P2N36Wb6cO7GB9mEKAElTnd8oLlJ3T27EBctdNf8gOBIYWtGo+lYtKeh/NJm5o7KGIdjhThi7Lrbyqaxb294yxydmrJBh64dws+f3IhUQBLz+6lk5PM7EtrBCGuN7PqdqQMHqWMcCvDCHxY5X/U4zrWMAClEifJfC0b+3HthLkBHb388nGMo2ymHq683s0PxmmY0lfpncUEGHu+1J5E3w2BEy5Qv83x0RQDoDFab5lxILo6VSmZru+Kj18yeqNiNw/CzHaMvID7Gio1jaq3DsuD4bA9ne5Je5yAK8INrYRDCSzMfQpc2QqE306tonmsu37EKGHTCOaaqfL8/f31nqZcdKAdidM4JBa+osYYVUCp50Nn8h94dczpjvC+M2hEQXbibUSwyPjDv7ptwfZSEPG1mjbrOEpRSbzh3lGbE5q9K7bNyt0aJRi2gOw/shU5rPxmJ5KoL0HUEc74pZRG+Csa3ZKruqYqOEezgZmVwo0E3NQD8u/y/oF/L8hgKj2jcRmJS/pKbr2Tv+Sde1ZYdZjsXW6tFRjPDZGyhjHBriPLikN097kmuPFWS3f4ZFPyHM/Az2uzPPBFGv7VchUbFScIDgBIq+fYnTPtjjST7FgsDxpzTkj8uliU9z7r0dTIawC8qSUYErsFYSvUITySWTam0R04yitaArcH5fLEhEeKKMjGUVkwwxGxfv9Fql6Zs1YSCKka9aynXDUmw6igbRJVIPtmEosrmFUzlX1OEiJrX5xWOVAv3wQ2vrxvwHlmOMtr/cQagvASds2kC4QJ4qSwc8YdpLAwrn4+h7uNP/QChAOVCiGQXpFqd5ab/LBc6Gc/1Zxilil1kecMFBc/XmVssw72XSVoXVJPlIyiSYOAtm1BGQHJXRspP06/M+/5ffaHoEevqB47kf6bE8c3F9SwksgwGtaqXdFBoKSQcret8Tww9C8ZwDji8v/woVu2COXWaF2HLg3r3vrXa+DVVz1ENtOmJEJYTCuLmdqpZsWv4olC2wcCUEA+po9kZbVcEAfKd0xe/0x2fzqQ==,iv:lDEAwKxgoRPH5AtF2kYxPQjHkw3/kbbpoz3jlUsEpTI=,tag:6dbL9WZoTZ2xSrSVE4Dlhg==,type:str]
+            sshPrivateKey: ENC[AES256_GCM,data:43Enu05W+Cxbg1z8GjoYMWNOkCSuUIny4c9YOJlp6HBwazFx8IbMLibSxcI4kWCaceKHj+jxHhj5hnnDJgXWElFHmsApxNX/GtXtaiIHF2I3f4o+WjLJMco1lkdrtLhb2ERis7PtzI+1aQsTDtwJG6xPDpxYT+apokx2XnwkFzjAetfi5zHMyepgQRXFjyGvn4HECLeC1uii4+/FmImI4gzTFIGAoeb6xT4HDsWV/kzrWNJk/FsnmQyCkiEHQ8wU1z1WTPr6cuTLf7WUrliPaOAwmGwxfchU+vIfIBsbfHoBVHeJR8/j9fB5Em10Z5Ton91CXObGVpEBJD4MHgUIEVmAunqK+ltAit/CNmQI5AwSofcfAV+hI2o8v6N4Wlq6PteNKeeBvdSCYEt9DR7uw+TNgTgxNhAzjZuXnfZzVpmsqtsy0LMBtdwruA7j0roBoqODU9+YbJc9rpx+MTwlaPrkBBRA2+ZZ2Z2Tl2NV8RJbxK6fwDha+E7KPqJnBwqK6xsROvEV2wzW/ZXGDWXuOM7sqCK0Zc+vi/X/1kgTTVt5BlnjLpk+tiZSIwMFLAQctMkEFpVQAWFqpVnlJenHmwh4NaHgEIEsiIMsR4Uh+7tmEwli+DVhauwOwJpMc4MJsZgquTyATd/1hJdLW0XJKNYGDd/Ia9dUvtuZR0vZks1J85XVwp/qR8QlJd0nMhFgzNV7cJnf2WE6nj3c8ibPjhelFPFd+dw0inoLsnwBGvNpxZTeu2UBInnyAW7MefVs29gSnWaSFi2dvT4Lw4X+yGdGP3SAydkTOfMcV7hbtv+IRfeyFTV6v0ebilufuvVy56HlZQl5H6y9kZEg3m8qxJ2gJB7MFVfqAku8lNDAgMyvdx2sDivbWvOOsPAC5N8NFHVn5XKlASrZs4N6o5Uo85ewO2GSLn+UKxLWvhqKwIB7oYubfVyV+m9SwqiZLBy6xt0FOKr4cg5pLDFhNer2vQfwRB/2meV3jZt3TXE5anlnxgEKIfrjhjJTXpOIaUPn3z/jbYk5RHTrFrAIib6u2r+HpTkxdnIE+jdgyl/bmhzI7cqDfR/VDdfbl78sAKNQjAhzG10eNWnRgrvNU5KuPOpvxaNUyv55L9MyrO95LdmrmV3SG2Y8J08sCx2kmGg0gJwWmQJpvWTPaa8HQ8oTUw/+b8c6z1DzesozjVVTdd2m51cprYQtSY+izJfjzYXfTs9q2ibzDaan1GWRx7cFYye5ks0DWG4Qn+dFIiVUez+mnSPIJ3CTWcXwnMfLALM4p1Ki2/BUyRz84ryJLJ4L+FhDJJFBpyi+SzdNOIpCEqOQgztxdX5FFEZ6dKwsQtj+8AA+eOlQIb1fu9lr+6g4+TgJzyYSxxgmCD/bTU+gGXq7r6pX8NIIZl3zcVNtvEg/mObzRq3U9JtljKDHjQVKlLm5KqoVeLybgCK0kr0DsqriD92UnhOHYY9Xt6l670h/kfH9tygSHogiWHZFJ3E90YeXnRAgzyELqdz9wrGri7y///Vm4vAh7O2wqVq7XW4w/27HStCFEOmPA6i/84VIRJPsbTNUxYi1SKVQzHe0r8gBAr3kcrLMRTzs/myH7utZxFmygR4NcI9q1X1Hz91Hi2mfHRAuhqnFWHjA/clMXy2eFTUkAUlG36z1+VhsPQVo+n1vkPXtbtW8FofL8LJZwtwuOHfnHI4W8431S4KtOcLFNLha6otzwD63KZ40x07ljwFW2/4txlb98jVE3myXK7n93mTL6iY17cTBir4gRdAACDlmelIyqQB2KcL8sJht9B0XXeWqMxkt6HQlJQaHjefv5QtP3tXKCSQUmdPf2dLLXfQnhhpZxEU6krZJLPCpM4Fj9hi+1dCmIwSW8iGSxMD9+KtyCenP3L243P0NzWPEpM4CvL4c8sgZYVzZ5xAxbGjL87ScTWhrBvpSv5a0OLtH9K1BFgISwXbZyn2dBSLdhaJYE2963KJE+yvbSuZPGzdOSGShQPX+h5FEEJrhZKyxI5b/EjbczZ/Rhu8YTrYdBNFX6XZkXvlF35uXfxmALihu7IBZCOZh8qepdxzYbXbrwLI22bG76Fib1zofhYuLTUqEHABy++NMGCZwLGsCzM6KQAEhlzy3uhQywpMuNUMfp9gaxsSb/RooYGEfqr7Ss7Qg6Nbzue9ayiO4sGl80m2kbQi2A+QdXsrplWeUVouNsdeIWs8J7uU+KSwQXdtuZHHVeo8v7YJddLHJDXdzKMEpukj1Nq342ZPSPpp8ENDh3XUP/SQgOWyAM7J08mhtlblmAOvKFe99SEnXqHLfRtgZgeZvlcfZF5mzz4Cq96mh8LU0V8C3T+31fWJpMJFo1eNHEbYxp/K6UkCDGsba4ahGAD8Txb/J5SPMWUKI8GRDo8ZOgvvDd0f/NvfnjngSWAVq/Kff2kMAMN9JtpEGUhxrRFZu+7qanmHrB4/3c3h+vh/+mQlURTIDmKOGFZPXmlOaW8KfL8/6dzSxAyYjOHPCuMb1JjyNqte1fzZ7Dih0LBtbTJYoMc52HM7nJ/ENHirwditTj3PTWJbRh/vVEQisbKtLkzb2vZPkTW3EXo1Z73KWZ/RqcU1S1Xj9egNLNZQegcJ98/9qXtmOAyhpwCyP+5Xscu6xVeIIso2f4G3JPJCelHCoeTyFo+8r/8k2FHiOhcmhPYPC6mlQQNKcV0441jrnjaJ7L9E1Kxt/iVK4B+/k4HVwv2J7yjQ5dU/KBY3V/vMhjQc3AGq6S6T7WoycYNY51AYYGHk6Hf2yl3md/qFE14hzX0Zt2sjmpQDJSG8CAOnay5XxDOrLEQwqmCaZPGGAK4FaXDERAgRsxp8vMy9KUQDVHwT1Tqf3rwGn74nNXo9IqQgcc5NV88FvRjLv1bm/6kBeaD9udfZBw7YqsRkY3mRoG/aJw8DkOdmYNIrJm69rmHreQo1KssVe/mz3Om0auwpBXR5D2OzZ/9e9XCprnUEN59cOfaha6qMm7pvDyJocaYvbSWPpchZb8DorWGEC7Iq2Qa45NaaKIpMrAOLPhiRqtNLP3L5Hzq23kvNOxY1r8Pxk6VPH6DqUBYrwq0vkYgABnquE1TZPL7ZqMMsfiAsK+iAxyFSbH44Yuby7VvD86rs0YaKYIgBTPMjfo7GNP5Dx8YPKUruQDnfaJYCw8klnmAtdioPWeEzRDmSYN+wOtz5fBFzPCXOVfit5BA8fIgpMrjdo/8a5TD7yf1HI9i3Nb8K8l1rAJ1SCsLF2Nu024rrcib8mxXBdXBdqxekGtN8+D2KLyq0FsR395o+Hy1uQg4UwL/tH5s7CiFoyQcngZxS4zqOjLQeTUbsLCx2y5SG144Ls/bQloLps0mvoz7+hyv7+UmKbkNbiJKOeIUjGMKRcfBDSog0v+V75yWjlsrRWmaVlQCwp0bkpCNu684qOv1T1WnpoYNctJzgxzggEYWuk/5YgqG/ao4Td7pJTkAD21A==,iv:x5mss0VoYp8qlgEdSa7973AClSdCin14GuAt3duWqjk=,tag:jz4tVj4Ot2ZwedETSRcVLA==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -14,14 +13,14 @@ sops:
        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxTWUxY2hYT0dId2hsR0x1
-            MXFtRjlSelgwdUcyVnBUdlJ6Nng1UkNJaHg4Ckc5NXBORjBCZHQyc0lDTiswazNF
-            cGhKVFFNdlZnRWlxS05OTklOUDJDQjQKLS0tIDNWNDVVWXcxUW8yUHgrOTNkRkQ1
-            MGNDV2cvUUF3dWZHSlZNeVFDNXhzalkKubKuiiZuqoZTvRMr2FiUxnFUu+Pvj3Wf
-            pZTfZg9rnUukmV+kmwqQKcfoPNfeShhoAsszWwPM628cV9pq87I2/A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoUm5MVFA1THRlNHlQdkpw
+            MGtVZjhiTTNCUzcwV3lCQ0NqeTZHUWxrc21BCnRVbklPZE84U1FhNFIzeHowWUh0
+            V01aeWhDcno1d1Bta01rdWtvaGRQaUkKLS0tIGhiZEZoMWt6WDlGeHpNdWZyVlI3
+            THJzYlU2NUJ1R1I0TEtpQUdOM0VvQ3MKQmjL1jaJfXGi6FeFb34/l4FhOEAV05Q4
+            DeHvke3nKOP/R0BJxwqvLi2hAyI2LEMSEaXs7iWnDDFOPUA1DiBcuA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-04T16:16:37Z"
-    mac: ENC[AES256_GCM,data:4HhqNV9EIcBA/nzxuiS21TWe6BQ+anfEQOnfrYcZ2vVD2dTPzc0ztZ1Ihc2WX6sMCVFDpUJFEcr38Aj2tXnnS80kTsnznBsSFNLj2b857PWXNeoAuwiiY3XBq+Ndo7I5wCYgWyuaH8xWQtd5JVuZPpqdtjTkbWq3lj8aARJUuQw=,iv:Hlu6iaBBQovSaXYAEB7nWBL9OM1UXYxQ444s5ZrMtuo=,tag:N/znbxYVwFoJ1eYAS8PE4A==,type:str]
+    lastmodified: "2024-02-22T23:43:36Z"
+    mac: ENC[AES256_GCM,data:szfQ+rXGzIaqcLKnGO/H1poFQu6/qxtUJejY9lCQre/YUg+d5WAgPdrxlwmsUsLaUz8tgMGiAd+J8NmR/P+tahz5/wwuHOYadPWzof/okC77vuyVLjuEE2t2RQ5U40kUJJKR/3TPawyttiaTDpxu6VJj2KcIlHfxsW5ddzAtFdU=,iv:fX2yQtrap9XKxjiPMfriH+QHZM8tGrTDgtHhCWh4NZQ=,tag:7FWAPf7K8rvyEURVFkrz8A==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
--- a/badhouseplants/values/secrets.bitwarden.yaml
+++ b/badhouseplants/values/secrets.bitwarden.yaml
@ -1,5 +1,7 @@
 env:
    ADMIN_TOKEN: ENC[AES256_GCM,data:ea2lgOEYMi8Dsvun00YZR3PCE3ycNC4Mpe+xye9YL5CTtnyrDwV9Tw==,iv:28Tcn1/qIquS4jCNBTtspB9c+5U3Ut1zoY6gIez8fcs=,tag:POmhoUY3t4w+iTJKK2eHVQ==,type:str]
+smtp:
+    password: ENC[AES256_GCM,data:cs+2Ml3YfZCk8z/KmexGMqzFQRM=,iv:mg8e3oHbLT07pZEdDGwlBchPyT83xOdwKJg9CCaicnc=,tag:NPD+8gKERO8uCuwrFnn3bQ==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -15,8 +17,8 @@ sops:
            dzNYMlRnUDIxK2padTRCSzR4UUpWQjQKxex3RqZGU7ekdNC3qIiqdFs7d7a0Pxa1
            amLsaNnBfJ3OqjuD8atF2iCAXy1Q2BcXunkWi3wbzHb/DgYly3n9OQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-16T18:40:43Z"
-    mac: ENC[AES256_GCM,data:tbPAgDQGA8MPnG5mIZLfvsOKdSkpOTK1Oy7uIQJ3DsNtBIt9vSO+vYxNjvfjAHyB6vE1cfx8zJkRcUw8kPh485jOxsM9G1ms/sjZKyJwsJbMjiqxs5zs0E4X9sqpJWiIhILBreZ8IopK4hCd2uLvhoV/HPxW8FV/HnHoCQ5p2Do=,iv:FtgTWFdkxCPOsNiJQWWIUmwYgh5rqRcbM/ToShcSODY=,tag:yc54xWHdq4KnSNxT9breOQ==,type:str]
+    lastmodified: "2023-10-15T12:20:48Z"
+    mac: ENC[AES256_GCM,data:2yRwdYM32eESPuUz+d7m7pTcluDUeOrLgv7iJmhPEnowcU9WvypAZr73w4y4ewc3yvLmmu5uuFjJJhN1+yjwULGUtU1NPdcvXHsGwtlA7KDyYUqwIc4NrD6BAeR7tRQChNVD++2wB43kiGAWAMmieOMt+xHcaWlM2btuLoiwE34=,iv:ZMxA5eu0IJKTRBtoKhyIJiDe/W3zVjzlz3TbO7gpRnU=,tag:ErYqzleh87+wj0uBRah20g==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
--- a/badhouseplants/values/secrets.chartmuseum.yaml
+++ b/badhouseplants/values/secrets.chartmuseum.yaml
@ -0,0 +1,24 @@
+env:
+    secret:
+        BASIC_AUTH_USER: ENC[AES256_GCM,data:i+3uBSJ1yrA=,iv:bhB9fIPxR2y9sS4jfbuhAIyzMHgoIRLFGXzQJ4763Cg=,tag:7pv9IOcBXhaeRu3qChQP8A==,type:str]
+        BASIC_AUTH_PASS: ENC[AES256_GCM,data:zSb7cw==,iv:CL6ywqsc2hpTnBl7ndD0s49JNEmMNnu3X0gke4KT3qw=,tag:tSVaRdIZpkzsqp6n1RUB9A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBc2RwQk9OTS9GV0NOb2x2
+            OE1YVEsveU1VMTArZEJ3a2tETis1N1FTTndJCm96bWtYMDdRNnVTZEk2b0JPQWFl
+            a1BTcWVyUWZKOEJSWDZEcWZydEc2b00KLS0tIEpWdTZGWUdCUHczWEZoR0dSTlRY
+            TlNpbDVHa1VDUk9wODJLaHZJT2JoWmsKUD7yk2jpDVHvP5B4soK7k834RI+ydHxg
+            H9/8nzPNwNbpq5ysHmYFChpfiOHrSKirVINUP7MmLGdPZ24FSHI4+g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-03-27T08:47:35Z"
+    mac: ENC[AES256_GCM,data:w72acY/GygiBVO/3/OQU1WJ90R+mbuCcGid9KzCAPOtdhBBbY5zZUtkZvkZkaugoiI+bpywoXQI/5JbY4+23D4MN2XHHG69DIkpR0eygeTHWc/id+LhfxIGHqvYzULshQuyVtPezoExWVwC3c3ZJYpkzRJhgOjA9TNg5ib4jnIw=,iv:srnydYWdQ352zeNzk/HJi5CyoQEqsDxbCV+1aT1qE8Y=,tag:zCRILWPmLcW0mN/IRpzazA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/badhouseplants/values/secrets.db-instances.yaml
+++ b/badhouseplants/values/secrets.db-instances.yaml
@ -1,12 +1,8 @@
 dbinstances:
-    postgres:
+    postgres16:
        secrets:
-            adminUser: ENC[AES256_GCM,data:pKbAQDiOs6k=,iv:yET0mJtdm2baDJHwq1uYEoxye48g2PrMqiOSO3POTBo=,tag:wuIxhHiRzjSRM+uaEo2KNQ==,type:str]
-            adminPassword: ENC[AES256_GCM,data:/U3q6RmOYLpxJBAYsJ8f4lV3MB0=,iv:dw7g0E4Gm0YqtgvdcC+bq+YbSRPop3BKLiJfwaz+1io=,tag:NAXnWj4AjgajN94ml/ENsA==,type:str]
-    mysql:
-        secrets:
-            adminUser: ENC[AES256_GCM,data:XFEGew==,iv:7aj2J7Qs9mHC5kRZGrg71hwEBP64vEz0qQ+qoPHSgrc=,tag:/Rx5yx7iMU5Gwcmbf5GVSg==,type:str]
-            adminPassword: ENC[AES256_GCM,data:vYIiHccMkX7yJ2gsVGcLTUO7Ers=,iv:uDlefG5I/cirIUal/phlHCNwYtcXYFBND54XJ+n7eug=,tag:YK7pdaohOZL9yg4OiPxbRg==,type:str]
+            adminUser: ENC[AES256_GCM,data:Ma+kTq+QHKY=,iv:1znr9VoLAdGlLFzbBx9NMsj022vb0I9z7bTTTAjzX/c=,tag:GfUQHztjj2h/ctm6XznT7w==,type:str]
+            adminPassword: ENC[AES256_GCM,data:XYfh9OGA9SgW3B76u3tmXPjQ8vA4,iv:M4KIyzNujIePcrwmp9N/EErer+YZFRujOEN9VsPz76E=,tag:driIxiCOYX2VUj3v0rvB7g==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -16,14 +12,14 @@ sops:
        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVbENvMm1YQzlSV3UrSEJ4
-            VTZ1RWVKTlpsUDFzQlVjMlJEZmIvaldHVXlFCm9SVzN3Z0dwTGo1Y3dnaHhvSmpi
-            bDIrMlJhbHhKUmRZejdkTmJiSDYvY2MKLS0tIFpRbkwySVh2MDlNWEFNZHVtY2Ns
-            Wmh3Z29ZSlBhbmFJNkFQZlE3aXpMMk0K14rSXjSF08xkil+fFJpeMV+6XChTJ2/3
-            OQecJtg+0NQPyvC+kR5qKq8roiSzNNJgTVg2wwKMdukKVVTbEGi0gA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBON2FPbXpoZCtMVStKZ0dl
+            RVRycjdaODJMcG5vblpiZlB3M1NVZXJaaWxnClpPSURkM0hzSFdPVmIwQ3g4N2Rx
+            Mnd6LzY2WVA1dTJmSVhMZXp6dmx5OXcKLS0tIHJKOGtWYTNjSnR1ZGMrZk5mR3ho
+            d1p0TDkrWkxwVUpKOTNYQVlORm94dFkKh4sfmicfMZzwoD6LymdlcXDTFcoLbJXq
+            Hoc62EW11Pl0Ah8HWkndbiYVO++xf2UHWq7Th4t1W1PdKq0bCN/GSg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-30T15:07:28Z"
-    mac: ENC[AES256_GCM,data:/q/LG+CgBAm666nwu+QCw9beoC8m11R5OYspnUxdwTfAv4h0yqY0Hk599hy+Yqt0brpUpj8hwqCESkt6gufFAklilSYV8SWvea7FxA4Jdbfpj1kfty9d4qMxHrpggId/jPshVAVsF0Ezh1/XbPWpQnTiaAMu2JTVMR9cFR3xvyc=,iv:37EdIo9QoUemTvpHSKD2kdq1FnJpwNXGr8ym0dPX6w8=,tag:ri2ILtd9FvLJf0O5iKOdyg==,type:str]
+    lastmodified: "2024-02-17T01:05:06Z"
+    mac: ENC[AES256_GCM,data:DX2T2S17r2U5jqqFWRDeuBjkjO1OrkF4/wRAC1cmSuhrGB+R+B/x3RPT9XKGpo9kEzgQkj1Fx9Wjkg0KMVlmTWJZM6GtHz/DUbD/nQX1+JLy+1U2qSYua59hdez3vIPPaLbiYcs7g2M/nEyyMj5c82wBgDUD26uiYo7V/AeoWjU=,iv:ISDzjgML2az6Y0VH/KNUcTVuHv8e59tT+Exn5BAqMeY=,tag:fGXusF0pYxHCPe8i+FmNIw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
--- a/badhouseplants/values/secrets.funkwhale.yaml
+++ b/badhouseplants/values/secrets.funkwhale.yaml
@ -1,10 +1,10 @@
-djangoSecret: ENC[AES256_GCM,data:CxsJVhNxku3pohREaVs=,iv:KDupR8tZlPkPeRwGWzyz+eKtp1tfTdFWqXNuQW20oXo=,tag:lCHqv2CC8cXpnqTr8fGzPg==,type:str]
+djangoSecret: ENC[AES256_GCM,data:Usu+QgI7MLUmU1m3ExE=,iv:wv4i60NCuG13xBPSCZ3NDQI+z5h9ENPVQcZmqUUFvls=,tag:2SPu5TC4sDxXkxVdZ9j11Q==,type:str]
 postgresql:
    auth:
-        password: ENC[AES256_GCM,data:IKPFpCY0Im2SQquNFM/3umvGfYOt1A==,iv:asWxkKTvez1FxxXto/ulh4CDBvPZ6SovqKnoFEQjG/s=,tag:iqyxZU+jERNgakMcAm+cnQ==,type:str]
+        password: ENC[AES256_GCM,data:Ly65GeUvKfwKfRakpDZWftzzE11hw6/mQ/rP,iv:DUIGI68MyWF7H56QIjajgP9GRNwdirX4i1lNMP02vXw=,tag:bl0bHFIbMWG2gVns+Fvfiw==,type:str]
 redis:
    auth:
-        password: ENC[AES256_GCM,data:fgxZMA13BpFf5FA8JwLUXjlelUgvR4qtg316OALq,iv:numLe3PrsToG0Fbl7+mdbWOBTb7XrgppF09pIVg+rrU=,tag:ivKuF0xFe/s4P1otjLML8g==,type:str]
+        password: ENC[AES256_GCM,data:ZLhshhCqRR4ks/UoMIwSbHtwSE4yg5Kv6GvqUvq9,iv:urWADLANGZz/W35grDnaFuvkzFx71fcqWOzpvz/5fR8=,tag:MLUMmSkTSGCntlooOWtR/Q==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -14,14 +14,14 @@ sops:
        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRL0l4OHh5TTd1UGoxZFcw
-            TUtNYkdYTzhRS3hpTHkyNlhoT2hTek54RlJnCktpZmpDNk9mYThyUVZOUTAvanBL
-            VElHYjR6T2QrV3N2c08vZ3JHVWdjSHMKLS0tIE5nREIyVlJ1d29UVzE2aFl2Q21Y
-            dWdMUFpOOVJYSXdBbzJiSzhQM0VmbWMKUqdIpfa8i7vASIga8HFurrPf1RgA+WVA
-            GZiG+M0i4yc3SooTIwbDzH0orfaEHueKdNTGOXMgxNiRIt2q9BG76g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpT21wYkxzTnJpemJSUWty
+            dm5EYy8rcXVnT1dVSlhjbkgxZkdsdGV1WkFnCk9pNnU5U0FRL1l3NWwyMzc4Q1JG
+            SVlmRUwwalR2M3NwcjhJTlVTZWFIWXcKLS0tIDBtU1V4YlJxNVN4UVdscGM0RW1Y
+            ZXFURTlCWnJLNWtjOENSclIxbHZWeWcKPzZZsTcvVWbLCroJZWeI78H8cgoLfxjC
+            nXtzdPpaENY1k6XULtsMWmh73Yj1Ul0pRvGiYRetRV0LOo+JeLcJ1Q==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-29T20:22:20Z"
-    mac: ENC[AES256_GCM,data:G9+rbTp4AXIr97bl4UUUIMsd47Gmwt5IGFJQMSAtKRkCCcWIVK9ac+3nX5g9gOgziKvPE7moETXPAfFjcfOQFvi8bmU7jZnoLr4rOvP7SX1LZEfs9siCCtC1q9S/VrlWhxx/2Cpz1EegM+o2cQepqGr4IoIpboEowKl2yhpZiko=,iv:aRDq9ptB6GrRAvl5b0yyKVTZwOPdtFvSGEIPhlMrZbg=,tag:PsRUQJrBtu3sfLcIhIJbqw==,type:str]
+    lastmodified: "2024-02-09T09:33:11Z"
+    mac: ENC[AES256_GCM,data:OCvHNmxwe5pd/xZiwd1LKD/QvzLd7pEQxqhj6xREeq/VQHDapM580DS+BJYEYWRVJUxIJP05E5ZrzYqfmXbynNvY87f1SHNWLVsRTDsKVI5j3ND6mxXH658DcJKfPcJlc3bV8SYX8ATiWI4JIyV43jvhFZ0JFrWLMzPlc2wVdQI=,iv:stgL/nBiCh33GEkBTRvcVyoc8LtX4ZEHgVbsl8x2GII=,tag:grVO5PT8kOlbbF/FfXBPmA==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
--- a/badhouseplants/values/secrets.gitea.yaml
+++ b/badhouseplants/values/secrets.gitea.yaml
@ -1,23 +1,23 @@
 gitea:
    admin:
-        username: ENC[AES256_GCM,data:f4o3zs74rjY=,iv:t5Cx0suxiZduwL2bsfNyxOVI8RZH1ytEGUdOF2nONco=,tag:mo/BwFwzw7e8tAX6LyaIQg==,type:str]
-        password: ENC[AES256_GCM,data:TnIUSnX7Lj+2N6mWWOvVVmc96DQ=,iv:vjow//IrtvdmTg4jYenwTyUnuBhq7witfzugbE0uq9c=,tag:L5UPa9UK4aB1wY1ilZntzg==,type:str]
+        username: ENC[AES256_GCM,data:o01/289lwFk=,iv:ubra+bsAGt3Sgu49oClylLWUd5ie0l82Uur5vMPcFfs=,tag:bH8dxpC/yls48dWoF60r1w==,type:str]
+        password: ENC[AES256_GCM,data:L6dhobCkOinNg/MNIAA3VBAq6ZY=,iv:CPBDvQ/i/OniOFTngH5CaUmygf331aqAVJRzBcMJw+4=,tag:RNtXdxEMckIaHTaMVLn3uA==,type:str]
    config:
        mailer:
-            ENABLED: ENC[AES256_GCM,data:C2qWn4E=,iv:APUvrTInDdxf1tJ5eFSgxUej8e085HZalsiHY6/Fryc=,tag:MW3KhfU+25EWDzM/+QOZ5A==,type:bool]
+            PASSWD: ENC[AES256_GCM,data:tTMOtRJ3trW34d+KqMGTYLBMBJg=,iv:4B3ThvHS+vha8pX/OA9rf8yeSGcafEbuMwHvjHPZfKA=,tag:Qs/y3HyxWX9il6HXCw9sMQ==,type:str]
        database:
-            PASSWD: ENC[AES256_GCM,data:EVawxgpBgJ1ZlU4F+KFlJZXHq/4=,iv:ZUC7YBQ+RXNKLFEZzAeXfoGqBv9ilGw6Q5ynspAsc78=,tag:Wpb3awtdRLLBNYmmuTUCrA==,type:str]
+            PASSWD: ENC[AES256_GCM,data:WlmdwR035A7nk7xfq5U6A9Ndoj0F3hkl5g==,iv:IgCCq9Hl7oYVTE3W/MfqSMT8yEl275HO8CwW/az2e10=,tag:ZKsJZq88oJhsIvSYwWsX3w==,type:str]
        session:
-            PROVIDER_CONFIG: ENC[AES256_GCM,data:i/N01zYx1H1D1eFiZKOmf4e1LoDBJE5AoN4eZl3h/QKwOEy5x4LNQoF7CbGguCBMvITtYbzXr12VzQ8pxEf17z6nssQ2nNiz84zuBOY9DQqxZLkxS5AmKKgk7XKF/YYYDaavMdJj54gtXoCrDZ58z5Tw8FM0ScTRp2+4RXGMwg==,iv:dKZhe9cOPDhdtK9sJKzCHmimV1vcuAebY8DfaJMqk2Q=,tag:ZhyEepW4wIM1Dv97xn5xBA==,type:str]
+            PROVIDER_CONFIG: ENC[AES256_GCM,data:amNVifRdK6R3SJNlLTYik/wrTgfwn6WR4cpCqrmSGlTXKgirmY2UjgYQkxThakmgCEDPaQGFf3dUi7CmCaThIN6bBueNVIrWiccLcp99vVIz05pMlgi+tRQStDStNtn0hIT2hsfCShlX+yVemUYveb+5TZXigqgwpFyqLGUh0Q==,iv:uc/R+s2IZwaXVbaT0+D4rNd1ZjqyrRw0ef1hdQeC7rY=,tag:WhK0ti0PV66LsTLrMmSrQw==,type:str]
        cache:
-            HOST: ENC[AES256_GCM,data:UI4Dgb4qajStyDcpuJaoJTaTo3vowWQw272Y4C5q3DuV9DarChv4Qvxh9ZJwYsPSgO9G/3eI+mLldipW98HLfATMCHR+DicM7ymI0nGwxeliyj7sOVGFS2dU4zF1kNyhFCqrjMfQzTRQbfOTiB+QyfhluMfrDbOjOAAuLlsdWQ==,iv:WOlGAxAtIS12vCGIUmxMhO3UIsoUuD3xluZbBThugW4=,tag:Y0Amh1HEtYcg+9JvROM1eQ==,type:str]
+            HOST: ENC[AES256_GCM,data:YlP7/4j3r1IpIuQN2yq2QD3IPN6F/sFw66RfsF0wPv53DNmordSB6D6Ltp4p5rhJtv9b5yX/XwEf6HY8BPpV4hC0oEDIMWHr1+rIS8GqaDt0faiwPCvMxAOmFjEP6n4pcEJgOlCx1Qm57SOQPKrUb64VchgOSAvkeSpWsBXoUQ==,iv:0P5LUtVCHpuuG8AwHhK2Hm/9ZY5XUYhxz9pVirhtt7I=,tag:8Hg5l1e/36AEa2mDmJSPWA==,type:str]
        queue:
-            CONN_STR: ENC[AES256_GCM,data:kpqTpJVI/8790Ho2/U8YTC2Sc/d7v8mc33PsG7vNO52d9vMCOgsb+GQldWlfMPdf1H09axJxdFc5SIvsWWD8FoaXvtktlz4yk6fL9YxEXnkpn72VSiNe+ajUu6diP4gYWw2cUhyKt3ss/Gx70bKMEyE5g/ecZG3S+NZPFxPSTw==,iv:T69ou0uBg5CrseI0VwB2sSKRDknXrlUVPb/igGI/1H0=,tag:Y42Wa4QVt8k6AmhDC5bOAg==,type:str]
+            CONN_STR: ENC[AES256_GCM,data:8WzpUjOeIUy/wd1SVah8huYgKGnQOeaIsHIGDOp5RPn3sDRFWQjt8UrQSvdQlpS1ByfzEKOagiRbAntopgKUBS217BIxCTseWWNHZSWFHmeqHl5khF12W/vzGnmNz13AzYjFyAa9pL8EO3padLCcW1a4amxrZrVxfoDdPGtLfg==,iv:ORrQ4J5h8GHCIc3t0DkMe7Su0azZZbXbHRq3a4els1g=,tag:OVtgofGCMpuAlZRSP2SC7g==,type:str]
    oauth:
-        - name: ENC[AES256_GCM,data:iR9QX2Si,iv:B+4ixm+dOwAnXFCYq2BnExnfVDGooonBCiHpyxfkLP0=,tag:r7CZbpL9uQ1QjAFNiFfOsw==,type:str]
-          provider: ENC[AES256_GCM,data:byE4rELH,iv:lcvbNSZMD9EMA4CmJF2mvN33a5fmXWzP4++PnNPK+fg=,tag:2wfHrpp/bJJOImBq5ULzqw==,type:str]
-          key: ENC[AES256_GCM,data:hiIl59SdN8usULpHhPX8XhMckZI=,iv:8aycsJVxbyK+Rlor8AsYKb6xjjSaS9Y5pRC/hoHzuKs=,tag:tBhMPj+AF86TaLkxF0+6Og==,type:str]
-          secret: ENC[AES256_GCM,data:JfoXbQW4G3QdDsb4WxbMOIBvsEVYXsdK06s2TLO6ojtgprYUb0ZKHA==,iv:n1SYPP3tnUCNuKET0PS9kIHcRSDMDqWtysjwbSI8O3A=,tag:EJ3gKUsCG9O218yS0sw9EA==,type:str]
+        - name: ENC[AES256_GCM,data:DgSGZYls,iv:jO6H2etEbN72eUqALClaNSSXTmFmwEwh68+B55XjgSg=,tag:NPvG3dNbqBfJpIYs5x5DRA==,type:str]
+          provider: ENC[AES256_GCM,data:KoZ8Phel,iv:DnVY7rr6Si7wRqcq7CIEHVwzdk4pu8LI+SfIKmQ/CK4=,tag:BDzwrZlCrG/1PZkZatAinQ==,type:str]
+          key: ENC[AES256_GCM,data:KHj8+hRm9WkQoJu9zZpXM9MggLU=,iv:HxbXynfvGPFDGKdHl9Vx4Y+Zg8hk0PBX4SmK/KDfVKk=,tag:tL2lkB458HhuaqZ0zf2FSA==,type:str]
+          secret: ENC[AES256_GCM,data:xGu+1QXvLo328O5D7+mJb+X0s3qQbD93kQA8UC3ec27oCcomXRSX7A==,iv:vVLCaFNv/4qjbvxyM2NKfScWAUz7Pn4o3GfzW/IhTO8=,tag:mRvGiq9jrcp+kaUeNlCnTA==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -27,14 +27,14 @@ sops:
        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkMCtwL0h3aGtNQlYzVC94
-            QVFvQ3VsTnVuckt1eW80RXFkTUw2VzdzMTBjCjMvSDFlZXpyM2RQRTFTTTJrL3Zu
-            LzNlRy9ZVTY5cWh1WmxmbzdwZVNHQm8KLS0tIDdxNGlxbnk1SDc2R0IrcmFHMmo4
-            Ym5KMWw5ZDBBZzJBcHBXdFZiaDZpU0UKNl/GkGP25D7z5a8mVBmoSTfOM3EzymPN
-            WW62zIoBHlwLxF9nwj1xCCtcL1XKgiB8nnn4IrY3ljqFc0VkxD9dnQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOUUg3a2M5cklyK1pXbklQ
+            M2NXVkFyejhsVmtuclB0bDJSUm9RanBza2lNClVoc1VaSjhrWkNUc0Q5NVJ0Zlo5
+            TEFzWXBya2tRS3hCelA2NTdUaFNqekkKLS0tIEwweEw0NFJRb1B0YlhnSFUwQUVC
+            OUh2Y3dUN1E2cEtaZWxvQXR2S2RRU1EK/4pB/huJUUfnai9tNuLCgVlYV+5e235X
+            RsA/rvpzFkwLWJD/Bg6Uxys9zU0LyuEvi9DwmEHM7Wuam85Ssh20Wg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-29T20:30:31Z"
-    mac: ENC[AES256_GCM,data:jd8jrX6GTAsEMydRfjLPW8XKXs4HgNNMqR0UvzVq0qFl/2zisKYLxtc6m4XBjDLeI8te+nNcJ16XYR0tdayM4PjXzurC9bAMdyI4utv1cRUJdWVxbo2oODWjJ9IAHqwkVHfJOrAJ7j0qamzHr/4h7u2DsLxvHm/lQY2g5zDKPD0=,iv:P215bq4q6iv8fSpU2CvfUhR1Pbr6mpYtv868m2F+M44=,tag:oWzMZOyCuxf2JBiGjDdCKg==,type:str]
+    lastmodified: "2024-02-09T09:32:40Z"
+    mac: ENC[AES256_GCM,data:zB/f5zCAEYpfFxhA1PW0osBvIC3WRVH8GlGZggD98KyuwhKDRlwRlNp6LTcBJjt0xZLK7xGQYB/A6vhpo/V6D8JYc6Cajy0mdy3n1BhX6W7ow6qsc7iPxFOKu2FegNwxY433FWsprisbV73K45TKLxxBtwD1PO/gCzCUah+iXr4=,iv:YEyYqURF4K1WbN8XB3f7YKq+asco8+m1jjBmCnqQ5gE=,tag:F7CgV3cQNTWndm4gvphejQ==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
--- a/badhouseplants/values/secrets.mailu.yaml
+++ b/badhouseplants/values/secrets.mailu.yaml
@ -1,21 +1,21 @@
-secretKey: ENC[AES256_GCM,data:yL0+ORBJ4ZWHrmoNvVowEA==,iv:XJuY89wtdz8b+9SnTMro33Ka/pBOymyhN3MLJOyujAA=,tag:hSXjKC6+6NLgCoiHlbqtxQ==,type:str]
+secretKey: ENC[AES256_GCM,data:0LlGX1QG39jemZ8X2Itq2A==,iv:Dt1YoxrQ3yxJVZ3sc60kWXDvtwKCO7PrsZRMZUDOHpg=,tag:NY/8/xxnYcX/Hv1BCIKCjw==,type:str]
 initialAccount:
-    enabled: ENC[AES256_GCM,data:MvyEVw==,iv:ICIPR4oJW6pCRUks7Rk70NqdxVTXYqmM2qjQetppmEY=,tag:1FOK5MyPSTaiDayAAaPPuQ==,type:bool]
-    username: ENC[AES256_GCM,data:qSsqS5iQAyNzAQ+ZOLSWsie3k04b7qPUpcfU,iv:sXe2sjo4XesoEmjI9tY8gYd2psUlZCltBtLlIyE+v8w=,tag:uZeXnjU+7aLHI87qW+tiGw==,type:str]
-    domain: ENC[AES256_GCM,data:T5w/nPrq36iwZQdYHMQkisY1,iv:7EskbKJfRXMhkKZBgHy6nP8r1epcf7bNi8gAp4qY5TI=,tag:nZ+0BhvIy9Ap88SHaKhSvw==,type:str]
-    password: ENC[AES256_GCM,data:dki7Cw2n5FxYsINS+aap4u8hkQBl4RUVW2KxSXrQ,iv:XxUHdy5xAWoH00yxItL9P5YuCJtCG4pfRUhZdOr0EWw=,tag:Lo7ahX7CAXS31lFDKEYRww==,type:str]
+    enabled: ENC[AES256_GCM,data:rCMSGQ==,iv:mltQk4uc4jETPOimbRirrlxWxPsck6cLOM387chFtt4=,tag:3cy2sk+WPle9T96PcdWL+g==,type:bool]
+    username: ENC[AES256_GCM,data:2s3WINCPpAg=,iv:inUPAt/Q/lqSi88CKIEcexkbeJwSkS7pCWJqjDBbZ68=,tag:793MA/57fipWdODD2zcaUg==,type:str]
+    domain: ENC[AES256_GCM,data:IPoIY+yGxry3QQTRbdfbaRJU,iv:xG3mp+yAf+J2V0owRYi3XUCpQjtxAA+92bNiKTLvhvw=,tag:JogwzTxnImd4iKgJz76yaA==,type:str]
+    password: ENC[AES256_GCM,data:e2d9qYEUjkxbQRatzDslMTGDZhIqZwgr9t/olN2G,iv:uynCQDAKn7IoVpd1VLhWAI6dK2hN7LNC9PFNnOkYGOU=,tag:gqZSMCh3j/9lA7m6RQm6Ag==,type:str]
 postgresql:
    auth:
-        password: ENC[AES256_GCM,data:o2KghCpri6cUbGeh3LIjUO6TXBz4nrZSaU8tW7PD,iv:KNp+FM1DqC2h1/F2cudAQfQZA6UAD833SQbEQ/oKkTM=,tag:oHZzKLzZ+IIJDrjFDX/3cA==,type:str]
-        postgresPassword: ENC[AES256_GCM,data:2+RrJdHwGQVU910BkXH5ZogDfh8zoOPDcJazg7Iv,iv:CKH/lhkTYNbJ0sKQCwgZ4CDg+7ITsbJq3wcQiJWogtI=,tag:xZX3HSfpC2Wrz1sCOtQwYQ==,type:str]
+        password: ENC[AES256_GCM,data:YHgy0iu0oaaRBiiO0FXCN2o9d76Vgdbxi3Mnoerj,iv:d0tOkZsXvbEVA8awiX3P9AMrctbvy2JIbGggua5dTzs=,tag:v8b7QHY+5urMsV53IL7wsA==,type:str]
+        postgresPassword: ENC[AES256_GCM,data:LJH0X2ptmy3xNOHcpWr1FQ0IA1v8q1GmzXrhRwZz,iv:kLh8rb/75uGQL4uFbNLxzD+U59LcKkDeY4uExgbfgoE=,tag:abbtDQZAdzzrMsw0ErnX9w==,type:str]
    secretKeys:
-        adminPasswordKey: ENC[AES256_GCM,data:LbBjpvmdVgIDLtlL5ccufC7Pe28ZVO5CYxTzVoZD,iv:dsVuk1ZluIAhtYN1s9xH+2Jk2CyVYGRU2LoxnC5Lgb0=,tag:lWZohYLUyVnrMKhvwIz7uw==,type:str]
-        replicationPasswordKey: ENC[AES256_GCM,data:asv/FCVAPir07vw5kW1uqSPGEKTR/ukwtOXY5q8j,iv:SnEftPnqXdPK3Zw9nd8Qnj412tHrPSK6hR0V3rLfn3A=,tag:xKqOjOuSyMKSo02r8GyVbg==,type:str]
-        userPasswordKey: ENC[AES256_GCM,data:NNUZ8zVSem5Aov/PxFbc7OjANRVa5g5WjyMLRX1V,iv:c3XDq6nyea5ErJZHMKwxEqNfpjBYVGiqbAgqko5nsjI=,tag:HrhLvBxraIKFhNPaulM+uQ==,type:str]
+        adminPasswordKey: ENC[AES256_GCM,data:30CNkafy6P0F5UCvjxMus9Isi/FzDzyOqMT+VFk0,iv:1s7dFCEGD6soA+uwjAzKmvCltS+YUVY1/2Tk3ZOBemU=,tag:IO+YBBWmmUnyxbsigACRwA==,type:str]
+        replicationPasswordKey: ENC[AES256_GCM,data:pdBxjNmwcsDj0/dC5324XVUBpemUM8LbjxVlBwt/,iv:+wfSUgLgCORtSe1Vf02LZx0U9eEs6Bd9OgH3n6kK8BQ=,tag:E+FgJG2z8/TBAmy7+XlYSw==,type:str]
+        userPasswordKey: ENC[AES256_GCM,data:3s35K9e4RHRvpt85ft2Msb9GfC6TlGnjIT8B/obp,iv:KnuBW4b0LOuHwXNzgxVqpVDnijiV+DoyQfveHvgCsp8=,tag:G3FcSSPMJy/7IUsUPLbuSw==,type:str]
 global:
    database:
        roundcube:
-            password: ENC[AES256_GCM,data:V7Ml++sPS94LzA==,iv:aQ36cTMR5ArSows/3+z10nFIRppCkSvQx6VwtB30hno=,tag:2yVIXNHJ3HbA/sr6vnX7XA==,type:str]
+            password: ENC[AES256_GCM,data:WUgeCqoWVRCdrA==,iv:5HO53lEArnIqRlWnQqlSKZ+hs7DxDAc9D3wHmbvb68M=,tag:nrjt2qnqGDmT/rv7JNR8Mg==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -25,14 +25,14 @@ sops:
        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGa1lRY0tQUk05WmpINVVw
-            YkJkVDA0QlZibHFmbDdPTHpGTTY5N0JodXljCm14aVVSUm43MXo3d0ZlYWRUMXhh
-            b1VqRHZXUTArbDNpRG9VY1U1a281ZW8KLS0tIHV6NWZQdzVzWFdJU0ErQy9WTFMv
-            RjVVYmRKcERYZVhMT0ViZzR5cm8rMTgKizZBRrU/WauUmFYm9fnouiegNkYZkudp
-            QpOha6CggN8rItelbnWMHlzGZBzM+77mFocuGmvNuTY/YGSkXfLjLA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvVlBCaDl3OHBxTnM4aWRS
+            L1Q2aC9uT20rUlgvQXFkVThsa1JBS3ZwdnlrCmwxQnNRazlENVFPUER4WEx2ODVu
+            Ukx1RHQ5c2NCZHptNm9IV2cxdHlmUFkKLS0tIG9kRUhzZDlocEhNQlFrYVpZdzVj
+            aXFnN08yR2JMVkNGcjE1UDFDWjBWSzAKQIt/5DQkW8FTQTQyWfU8QSxMQ8TV1J8i
+            l326pi2q+TuLoIvef8EKA+qax56OGnqESl2JcyHCAyT2T1tTzM1bpw==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-28T08:37:51Z"
-    mac: ENC[AES256_GCM,data:NtXsrrs9yWlVO6oBQuJKHKPlmFMkqmu5BqOrYjdj9R7KdYycIWRDlNojieP9lghjSllgjkR3N4DpST9n6r6GHOkrpCl0eX12AsY0GUhSwaJzMgvX34Kzo+BjtISvODy0UzEVb9qKzbFuO9R4FMqyxBjTJirJVFT1EIB7Hxbb5Zc=,iv:OFKLvj96oRasDg5sYbJNS5KvZnxOXhh36Nwjl2gA1v0=,tag:aWsKrlbubuh+xTnyxvWeRg==,type:str]
+    lastmodified: "2024-02-04T09:30:41Z"
+    mac: ENC[AES256_GCM,data:5SE/XCKyCArO+AqhRJb8h3K1WYys5OHcOfZuRW8j8i3SMEtb+84D1KcsgEFBsJmvffbpxaKXcz7umEIKG+LWLeLjvCgqHwZa7Tidn1X07a9Dep74BfvTNZWVCKEAi/6YcHkLIsVM9Bkl0MOPZTxDjmzVsdiCR+3nfZ6RJ4AysxA=,iv:Yf8m6YNxycoZj+uYAe4rKRmzQiuZtmpLrYYmxDvwPbA=,tag:TcrPy/gj/je8gGOw3jiZ1w==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
--- a/arm-badhouseplants/values/secrets.postgres.yaml
+++ b/arm-badhouseplants/values/secrets.postgres.yaml
@ -1,7 +1,7 @@
 global:
    postgresql:
        auth:
-            postgresPassword: ENC[AES256_GCM,data:NopZyPWiTKPPVzLcvVLN3JgMQjQ=,iv:rWVhR2wChvQSIa7eBPrvnWO2ydLZ2D8oF87INiy8NX4=,tag:Xb0qbED6QXu5QBgHY6hrOA==,type:str]
+            postgresPassword: ENC[AES256_GCM,data:O5Fvmjipcx7CZ4DKQjRW0isfzoUt,iv:sVl6TFRCKAL5ci+lC4DfX/vZkWwRVg559kq4GU67udY=,tag:dEsoEe1UfvD5rUrI+EYOsg==,type:str]
 sops:
    kms: []
    gcp_kms: []
@ -17,8 +17,8 @@ sops:
            Wmh3Z29ZSlBhbmFJNkFQZlE3aXpMMk0K14rSXjSF08xkil+fFJpeMV+6XChTJ2/3
            OQecJtg+0NQPyvC+kR5qKq8roiSzNNJgTVg2wwKMdukKVVTbEGi0gA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-21T12:58:01Z"
-    mac: ENC[AES256_GCM,data:ShHWH9RIL4rJ5X0IvThOtyM28AC+1bJLr4PJJdYSLtV9T7Wcs2LbmWxtM2tpRyzMeZjYKJrsstGYgxBevr1BpfGBIeR4+JCwrbdK4AOq2VbLMpH7nMOU/huuUpxOopweRBTwZOEMRBkSkEk4qPvebLHEqUi6aNGdtxOINmHv/fA=,iv:C/iJOSshanbhSQ9Be712aSN2B8aXndPpP4655SQONeQ=,tag:BAJIzrYfh8a59OzkxDOrbw==,type:str]
+    lastmodified: "2023-10-04T02:27:48Z"
+    mac: ENC[AES256_GCM,data:yyvzDlqm3ZOGAMAWCbA4JBC2xs14dKJ4oGifHCvD6K3cBcLgQLS8MOoQJBVfAfL/lVqYDtQ8qwQl/NbCEAKdqw5mtGRwSGaCExSTfO8PIUZCT69q5lwhAxfSGkhjjup+88MhwdZbe2iqqr0nF/GBYT7exqu6Pj85ZKbeDVBTMUE=,iv:KVuyYWYvtVjFinkY82nPwKI/XX18t4purLInfjSxYlg=,tag:kD0G+keg4veTy+CN7KOo6Q==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.0
--- a/badhouseplants/values/secrets.tandoor.yaml
+++ b/badhouseplants/values/secrets.tandoor.yaml
@ -0,0 +1,22 @@
+env:
+    SECRET_KEY: ENC[AES256_GCM,data:vIzxdLGoKHEIGt451pZKwyFFQ7+g3ViryUHkhmzU,iv:JuSUmrUUgVL07y4mQ+z3lNRLpe0io4uDKndWpEgIVDU=,tag:6nsOuHbtgyGFJebOHChKxQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNYmNkcjVyR2o5R0dJTXZB
+            d2NBczgrTllrM3hWdHVIcmhmb1dlY1FzN2pjCndTSS83Wi9WcytrT04xY1dyNXVV
+            YzlxWmwxNkpnMk1oK25wcDJTUFQyYk0KLS0tIHR3R3did2hlMThOUEV1QjNma2pM
+            NnNxMC9vNStLQ1dadE13RmhLWExqeG8KpSUTbfxuZX+7L6SK55BJvY8KIfqt2ykz
+            qNmUpeC7YHzDfoXGF6+jklMCVcUJDRI5UeZejZ7KXnI9OR8VncIiqw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-06T15:16:21Z"
+    mac: ENC[AES256_GCM,data:qVocy+iBsjj45hLObpoxxo0ZyzxCITXR52NLfo5NZvJutRLs5SfKjmecYVth4j1t15qUJ3GIYG2t2lGxqptMyPK7SG4ln0G8p02LP4XdboKYeZNdWlHYf3cMZtnST4WdrpTCNWhLs3+8ittBb3AsR3QBtwoqzalC+VatAOJ2IDc=,iv:y3TspYIFS/eVJE8x+fAlPhFrWcH9PM0Rajgt8yUJLSc=,tag:nUt0xWqdjfoeemTk4xhr8w==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/badhouseplants/values/secrets.vaultwarden.yaml
+++ b/badhouseplants/values/secrets.vaultwarden.yaml
@ -0,0 +1,27 @@
+vaultwarden:
+    smtp:
+        username: ENC[AES256_GCM,data:j/y4Wzhb1obnLW9zHYqpM7/Glfd15hDAAn+6,iv:wNQgESf/0zbfcwFWrKgdSKcoCYVUJ3pnQYuMhfeergQ=,tag:/DPHJGrySeH9xZ9gfH7yFg==,type:str]
+        password:
+            value: ENC[AES256_GCM,data:lM5RLAEz5K2LqoCEt2KfOgVv+Dg8zDwUKg==,iv:tT/71iljjyCyBxVoAKOZgdC7BHxhQfjH7ECZUGTv8So=,tag:sd2+m7KyoJmEY3l6Qey6yQ==,type:str]
+    adminToken:
+        value: ENC[AES256_GCM,data:8+nwPIKqrzIHvfxzVvUx+hh6qz6c8lCTYzJQsbGFx3c/76wzgJZ08TVNRu2VNmlHBOE=,iv:U5Cv0rykPbBql6wu9HFuMIGoLMM40TlDp8MNM5OGzzw=,tag:++lPoZaKQD/RsVm1xZfMRA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhLzVRdW5ITFJmWHE5dkRr
+            R3pGbTh3UmFTTXR4VVVGRjlSUURudmxwM1hjCk16U3BKYkZTcmdwaFZtcTZNYk9C
+            M0ZBZk52bDBuNWZwa21SMU1mSnhmWEUKLS0tIGZVV01KQ3Z6OGltN1RFSks5MVJI
+            a2xWUGZpMmovY1Qya05nVXRZVUFDTFEKhF34OSdGZizs1/Rs9qvUOVtomQBvOFbS
+            hRsK3Orwig4HJdzj1UOZd8UMGwj6Mzhw+aKUJKL67igMwxbxVcaU1Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-30T18:44:39Z"
+    mac: ENC[AES256_GCM,data:1cpPRtzipDI0/fXlbcbuQQyjAZMk7MR005sJAIwfNVG4o1UdV6cIEG6096yeXGP8aKYXJwm1GUZ0NtdipQpieNnj59xClZHJ00m0K/0b6UHoGzSMY82t0nNrS3KvVEQP0a+LR5WVQEl7ac2m4FmbHpGtSWWMW6CYBnflfHQisFA=,iv:exvh14LUOeZnLrnvPrX9Hzfnv7wMd1Qfx37F0aVf2q8=,tag:62QX/P5K3U72O0zkgyyXhg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/badhouseplants/values/secrets.vaultwardentest.yaml
+++ b/badhouseplants/values/secrets.vaultwardentest.yaml
@ -0,0 +1,27 @@
+vaultwarden:
+    smtp:
+        username: ENC[AES256_GCM,data:9bEvyZkXadW7Hx2iW6ByPDdnuIFPkeoUjoOyoQ==,iv:Y5M/16L16AWXeaWyKCSsV/c/l9JXmNzx/IsLBmMJuGg=,tag:nFN1ZssjtqZOG8Gvka9f3A==,type:str]
+        password:
+            value: ENC[AES256_GCM,data:CF2VgDpxlwHmvCDJhx0GDLT/yyw=,iv:t8JwQFeK9Te2zVdg+gPdMlh1E5g0vMG+ApAGKbGZ4WI=,tag:7UJuxFqS/hUTVunv0CJcTw==,type:str]
+    adminToken:
+        value: ENC[AES256_GCM,data:lrb99F1zn7AWlAttShQGGyMz5Ds=,iv:nas5hzd/XMQWFA2pTaTDkqXReoToBulf6s7tZraxM3s=,tag:UH/AXIWKbZOmu/W8XyuWNw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhLzVRdW5ITFJmWHE5dkRr
+            R3pGbTh3UmFTTXR4VVVGRjlSUURudmxwM1hjCk16U3BKYkZTcmdwaFZtcTZNYk9C
+            M0ZBZk52bDBuNWZwa21SMU1mSnhmWEUKLS0tIGZVV01KQ3Z6OGltN1RFSks5MVJI
+            a2xWUGZpMmovY1Qya05nVXRZVUFDTFEKhF34OSdGZizs1/Rs9qvUOVtomQBvOFbS
+            hRsK3Orwig4HJdzj1UOZd8UMGwj6Mzhw+aKUJKL67igMwxbxVcaU1Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-06-06T15:15:43Z"
+    mac: ENC[AES256_GCM,data:9GsJoDWT1Onv6f8aUcwkbeTcpr0vF2MIgtJjKTbvvPHhzVeVev4FPFZ5R0YQXD1CmQycu/rnElktohgu9Xwum3j4hfs8Ga2qDqOk6heleBcptXDYwcBUAxg8QD5NNAkefsq5oJi+QsdD0nOeRjG6o5XYRccyoFiucTcpT9eASzw=,iv:7UJzUShRD+tzhIEeKygZlgaWHOYOS+L2Io69K0xW2MM=,tag:alOPQPbM6cex7kgQv8mqQQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/badhouseplants/values/secrets.woodpecker-agent.yaml
+++ b/badhouseplants/values/secrets.woodpecker-agent.yaml
@ -0,0 +1,23 @@
+env:
+    WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:cJoxJw6c6FYZ337i5P6dGUzLmgUn9Z+/Ed9aUK76WYnB8m0D9h5IlAlOfCQ=,iv:1BgxKsaI3dhhPNkZbpHKBn6GXadn1RD+3Q4RwKLfmcU=,tag:y8qLWwpVAwKrOWN1cC2ulw==,type:str]
+    WOODPECKER_GITEA_SECRET: ENC[AES256_GCM,data:VdWASwxPurzmfSjb2h8wBw3XbZSfG9UG0jmXSbTBPreZ+l7UQblI/wqr8Tw=,iv:APNuiqimA/ofCWsvywj+SJedQBMgRoCd65Gd3Ps2/fw=,tag:ATLGT4ACZ2GR46qD9ABUng==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTRFNvdnBsSHFBcjlGcGl1
+            RnU1NEpZekpucTNCZHBGcXdBakhkU1drb2dZClVYZ2xMVUJiOXV2enlBbm1TS2Mz
+            ZnZ0UHpsVHVUU2ZkSGtwUXNMM0R6VjQKLS0tIFR4NEdTTGRIY3QycTFhRzJNSEY0
+            SEs0Z3VjaTN2Y3Z0QmtEUEdQdmtwYnMKxQ3z1p2GulSOklUEolWeH20JeFwNpZqY
+            870x5UtCJNVTMrIDgwMQK3hn+yywxPdgSRhkW3bqH4PJDxi78UUpXw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-10-05T08:06:51Z"
+    mac: ENC[AES256_GCM,data:pc4n/3MEP0GhmZ+wdbOiK2gj7ah/9IJ2hoXRtM1sAGy3UPNBrF5VE7hxnAi393YpWBank7crDTvg2aJjhVt7XqB8zcjiHtNMlcpxL6fJ+uWxeH4uVj/NBfSvoO410oYbtPuKMjZpPU7KACmTJ9tzVIZdZOScXx7fLQxNUq01Hu8=,iv:18MqueG9MHrTcXmu14Q8LPnMFT9lolDkCbXjjA2P1qg=,tag:6ETPd8vZ0CCGEUP5u8ZxNA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.0
--- a/badhouseplants/values/secrets.woodpecker-ci.yaml
+++ b/badhouseplants/values/secrets.woodpecker-ci.yaml
@ -0,0 +1,27 @@
+server:
+    env:
+        WOODPECKER_GITEA_SECRET: ENC[AES256_GCM,data:mGYEvlIeQC3mg+kxy3ZX6gAVf88DXLVdeSdgpQa8wixsb2rDoj4+l2ET2saquK+lVhjvv8ZKdvg=,iv:VlPgDYPj1xpxnpWnEHj+slBi0H2nWKeScclPItUaG9A=,tag:ox/Ur5vsOARXRT3g0hCgsg==,type:str]
+        WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:WXwsmLmb37clb5xgv+2DeKfhk7cwaIJpaCW8/Kq/CmgfwCmrarPDDQGXZoLwOjGj3mh/ciDj7V5WgHfyxuIDhA==,iv:NhGlPyPrTrTbz1DjOZEieWAfOQHqSqhdLiqMspex1j0=,tag:vOfo+XiCUW6MhtJemkZPMA==,type:str]
+agent:
+    env:
+        WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:4lTZ16jbrorU4B9gTAoWmgiGggrMWD7K5O/5R47OIDMdRInwXtaWviofFD8WJQMduiGvANxMVNs0J1DLvFKi9Q==,iv:Y0AsW63vdVEwKvpVYeMVLFmwYlsQSwnz602QjDgj/ZQ=,tag:aO9xh3psy/bRCCQEFUp75A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlQjZqNE9iMDl6MlhnSUp5
+            QTBSOG83WFBqZFZIU2dEMzlpengrUFg4alZFCld4MkI4WW8xMUZnMm1SU2hmMCtn
+            bTZSVTIxTk5aZmo3OEJJdlJwL2xhV3MKLS0tIGJraERVZTNyMWFCVE1TbEhRR3J4
+            WXh3NGd4UG9OODhHNEp0cDVoQkM5dWMKcz4h0O4J2WlB+L9+/U8Rl+zzd87hsJo8
+            ThPZgnUNDGpdRrU2IYiXo03fZOhBoqBJe1ZG+Ol8z9bvTeyeMZxRIg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-11-18T17:43:53Z"
+    mac: ENC[AES256_GCM,data:u8iu+Ia1u5c5AkdyKbGT//G/Zp+yDNv3TQIElSBA6qCTBu0lKAii3ywXrqdpQ1kYtytjazcwkOa7vKmVy1UoCNda+8wGGHfhfOIQlll+TKBNvgUO73lF5P7X5q6CcgFMvTazXKElESEC3G04uVLEOdG1W6d0ArVRnh8gFOY6Jgg=,iv:VT0pFoOcLPK14I1doJi+52wtCfUuqh2nxdSVu0ufVOY=,tag:SwAOYLxOYaouteqXdgP2Hg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/badhouseplants/values/secrets.zot.yaml
+++ b/badhouseplants/values/secrets.zot.yaml
@ -0,0 +1,23 @@
+configFiles:
+    config.json: ENC[AES256_GCM,data:id5h3EObc18qFAYXYtVFAgJcp7IUS0QCSQZfKqy1fIoZUUYYIuKBDE9aL3OnqZkVJtXn5DNCRii/1ZYY/9Tg2IEK73twu5lDkM73APphI2GPw1ONQh6WBRp54AskuZizx3l1+PyKI/8WPVy/x1cbc7l5pGBziDzSbREor+YQQe4P3Og5KqkoWPeeO/GB/vCP+4CquBVwakyDPibrXtvEcIPxfu8b4H84fBQtlStuoT6Mdmj7NfBtK5SEl9yZ8R+kAJyjr4aM1XrtKtpBfituxi6OsXIQgKTWWZtFkousCkDuKxJf1EUCUR1J4ClmcF7UGUOxg3r3Csf1Y6ijhVgUqDlgNmRIq+qsEWrgWVixnO1RMnRcWmgJFDAs/QXY841lJTQJmVS4LRNZKu1ea8fDmF5KaxBdshizeA0RZGrdNlTUIB5AUsK3mmyPCvM4JYivQp4Hv8i1U9zlLpuPWR+7UgKbHjpQSVCem+dM76W4z9Wy463AS20EjwLUicSq7g8yLoCstuI1XsC8yNLZE6Z/nUkRysiGXa6iJnWez2tVOnIVVJ3c378U3U6tTr7ygae7v9PcvoGBTYTZA0OyrMeHrocKp4026yQJN+8Pj8CPdZX/nhC0gW08xI7EQnzK84ca4XuEZHWEtlmMBJyIGK07trq94BH6QwUaIg+nUv/gKvUA5CuMSAqECv+wCfQ+EU7mRClXR6RYJvEUxIEvGjb3CTOyV+gbj+CKaz3LZWWPETCAvOz0Cd8L56E7yUwFNhd+c7X8RuMy1vdoiCXdkzU5QCDmfv3ka4lKBPd3cvHduXeAh0wMNHSqLEVZblnt50tiZmo6vwiNGxlg3jL56Lfn3rkz+HVKRl6ArPBOdJhbgGj0bZFJMPGBU8kNDksQ6DMw371vAR7FwlzLKdz1Z3D1CvmBRUBIhr4TbnPuTL77fytVq9IdgGcTexs8QhcelXmoW5nA61PpYhYCU65m7BKC0koX4fjCjAksvjZaI0eeYPgKafAqKBlJslqKq9lNGH1orjgmXO0LWV7xv7D46BRrrfMqPwHUsPAGBP4VhfuIXc3keTmtFWjexyjMzvkxtoagATQZgbohjL4D4dzMTVhGH+Iw6AyM+9/NZeb7Cm2CmmJJXG0kmXGezuyRwNrChlhd4/HdeLvfBZbvXYLwr6pZn8dbJ7w0V77clsjN2QhsrPGh8VVf548KlkcfWp821pwmPxLme2TU4nJE+eU/7xK+LdSy8vpZ6wkxThTUdj5/A7DAszgdDed3aWfVIKz2DmLWR1iD6fC7n6OIIE+dcywNTU0sbYkMffpoYwU9Om9uPeer9rkzrnWHZX2btyfKUy8bnf0LuHuzRKyFl59nMUhlXbr1YsEKabNpsaxT50L0idoO5Phkx7os/qiqvxaPChMJngJQ9BXIoKARkg4hgvvjKpQwmjt/liA18COy58B2gjH3aKA6kye0/utQTih65DamYt8Wv4niVAZ3wm0rG5uaBvwZnj9N/xn2Klx5Iih2ZbobWVVR0MCAhe1nKIcnZxRrsm+GGRX2svYZg4ROLq7FagL8mn27/aG0UMdKQGpbXDQviNQgY+wB3jBmZAea54pWe5sgGBxXAZSYhGoOaWCLwWUtQWGdusjebEuqonW6PSE7whkbJxStNZOdAxATlCSe7jAkzuj5VBZbL8mIgnTltwKk3RcbnpL0j0pwousVZpSqg9KOqubxgk81YyMImA4LI3Fi0OFYIbDSw8zJJUgwASIWLQ2GxLM1Z1oxun7HpMV5lK8I+n70Vcqutn2N8URU0XOo6gcWCfknhClCwkOsZxU+DSVYyz5Aq49zwojSsd/CuS6WbFO82MMCO7dRLIz9ju43xAeCgFY7ZpbRyCR8U5IJKHPrHunYGwaRpolAE1V13XuBu0pOyaiU0sIeA44snU58DVMFyvA3PUl47FXvPMjGahbZoun7vi8J8KbRXlhHH/HFshi5eT16WOXK5SXBEiQDjhLa5RseWI121ARKtsvBRlhr9yRsZedlhmW7nqRw5hbVvHDQfUFIuiRHF1XAElP1C1hcb2GDE7r4anmoSRgcHYAI50HF4CPBSxiI+EAisKARIlUgRKt3gOfG8AH4mraUL8Lt+Eb0Clsd0z2GuysPHrEhy8WzGv4HW84ngNmZgznXP7ZFrtT31zAQr9QL/oirJf+ujPUdY03gJbr3jQXrQ1mfivlsaofgC0WL0xLma3Cuosb1nGmw0XmCGJNIOmgZJ/plQCWH05UzVR/QXhdEwlci3VNeYOSIUJwkv2eUyHsxHj45VRtLuxnrLx7BqR+kxBpRayJXWRBx1rcW7RTvS1a5Dk5PxsqjKcxKu+wRbPFmv77qOIroGg+XKTp8XeIxcSs4lx7AsfpTEvWpARwsydrUSKf/++F+3dL4yOrOyywul8gnTN3iLMoTjpze83ZFcJ2viiyqMWnHWQnuVveZTZi3NmoC63ZE/XLlztJcDT1UkrH3Tlvu1AxqMcm0SxK3TgEbvGmdWYo07E+qEMsUyoSpeE5MX2FESR9C67s/t5/rfThhvvjQNhydUVLrQL8O,iv:njFz+TX54d1Fy7QtrjFht7lyujuuIamNWEXquA6Q+jA=,tag:d+9rLYzYZf/0uuZ/VVys0Q==,type:str]
+authHeader: ENC[AES256_GCM,data:IHFsb7dRNIMe8kv0sG6u/A==,iv:mc0MhVWKEz8ln2DvC9mwrYtqKCvOjudiUYETOBx3DAM=,tag:aktcOM3u4xNyZ4wTJZ1E3w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvMjkwcll5bkNzUE1lQkN0
+            NXRCckdnUER0YlAwWG1wWVo5Mno2T1g5eWtZCnJGMkNScEthNHVqZnlvQnN6Q0du
+            RnpzNitYR1RpTnl4UDB3Zk5HMjU1MTQKLS0tIHNoZHRjdlU1SXl1c2pzemZsQzBB
+            M25WRjB6QUpkbURZVmNaWm9nd1U4RzAKan1bSzcDc2G+428vpnNDWYhQ3/nFKSUp
+            VLnfx3roZUrs0QV07O+AHobOvlLD4eo8wfHMUneKipAQ8ZAlhNFTBg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-05-05T17:37:17Z"
+    mac: ENC[AES256_GCM,data:vabfq3du2GfVkWQqdy2X/8pl/V/i+juyjIeGRia9cZ57SFPPmS/7n7rV6W+tpp402ov+16HHevVu+ZUZKxFPNq/8WiIVFCh3YMAFimzB+wOXziivAf1zAgYX5h5JHMV3FrXJT0yJAGmVbrZ7KP48CaB74PJGb++4Jr3qPE6VU/4=,iv:PApbvtdThsQyfD2db8GBrnrZL4jlx7qL8bHhAijXk0E=,tag:vIwECp7tomejqjGadIhudw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1
--- a/badhouseplants/values/values.argocd.yaml
+++ b/badhouseplants/values/values.argocd.yaml
@ -1,18 +1,4 @@
 ---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: argocd-http
-      gateway: badhouseplants-net
-      kind: http
-      hostname: argo.badhouseplants.net
-      service: argocd-server
-      port: 80
-
 controller:
  resources:
    limits:
@ -48,32 +34,35 @@ dex:
    enabled: false
    serviceMonitor:
      enabled: false
+
 redis:
  metrics:
    enabled: false
    serviceMonitor:
      enabled: false
+
+global:
+  domain: argo.badhouseplants.net
+
 server:
+  ingress:
+    enabled: true
+    annotations:
+      kubernetes.io/tls-acme: "true"
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.global-static-ip-name: ""
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+    ingressClassName: traefik
+    tls: true
  metrics:
    enabled: true
    serviceMonitor:
      enabled: false
-  rbacConfig:
-    policy.default: role:readonly
-    scopes: "[email, group]"
-    policy.csv: |
-      g, allanger@zohomail.com, role:admin
-      g, rodion.n.rodionov@gmail.com, role:admin
-      p, drone, applications, *, badhouseplants/*,allow
-  config:
-    exec.enabled: "true"
-    url: https://argo.badhouseplants.net
-    kustomize.buildOptions: "--enable-alpha-plugins"
-    accounts.drone: apiKey, login
-    accounts.drone.enabled: "true"
-
  extraArgs:
    - --insecure
+  servicePort:
+    servicePortHttp: 80
+    servicePortHttps: 80

 repoServer:
  metrics:
@ -85,6 +74,22 @@ repoServer:
    - name: regcred

 configs:
+  params:
+    server.insecure: true
+  rbac:
+    policy.default: role:readonly
+    scopes: "[email, group]"
+    policy.csv: |
+      g, allanger@zohomail.com, role:admin
+      g, allanger@badhouseplants.net, role:admin
+      g, rodion.n.rodionov@gmail.com, role:admin
+      p, drone, applications, *, badhouseplants/*,allow
+  cm:
+    exec.enabled: "true"
+    url: https://argo.badhouseplants.net
+    kustomize.buildOptions: "--enable-alpha-plugins"
+    accounts.drone: apiKey, login
+    accounts.drone.enabled: "true"
  credentialTemplates:
    ssh-creds:
      url: git@github.com
--- a/badhouseplants/values/values.bitwarden.yaml
+++ b/badhouseplants/values/values.bitwarden.yaml
@ -7,7 +7,7 @@ istio:
  enabled: true
  istio:
    - name: bitwarden-http
-      gateway: badhouseplants-net
+      gateway: istio-system/badhouseplants-net
      kind: http
      hostname: bitwarden.badhouseplants.net
      service: bitwarden-vaultwarden
@ -17,21 +17,24 @@ istio:
  pathType: Prefix

 env:
-
  SIGNUPS_ALLOWED: false
  DOMAIN: "https://bitwarden.badhouseplants.net"
-  # YUBICO_CLIENT_ID
-  # YUBICO_SECRET_KEY
-  # DATA_FOLDER
-  # DATABASE_URL
-  # ATTACHMENTS_FOLDER
-  # ICON_CACHE_FOLDER
-  # ROCKET_LIMITS
-  # ROCKET_WORKERS
  WEB_VAULT_ENABLED: true

 persistence:
  enabled: true
  accessMode: ReadWriteOnce
  size: 800Mi
-  storageClass: longhorn
+  storageClass: longhorn
+
+smtp:
+  host: badhouseplants.net
+  security: "starttls"
+  port: 587
+  from: bitwarden@badhouseplants.net
+  fromName: bitwarden
+  username:
+    value: overlord@badhouseplants.net
+  authMechanism: "Plain"
+  acceptInvalidHostnames: "false"
+  acceptInvalidCerts: "false"
--- a/badhouseplants/values/values.chartmuseum.yaml
+++ b/badhouseplants/values/values.chartmuseum.yaml
@ -0,0 +1,19 @@
+istio:
+  enabled: true
+  istio:
+    - name: chartmuseum
+      kind: http
+      gateway: istio-system/badhouseplants-net
+      hostname: helm.badhouseplants.net
+      service: chartmuseum
+      port: 8080
+env:
+  open:
+    AUTH_ANONYMOUS_GET: true
+    DISABLE_API: false
+    CORS_ALLOWORIGIN: "*"
+persistence:
+  enabled: true
+  accessMode: ReadWriteOnce
+  size: 2Gi
+  path: /storage
--- a/badhouseplants/values/values.cilium.yaml
+++ b/badhouseplants/values/values.cilium.yaml
@ -0,0 +1,10 @@
+operator:
+  replicas: 1
+endpointRoutes:
+  # -- Enable use of per endpoint routes instead of routing via
+  # the cilium_host interface.
+  enabled: true
+ipam:
+  ciliumNodeUpdateRate: "15s"
+  operator:
+    clusterPoolIPv4PodCIDRList: ["10.244.0.0/16"]
--- a/badhouseplants/values/values.coredns.yaml
+++ b/badhouseplants/values/values.coredns.yaml
@ -0,0 +1,32 @@
+service:
+  clusterIP: 10.43.0.10
+
+servers:
+  - zones:
+      - zone: .
+    port: 53
+    plugins:
+    - name: errors
+    # Serves a /health endpoint on :8080, required for livenessProbe
+    - name: health
+      configBlock: |-
+        lameduck 5s
+    # Serves a /ready endpoint on :8181, required for readinessProbe
+    - name: ready
+    # Required to query kubernetes API for data
+    - name: kubernetes
+      parameters: cluster.local in-addr.arpa ip6.arpa
+      configBlock: |-
+        pods insecure
+        fallthrough in-addr.arpa ip6.arpa
+        ttl 30
+    # Serves a /metrics endpoint on :9153, required for serviceMonitor
+    - name: prometheus
+      parameters: 0.0.0.0:9153
+    - name: forward
+      parameters: . 1.1.1.1 1.0.0.1
+    - name: cache
+      parameters: 30
+    - name: loop
+    - name: reload
+    - name: loadbalance
--- a/badhouseplants/values/values.db-instances.yaml
+++ b/badhouseplants/values/values.db-instances.yaml
@ -1,22 +1,12 @@
 ---
 dbinstances:
-  postgres:
+  postgres16:
    monitoring:
      enabled: false
    adminSecretRef:
-      Name: postgres-secret
+      Name: postgres16-secret
      Namespace: database-service
    engine: postgres
    generic:
-      host: postgres-postgresql
+      host: postgres16-postgresql.database-service.svc.cluster.local
      port: 5432
-  mysql:
-    monitoring:
-      enabled: false
-    adminSecretRef:
-      Name: mysql-secret
-      Namespace: database-service
-    engine: mysql
-    generic:
-      host: mysql
-      port: 3306
--- a/badhouseplants/values/values.docker-mailserver.yaml
+++ b/badhouseplants/values/values.docker-mailserver.yaml
@ -0,0 +1,71 @@
+traefik:
+  enabled: true
+  tcpRoutes:
+    - name: docker-mailserver-smtp
+      service: docker-mailserver
+      match: HostSNI(`*`)
+      entrypoint: smtp
+      port: 25
+    - name: docker-mailserver-smtps
+      match: HostSNI(`*`)
+      service: docker-mailserver
+      entrypoint: smtps
+      port: 465
+    - name: docker-mailserver-smpt-startls
+      match: HostSNI(`*`)
+      service: docker-mailserver
+      entrypoint: smtp-startls
+      port: 587
+    - name: docker-mailserver-imap
+      match: HostSNI(`*`)
+      service: docker-mailserver
+      entrypoint: imap
+      port: 143
+    - name: docker-mailserver-imaps
+      match: HostSNI(`*`)
+      service: docker-mailserver
+      entrypoint: imaps
+      port: 993
+    - name: docker-mailserver-pop3
+      match: HostSNI(`*`)
+      service: docker-mailserver
+      entrypoint: pop3
+      port: 110
+    - name: docker-mailserver-pop3s
+      match: HostSNI(`*`)
+      service: docker-mailserver
+      entrypoint: pop3s
+      port: 993
+
+rainloop:
+  enabled: true
+  ingress:
+    enabled: true
+    hosts: 
+      - mail.badhouseplants.net
+    annotations:
+      kubernetes.io/ingress.class: traefik
+      kubernetes.io/tls-acme: "true"
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.global-static-ip-name: ""
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+    tls:
+      - secretName: mail-tls-secret
+        hosts:
+          - mail.badhouseplants.net
+
+demoMode:
+  enabled: false
+domains:
+  - badhouseplants.net
+  - mail.badhouseplants.net
+ssl:
+  useExisting: true
+  existingName: mail-tls-secret
+pod:
+  dockermailserver:
+    enable_fail2ban: "0"
+    ssl_type: manual
+service:
+  type: ClusterIP
+spfTestsDisabled: true
--- a/badhouseplants/values/values.drone.yaml
+++ b/badhouseplants/values/values.drone.yaml
@ -6,7 +6,7 @@ istio:
  enabled: true
  istio:
    - name: drone-http
-      gateway: badhouseplants-net
+      gateway: istio-system/badhouseplants-net
      kind: http
      hostname: drone.badhouseplants.net
      service: drone
--- a/badhouseplants/values/values.funkwhale.yaml
+++ b/badhouseplants/values/values.funkwhale.yaml
@ -7,7 +7,7 @@ istio:
  enabled: true
  istio:
    - name: funkwhale-http
-      gateway: badhouseplants-net
+      gateway: istio-system/badhouseplants-net
      kind: http
      hostname: funkwhale.badhouseplants.net
      service: funkwhale
@ -15,8 +15,8 @@ istio:

 ext-database:
  enabled: true
-  name: funkwhale-postgres
-  instance: postgres
+  name: funkwhale-postgres16
+  instance: postgres16

 replicaCount: 1
 celery:
@ -30,6 +30,22 @@ celery:
      requests:
        cpu: 10m
        memory: 75Mi
+ingress:  
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  host: funkwhale.badhouseplants.net
+  protocol: http
+
+  tls: 
+    - secretName: funkwhale-tls-secret
+      hosts:
+        - funkwhale.badhouseplants.net
+
 extraEnv:
  FUNKWHALE_HOSTNAME: funkwhale.badhouseplants.net
  FUNKWHALE_PROTOCOL: https
@ -39,17 +55,17 @@ persistence:
  size: 10Gi
 s3:
  enabled: false
-ingress:
-  enabled: false
+
 postgresql:
  enabled: false
-  host: postgres-postgresql.database-service.svc.cluster.local
+  host: postgres16-postgresql.database-service.svc.cluster.local
  auth:
-    username: funkwhale-application-funkwhale-postgres
-    database: funkwhale-application-funkwhale-postgres
+    username: funkwhale-application-funkwhale-postgres16
+    database: funkwhale-application-funkwhale-postgres16

 redis:
  enabled: false
  host: redis-master.database-service.svc.cluster.local
  auth:
    enabled: true
+  database: 3
--- a/badhouseplants/values/values.gitea.yaml
+++ b/badhouseplants/values/values.gitea.yaml
@ -1,35 +1,33 @@
 ---
 # ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: gitea-http
-      kind: http
-      gateway: badhouseplants-net
-      hostname: git.badhouseplants.net
-      service: gitea-http
-      port: 3000
-    - name: gitea-ssh
-      kind: tcp
-      gateway: badhouseplants-ssh
-      hostname: "*"
-      port_match: 22
-      service: gitea-ssh
-      port: 22
-# ------------------------------------------
 # -- Database extension is used to manage
 # --  database with db-operator
 # ------------------------------------------
 ext-database:
  enabled: true
-  name: gitea-postgres
-  instance: postgres
+  name: gitea-postgres16
+  instance: postgres16
+
 # ------------------------------------------
 # -- Kubernetes related values
 # ------------------------------------------
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  hosts:
+    - host: git.badhouseplants.net
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: gitea-tls-secret
+      hosts:
+        - git.badhouseplants.net
 replicaCount: 1
 clusterDomain: cluster.local

@ -43,12 +41,10 @@ resources:

 persistence:
  enabled: true
-  size: 6Gi
+  size: 15Gi
  accessModes:
    - ReadWriteOnce

-ingress:
-  enabled: false
 # ------------------------------------------
 # -- Main Gitea settings
 # ------------------------------------------
@ -61,9 +57,9 @@ gitea:
  config:
    database:
      DB_TYPE: postgres
-      HOST: postgres-postgresql.database-service.svc.cluster.local
-      NAME: gitea-service-gitea-postgres
-      USER: gitea-service-gitea-postgres
+      HOST: postgres16-postgresql.database-service.svc.cluster.local
+      NAME: gitea-service-gitea-postgres16
+      USER: gitea-service-gitea-postgres16
    APP_NAME: Bad Houseplants Gitea
    ui:
      meta:
@ -101,6 +97,18 @@ gitea:
      ADAPTER: redis
    queue:
      TYPE: redis
+    mailer:
+      ENABLED: true
+      FROM: gitea@badhouseplants.net
+      PROTOCOL: smtp+startls
+      SMTP_ADDR: badhouseplants.net
+      SMTP_PORT: 587
+      USER: overlord@badhouseplants.net
+    indexer:
+      REPO_INDEXER_ENABLED: true
+      REPO_INDEXER_PATH: indexers/repos.bleve
+      MAX_FILE_SIZE: 1048576
+      REPO_INDEXER_EXCLUDE: resources/bin/**
 service:
  ssh:
    type: ClusterIP
@ -112,4 +120,22 @@ service:
 postgresql-ha:
  enabled: false
 redis-cluster:
-  enabled: false
+  enabled: false
+
+extraDeploy:
+  - |
+      {{- if $.Capabilities.APIVersions.Has "traefik.io/v1alpha1/IngressRouteTCP" }}
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: {{ include "gitea.fullname" . }}-ssh
+      spec:
+        entryPoints:
+          - git-ssh
+        routes:
+          - match: HostSNI(`git.badhouseplants.net`)
+            services:
+              - name: "{{ include "gitea.fullname" . }}-ssh"
+                port: 22
+                nativeLB: true
+      {{- end }}
--- a/badhouseplants/values/values.istio-gateway-resources.yaml
+++ b/badhouseplants/values/values.istio-gateway-resources.yaml
@ -0,0 +1,98 @@
+certificate:
+  enabled: true
+  certificate: 
+    - name: nrodionov-wildcard
+      secretName: nrodionov-wildcard-tls
+      issuer:
+        kind: ClusterIssuer
+        name: badhouseplants-issuer
+      dnsNames:
+        - nrodionov.info
+        - "*.nrodionov.info"
+    - name: badhouseplants-wildcard
+      secretName: badhouseplants-wildcard-tls
+      issuer:
+        kind: ClusterIssuer
+        name: badhouseplants-issuer
+      dnsNames:
+        - badhouseplants.net
+        - "*.badhouseplants.net"
+istio-gateway:
+  enabled: true
+  gateways:
+    - name: badhouseplants-net
+      servers:
+        - hosts:
+          - badhouseplants.net
+          - '*.badhouseplants.net'
+          port:
+            name: grpc-web
+            number: 8080
+            protocol: HTTPS
+          tls:
+            credentialName: badhouseplants-wildcard-tls
+            mode: SIMPLE
+        - hosts:
+          - badhouseplants.net
+          - '*.badhouseplants.net'
+          port:
+            name: http
+            number: 80
+            protocol: HTTP2
+          tls:
+            httpsRedirect: true
+        - hosts:
+          - badhouseplants.net
+          - '*.badhouseplants.net'
+          port:
+            name: https
+            number: 443
+            protocol: HTTPS
+          tls:
+            credentialName: badhouseplants-wildcard-tls
+            mode: SIMPLE
+    - name: nrodionov-info
+      servers:
+        - hosts:
+          - nrodionov.info
+          - dev.nrodionov.info
+          port:
+            name: http
+            number: 80
+            protocol: HTTP2
+          tls:
+            httpsRedirect: true
+        - hosts:
+          - nrodionov.info
+          - dev.nrodionov.info
+          port:
+            name: https
+            number: 443
+            protocol: HTTPS
+          tls:
+            credentialName: nrodionov-wildcard-tls
+            mode: SIMPLE
+    - name: badhouseplants-vpn
+      servers:
+        - hosts:
+          - '*'
+          port:
+            name: tcp
+            number: 1194
+            protocol: TCP
+    - name: badhouseplants-ssh
+      servers:
+        - hosts:
+          - '*'
+          port:
+            name: ssh
+            number: 22
+            protocol: TCP
+    - name: badhouseplants-minecraft
+      servers:
+        - hosts:
+          - '*'
+          port:
+            name: minecraft
+            number: 25565
+            protocol: TCP
--- a/badhouseplants/values/values.istio-ingressgateway.yaml
+++ b/badhouseplants/values/values.istio-ingressgateway.yaml
@ -1,7 +1,11 @@
---
 service:
  type: LoadBalancer
+  externalTrafficPolicy: Local
  ports:
+    - name: shadowsocks
+      port: 8388
+      protocol: TCP
+      targetPort: 8388
    - name: minecraft
      port: 25565
      protocol: TCP
@ -14,6 +18,10 @@ service:
      port: 80
      protocol: TCP
      targetPort: 80
+    - name: grpc-web
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
    - name: https
      port: 443
      protocol: TCP
--- a/badhouseplants/values/values.istiod.yaml
+++ b/badhouseplants/values/values.istiod.yaml
@ -8,7 +8,7 @@ global:
  proxy:
    resources:
      requests:
-        cpu: 100m
+        cpu: 20m
        memory: 128Mi
      limits:
        memory: 128Mi
--- a/badhouseplants/values/values.local-path-provisioner.yaml
+++ b/badhouseplants/values/values.local-path-provisioner.yaml
@ -0,0 +1,3 @@
+storageClass:
+  create: true
+  defaultClass: false
--- a/badhouseplants/values/values.loki.yaml
+++ b/badhouseplants/values/values.loki.yaml
@ -1,11 +1,99 @@
 ---
-singleBinary:
-  replicas: 1
+global:
+  dnsService: "coredns"
+
 loki:
  auth_enabled: false
  commonConfig:
    replication_factor: 1
+  storage:
+    type: 'filesystem'
+  commonConfig:
+    replication_factor: 1
+  schemaConfig:
+    configs:
+      - from: 2024-04-01
+        store: tsdb
+        object_store: s3
+        schema: v13
+        index:
+          prefix: loki_index_
+          period: 24h
+  ingester:
+    chunk_encoding: snappy
+  tracing:
+    enabled: true
+  querier:
+    # Default is 4, if you have enough memory and CPU you can increase, reduce if OOMing
+    max_concurrent: 2
+
 compactor:
  retention_enabled: true
 limits_config:
-  retention_period: 2d
+  retention_period: 14d
+
+monitoring:
+  selfMonitoring:
+    enabled: false
+  lokiCanary:
+    enabled: false
+
+#gateway:
+#  ingress:
+#    enabled: true
+#    hosts:
+#      - host: FIXME
+#        paths:
+#          - path: /
+#            pathType: Prefix
+
+deploymentMode: SingleBinary
+singleBinary:
+  persistence:
+    size: 5Gi
+  replicas: 1
+  resources:
+    limits:
+      cpu: 1
+      memory: 1Gi
+    requests:
+      cpu: 0.5
+      memory: 512Mi
+  extraEnv:
+    # Keep a little bit lower than memory limits
+    - name: GOMEMLIMIT
+      value: 3750MiB
+
+chunksCache:
+  # default is 500MB, with limited memory keep this smaller
+  writebackSizeLimit: 10MB
+
+minio:
+  enabled: false
+
+# Zero out replica counts of other deployment modes
+backend:
+  replicas: 0
+read:
+  replicas: 0
+write:
+  replicas: 0
+
+ingester:
+  replicas: 0
+querier:
+  replicas: 0
+queryFrontend:
+  replicas: 0
+queryScheduler:
+  replicas: 0
+distributor:
+  replicas: 0
+compactor:
+  replicas: 0
+indexGateway:
+  replicas: 0
+bloomCompactor:
+  replicas: 0
+bloomGateway:
+  replicas: 0
--- a/badhouseplants/values/values.longhorn.yaml
+++ b/badhouseplants/values/values.longhorn.yaml
@ -1,13 +1,14 @@
 defaultSettings:
-  backupTarget: s3://longhorn@us-east1/backupstore 
+  backupTarget: s3://longhorn@us-east1/backupstore
  backupTargetCredentialSecret: aws-secret
  guaranteedEngineManagerCPU: 6
  guaranteedReplicaManagerCPU: 6
  storageOverProvisioningPercentage: 300
  storageMinimalAvailablePercentage: 5
-  defaultDataPath: /media-longhorn
+  storageReservedPercentageForDefaultDisk: 1
+  defaultDataPath: /media/longhorn
 csi:
-  kubeletRootDir: /var/snap/microk8s/common/var/lib/kubelet
+  kubeletRootDir: /var/lib/kubelet/
 persistence:
  defaultClassReplicaCount: 1
 enablePSP: false
--- a/badhouseplants/values/values.mailu.yaml
+++ b/badhouseplants/values/values.mailu.yaml
@ -1,81 +1,64 @@
 ---
-certificate: 
+# ------------------------------------------
+# -- Database extension is used to manage
+# --  database with db-operator
+# ------------------------------------------
+ext-database:
  enabled: true
-  certificate: 
-    - name: mailu
-      secretName: mailu-certificate
-      issuer:
-        kind: ClusterIssuer
-        name: badhouseplants-issuer
-      dnsNames:
-        - badhouseplants.net
-        - "email.badhouseplants.net"
+  name: mailu-postgres16
+  instance: postgres16
+  extraDatabase:
+    enabled: true
+    name: roundcube-postgres16
+    instance: postgres16
+
 # ------------------------------------------
 # -- Istio extenstion. Just because I'm
 # --  not using ingress nginx
 # ------------------------------------------
-istio:
+traefik:
  enabled: true
-  istio:
-    - name: mailu-web
-      kind: http
-      gateway: badhouseplants-net
-      hostname: email.badhouseplants.net
+  tcpRoutes:
+    - name: mailu-smtp
      service: mailu-front
-      port: 80
-    # - name: mailu-smpt
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # service: mailu-front
-      # hostname: email.badhousplants.net
-      # port_match: 25
-      # port: 25
-    # - name: mailu-smpts
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # port_match: 465
-      # hostname: email.badhousplants.net
-      # service: mailu-front
-      # port: 465
-    # - name: mailu-smpt-startls
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # hostname: email.badhousplants.net
-      # port_match: 587
-      # service: mailu-front
-      # port: 587
-    # - name: mailu-imap
-      # kind: tcp
-      # hostname: email.badhousplants.net
-      # gateway: badhouseplants-mail
-      # port_match: 143
-      # service: mailu-front
-      # port: 143
-    # - name: mailu-imaps
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # hostname: email.badhousplants.net
-      # port_match: 993
-      # service: mailu-front
-      # port: 993
-    # - name: mailu-pop3
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # port_match: 110
-      # hostname: email.badhousplants.net
-      # service: mailu-front
-      # port: 110
-    # - name: mailu-pop3s
-      # kind: tcp
-      # gateway: badhouseplants-mail
-      # port_match: 993
-      # hostname: email.badhousplants.net
-      # service: mailu-front
-      # port: 993
-subnet: 10.1.0.0/16
+      match: HostSNI(`*`)
+      entrypoint: smtp
+      port: 25
+    - name: mailu-smtps
+      match: HostSNI(`*`)
+      service: mailu-front
+      entrypoint: smtps
+      port: 465
+    - name: mailu-smpt-startls
+      match: HostSNI(`*`)
+      service: mailu-front
+      entrypoint: smtp-startls
+      port: 587
+    - name: mailu-imap
+      match: HostSNI(`*`)
+      service: mailu-front
+      entrypoint: imap
+      port: 143
+    - name: mailu-imaps
+      match: HostSNI(`*`)
+      service: mailu-front
+      entrypoint: imaps
+      port: 993
+    - name: mailu-pop3
+      match: HostSNI(`*`)
+      service: mailu-front
+      entrypoint: pop3
+      port: 110
+    - name: mailu-pop3s
+      match: HostSNI(`*`)
+      service: mailu-front
+      entrypoint: pop3s
+      port: 993
+subnet: 10.244.0.0/16
 sessionCookieSecure: true
 hostnames:
-  - post.badhouseplants.net
+  - badhouseplants.net
+  - email.badhouseplants.net
 domain: badhouseplants.net
 persistence:
  single_pvc: false
@ -85,11 +68,20 @@ limits:
 tls:
  outboundLevel: secure
 ingress:
-  enabled: false
-  tls: false
+  enabled: true
+  ingressClassName: traefik
+  tls: true
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
  tlsFlavorOverride: mail
-  selfSigned: false
-  existingSecret: mailu-certificate
+  realIpFrom: traefik.kube-system.svc.cluster.local
+  realIpHeader: "X-Real-IP"
+front:
+  hostPort:
+    enabled: false
 admin:
  resources:
    requests:
@ -107,9 +99,10 @@ redis:
      cpu: 70m
    limits:
      memory: 200Mi
-      cpu: 200m 
-  persistence:
-    size: 1Gi
+      cpu: 200m
+  master:
+    persistence:
+      enabled: false
 postfix:
  resources:
    requests:
@ -117,7 +110,7 @@ postfix:
      cpu: 200m
    limits:
      memory: 1024Mi
-      cpu: 200m 
+      cpu: 200m
  persistence:
    size: 1Gi
 dovecot:
@ -128,7 +121,7 @@ dovecot:
      cpu: 70m
    limits:
      memory: 400Mi
-      cpu: 300m 
+      cpu: 300m
  persistence:
    size: 1Gi
 roundcube:
@ -138,26 +131,24 @@ roundcube:
      cpu: 70m
    limits:
      memory: 200Mi
-      cpu: 200m 
+      cpu: 200m
  persistence:
    size: 1Gi
 mysql:
  enabled: false
 postgresql:
+  enabled: false
+## If using the built-in MariaDB or PostgreSQL, the `roundcube` database will be created automatically.
+externalDatabase:
+  ## @param externalDatabase.enabled Set to true to use an external database
  enabled: true
-  auth:
-    enablePostgresUser: true
-    username: mailu
-    database: mailu
-  persistence:
-    enabled: false
-    storageClass: ""
-    accessMode: ReadWriteOnce
-    size: 2Gi
-front:
-  logLevel: DEBUG
-  hostPort:
-    enabled: true
+  type: postgresql
+  existingSecret: mailu-postgres16-creds
+  existingSecretDatabaseKey: POSTGRES_DB
+  existingSecretUsernameKey: POSTGRES_USER
+  existingSecretPasswordKey: POSTGRES_PASSWORD
+  host: postgres16-postgresql.database-service.svc.cluster.local
+  port: 5432
 rspamd:
  resources:
    requests:
@ -166,7 +157,7 @@ rspamd:
    limits:
      memory: 500Mi
      cpu: 400m
-  startupProbe: 
+  startupProbe:
    periodSeconds: 30
    failureThreshold: 900
    timeoutSeconds: 20
@ -179,3 +170,10 @@ webmail:
    accessModes: [ReadWriteOnce]
    claimNameOverride: ""
    annotations: {}
+global:
+  database:
+    roundcube:
+      database: applications-roundcube-postgres16
+      username: applications-roundcube-postgres16
+      existingSecret: roundcube-postgres16-creds
+      existingSecretPasswordKey: POSTGRES_PASSWORD
--- a/badhouseplants/values/values.metallb-resources.yaml
+++ b/badhouseplants/values/values.metallb-resources.yaml
@ -0,0 +1,5 @@
+metallb:
+  enabled: true
+  ippools:
+    - name: fuji
+      addresses: 195.201.249.91-195.201.249.91
--- a/badhouseplants/values/values.minecraft.yaml
+++ b/badhouseplants/values/values.minecraft.yaml
@ -1,115 +0,0 @@
---
-# --------------------------------------------------
-# -- Extensions values
-# --------------------------------------------------
-service-account:
-  enabled: true
-  resources:
-    - name: minecraft-exporter
-      label:
-        app: minecraft-minecraft-metrics
-      endpoints:
-        port: metrics
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: minecraft-tcp
-      gateway: badhouseplants-minecraft
-      kind: tcp
-      port_match: 25565
-      hostname: "*"
-      service: minecraft-minecraft
-      port: 25565
-# --------------------------------------------------
-# -- Main values
-# --------------------------------------------------
-image:
-  tag: java17-graalvm-ce
-  pullPolicy: Always
-resources:
-  requests:
-    memory: 512Mi
-    cpu: 50m
-  limits:
-    memory: 3Gi
-
-lifecycle:
-  postStart:
-    - bash
-    - -c
-    - for i in {1..100}; do mc-health && break || sleep 20; done && mc-send-to-console setpassword 11223345
-readinessProbe:
-  command:
-    - mc-health
-  periodSeconds: 20
-  failureThreshold: 50
-  timeoutSeconds: 10
-livenessProbe:
-  timeoutSeconds: 10
-minecraftServer:
-  eula: "TRUE"
-  onlineMode: false
-  difficulty: hard
-  hardcore: true
-  version: 1.20.1
-  maxWorldSize: 90000
-  type: "PAPER"
-  paperDownloadUrl: https://api.papermc.io/v2/projects/paper/versions/1.20.1/builds/100/downloads/paper-1.20.1-100.jar
-  gameMode: survival
-  pvp: true
-  memory: 2512M
-  extraPorts:
-    - name: metrics
-      containerPort: 9225
-      protocol: TCP
-      service:
-        enabled: true
-        embedded: false
-        labels:
-          exporter: minecraft
-        type: ClusterIP
-        port: 9925
-      ingress:
-        enabled: false
-persistence:
-  dataDir:
-    enabled: true
-    Size: 15Gi
-initContainers:
-  - name: install-prometheus-exporter
-    image: alpine/curl
-    command:
-      - curl
-      - -L
-      - "https://github.com/sladkoff/minecraft-prometheus-exporter/releases/download/v2.5.0/minecraft-prometheus-exporter-2.5.0.jar"
-      - -o
-      - /data/plugins/prometheus-exporter.jar
-    volumeMounts:
-      - name: plugins
-        mountPath: /data/plugins
-        readOnly: false
-  - name: install-password-plugin
-    image: alpine/curl
-    command:
-      - curl
-      - -L
-      - "https://github.com/timbru31/PasswordProtect/releases/download/PasswordProtect-3.1.0/PasswordProtect.jar"
-      - -o
-      - /data/plugins/PasswordProtect.jar
-    volumeMounts:
-      - name: plugins
-        mountPath: /data/plugins
-        readOnly: false
-extraVolumes:
-  - volumeMounts:
-      - name: plugins
-        mountPath: /data/plugins
-        readOnly: false
-    volumes:
-      - name: plugins
-        emptyDir:
-          sizeLimit: 500Mi
--- a/badhouseplants/values/values.minio.yaml
+++ b/badhouseplants/values/values.minio.yaml
@ -7,18 +7,51 @@ istio:
  enabled: true
  istio:
    - name: minio-http
-      gateway: badhouseplants-net
+      gateway: istio-system/badhouseplants-net
      kind: http
      hostname: minio.badhouseplants.net
      service: minio-console
      port: 9001
    - name: s3-http
-      gateway: badhouseplants-net
+      gateway: istio-system/badhouseplants-net
      kind: http
      hostname: s3.badhouseplants.net
      service: minio
      port: 9000

+ingress:
+  enabled: true
+  ingressClassName: ~
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  path: /
+  hosts:
+    - s3.badhouseplants.net
+  tls:
+    - secretName: s3-tls-secret
+      hosts:
+        - s3.badhouseplants.net
+consoleIngress:
+  enabled: true
+  ingressClassName: ~
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  path: /
+  hosts:
+    - minio.badhouseplants.net
+  tls:
+    - secretName: minio-tls-secret
+      hosts:
+        - minio.badhouseplants.net
+
 rootUser: 'overlord'
 replicas: 1
 mode: standalone
@ -64,11 +97,6 @@ buckets:
  - name: allanger-music
    policy: download
    purge: false
-    versioning: false
-  - name: badhouseplants-brew
-    policy: download
-    purge: false
-    versioning: false
 metrics:
  serviceMonitor:
    enabled: false
--- a/badhouseplants/values/values.mysql.yaml
+++ b/badhouseplants/values/values.mysql.yaml
@ -4,4 +4,3 @@ primary:

 auth:
  createDatabase: false
-  
--- a/badhouseplants/values/values.namespaces.yaml
+++ b/badhouseplants/values/values.namespaces.yaml
@ -1,11 +1,23 @@
---
-ns:
-  - name: monitoring-system
-templates:
-  - |
-    {{ range .Values.ns }}
-    apiVersion: v1
-    kind: Namespace
-    metadata:
-      name: {{ .name }}
-    {{ end }}
+namespaces:
+  - name: longhorn-system
+  - name: minio-service
+  - name: argo-system
+  - name: nrodionov-application
+  - name: minecraft-application
+    annotations:
+      badohouseplants.net/git-repo: |
+        https://git.badhouseplants.net/badhouseplants/minecraft-helmfile
+      badhouseplants.net/ci: |
+        https://ci.badhouseplants.net/repos/15
+  - name: gitea-service
+  - name: funkwhale-application
+  - name: database-service
+  - name: mail-service
+  - name: vaultwarden-application
+  - name: woodpecker-ci
+  - name: openvpn-service
+  - name: badhouseplants-main
+    labels:
+      istio-injection: enabled
+  - name: badhouseplants-preview
+  - name: kube-services
--- a/badhouseplants/values/values.nrodionov.yaml
+++ b/badhouseplants/values/values.nrodionov.yaml
@ -7,7 +7,7 @@ istio:
  enabled: true
  istio:
    - name: nrodionov-http
-      gateway: nrodionov-info
+      gateway: istio-system/nrodionov-info
      kind: http
      hostname: dev.nrodionov.info
      service: nrodionov-wordpress
@ -17,7 +17,20 @@ ext-database:
  enabled: true
  name: nrodionov-mysql
  instance: mysql
-
+ingress:
+  enabled: true
+  pathType: ImplementationSpecific
+  hostname: dev.nrodionov.info
+  path: /
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  tls: true
+  tlsWwwPrefix: false
+  selfSigned: false
 wordpressBlogName: Николай Николаевич Родионов
 wordpressUsername: admin
 wordpressFirstName: Nikolai
--- a/badhouseplants/values/values.openvpn-xor.yaml
+++ b/badhouseplants/values/values.openvpn-xor.yaml
@ -0,0 +1,46 @@
+---
+# ------------------------------------------
+# -- Istio extenstion. Just because I'm
+# --  not using ingress nginx
+# ------------------------------------------
+# istio:
+  # enabled: true
+  # istio:
+    # - name: openvpn-tcp-xor
+      # gateway: istio-system/badhouseplants-vpn
+      # kind: tcp
+      # port_match: 1194
+      # hostname: "*"
+      # service: openvpn-xor
+      # port: 1194
+# ------------------------------------------
+traefik:
+  enabled: true
+  tcpRoutes:
+    - name: openvpn-xor
+      service: openvpn-xor
+      match: HostSNI(`*`)
+      entrypoint: openvpn
+      port: 1194
+
+storage:
+  class: longhorn
+  size: 512Mi
+
+openvpn:
+  proto: tcp
+  host: 195.201.249.91
+
+easyrsa:
+  cn: Bad Houseplants
+  country: Germany
+  province: NRW
+  city: Duesseldorf
+  org: Bad Houseplants
+  email: allanger@zohomail.com
+
+service:
+  type: ClusterIP
+  port: 1194
+  targetPort: 1194
+  protocol: TCP
--- a/badhouseplants/values/values.openvpn.yaml
+++ b/badhouseplants/values/values.openvpn.yaml
@ -1,24 +0,0 @@
---
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: openvpn-tcp
-      gateway: badhouseplants-vpn
-      kind: tcp
-      port_match: 1194
-      hostname: "*"
-      service: openvpn
-      port: 1194
-
-storageClassName: longhorn
-openvpn:
-  server: "tcp://195.201.250.50:1194"
-service:
-  type: ClusterIP
-  port: 1194
-  targetPort: 1194
-  protocol: TCP
--- a/badhouseplants/values/values.postgres16.yaml
+++ b/badhouseplants/values/values.postgres16.yaml
@ -0,0 +1,27 @@
+architecture: standalone
+
+auth:
+  database: postgres
+
+persistence:
+  size: 1Gi
+
+metrics:
+  enabled: false
+primary:
+  podSecurityContext:
+    enabled: true
+    fsGroupChangePolicy: Always
+    sysctls: []
+    supplementalGroups: []
+  containerSecurityContext:
+    enabled: true
+    seLinuxOptions: {}
+    runAsNonRoot: false
+    privileged: false
+    readOnlyRootFilesystem: false
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    seccompProfile:
+      type: "RuntimeDefault"
--- a/badhouseplants/values/values.prometheus.yaml
+++ b/badhouseplants/values/values.prometheus.yaml
@ -7,7 +7,7 @@ istio:
  enabled: true
  istio:
    - name: grafana-https
-      gateway: badhouseplants-net
+      gateway: istio-system/badhouseplants-net
      kind: http
      hostname: "grafana.badhouseplants.net"
      service: prometheus-grafana
@ -64,7 +64,8 @@ defaultRules:
 prometheus:
  prometheusSpec:
    enableAdminAPI: true
-    retentionSize: 10GB
+    retentionSize: 7GB
+    retention: 20d
    podMonitorNamespaceSelector:
      any: true
    podMonitorSelector: {}
@ -83,9 +84,10 @@ prometheus:
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
-              storage: 10Gi
+              storage: 12Gi

 grafana:
+  assertNoLeakedSecrets: false
  persistence:
    enabled: true
    size: 2Gi
--- a/badhouseplants/values/values.promtail.yaml
+++ b/badhouseplants/values/values.promtail.yaml
@ -3,3 +3,9 @@ config:
  clients:
    #    - url: http://loki.monitoring-system:3100
    - url: http://loki-gateway/loki/api/v1/push
+  snippets:
+    pipelineStages:
+      - match:
+          pipeline_name: "drop-all"
+          selector: '{namespace!~"mail-service|woodpecker|minecraft-application"}'
+          action: drop
--- a/badhouseplants/values/values.redis.yaml
+++ b/badhouseplants/values/values.redis.yaml
@ -1,7 +1,11 @@
 metrics:
  enabled: false

+secretAnnotations:
+  reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+  reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+  reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "gitea-service,funkwhale-application"
 architecture: standalone
 master:
  persistence:
-    enabled: false
+    enabled: false
--- a/badhouseplants/values/values.roles.yaml
+++ b/badhouseplants/values/values.roles.yaml
@ -0,0 +1,9 @@
+roles:
+  - name: minecraft-admin
+    namespace: minecraft-application
+    kind: Role
+    rules:
+      - apiGroups: ["*"]
+        resources: ["*"]
+        verbs: ["*"]
+        namespace: ["minecraft-application"]
--- a/badhouseplants/values/values.tandoor.yaml
+++ b/badhouseplants/values/values.tandoor.yaml
@ -0,0 +1,55 @@
+istio:
+  enabled: true
+  istio:
+    - name: tandoor-http
+      gateway: istio-system/badhouseplants-net
+      kind: http
+      hostname: tandoor.badhouseplants.net
+      service: tandoor
+      port: 8080
+
+ext-database:
+  enabled: true
+  name: tandoor-postgres16
+  instance: postgres16
+  credentials:
+    POSTGRES_HOST: |-
+      "{{ .Hostname }}"
+    POSTGRES_PORT: |-
+      "{{ .Port }}"
+
+envFrom:
+  - secretRef:
+      name: tandoor-postgres16-creds
+env:
+  TZ: UTC
+  DB_ENGINE: django.db.backends.postgresql
+  EMAIL_HOST: badhouseplants.net
+  EMAIL_PORT: 587
+  EMAIL_HOST_USER: overlord@badhouseplants.net
+  EMAIL_HOST_PASSWORD: nxVa8Xcf4jNvzNeE$JzBL&H8g
+  EMAIL_USE_TLS: 1
+  EMAIL_USE_SSL: 0
+  DEFAULT_FROM_EMAIL: tandoor@badhouseplants.net
+persistence:
+  config:
+    enabled: true
+    retain: true
+    storageClass: longhorn
+    accessMode: ReadWriteOnce
+    size: 1Gi
+  media:
+    enabled: true
+    mountPath: /opt/recipes/mediafiles
+    retain: true
+    storageClass: longhorn
+    accessMode: ReadWriteOnce
+    size: 1Gi
+  static:
+    enabled: true
+    type: emptyDir
+    mountPath: /opt/recipes/staticfiles
+  django-js-reverse:
+    enabled: true
+    type: emptyDir
+    mountPath: /opt/recipes/cookbook/static/django_js_reverse
--- a/badhouseplants/values/values.traefik.yaml
+++ b/badhouseplants/values/values.traefik.yaml
@ -0,0 +1,78 @@
+globalArguments:
+  - "--serversTransport.insecureSkipVerify=true"
+service:
+  spec:
+    externalTrafficPolicy: Local
+ports:
+  git-ssh:
+    port: 22
+    expose:
+      default: true
+    exposedPort: 22
+    protocol: TCP
+  openvpn:
+    port: 1194
+    expose:
+      default: true
+    exposedPort: 1194
+    protocol: TCP
+  valve-server:
+    port: 27015
+    expose:
+      default: true
+    exposedPort: 27015
+    protocol: UDP
+  valve-rcon:
+    port: 27015
+    expose:
+      default: true
+    exposedPort: 27015
+    protocol: TCP
+  smtp:
+    port: 25
+    protocol: TCP
+    exposedPort: 25
+    expose:
+      default: true
+  smtps:
+    port: 465
+    protocol: TCP
+    exposedPort: 465
+    expose:
+      default: true
+  smtp-startls:
+    port: 587
+    protocol: TCP
+    exposedPort: 587
+    expose:
+      default: true
+  imap:
+    port: 143
+    protocol: TCP
+    exposedPort: 143
+    expose:
+      default: true
+  imaps:
+    port: 993
+    protocol: TCP
+    exposedPort: 993
+    expose:
+      default: true
+  pop3:
+    port: 110
+    protocol: TCP
+    exposedPort: 110
+    expose:
+      default: true
+  pop3s:
+    port: 995
+    protocol: TCP
+    exposedPort: 995
+    expose:
+      default: true
+  minecraft:
+    port: 25565
+    protocol: TCP
+    exposedPort: 25565
+    expose:
+      default: true
--- a/badhouseplants/values/values.vaultwarden.yaml
+++ b/badhouseplants/values/values.vaultwarden.yaml
@ -0,0 +1,80 @@
+---
+# ------------------------------------------
+# -- Istio extenstion. Just because I'm
+# --  not using ingress nginx
+# ------------------------------------------
+istio:
+  enabled: true
+  istio:
+    - name: vaultwarden-http
+      kind: http
+      gateway: istio-system/badhouseplants-net
+      hostname: vault.badhouseplants.net
+      service: vaultwarden
+      port: 8080
+# ------------------------------------------
+# -- Database extension is used to manage
+# --  database with db-operator
+# ------------------------------------------
+ext-database:
+  enabled: true
+  name: vaultwarden-postgres16
+  instance: postgres16
+service:
+  port: 8080
+vaultwarden:
+  smtp:
+    host: badhouseplants.net
+    security: "starttls"
+    port: 587
+    from: vaultwarden@badhouseplants.net
+    fromName: Vault Warden
+    authMechanism: "Plain"
+    acceptInvalidHostnames: "false"
+    acceptInvalidCerts: "false"
+    debug: false
+  domain: https://vault.badhouseplants.net
+  websocket:
+    enabled: true
+    address: "0.0.0.0"
+    port: 3012
+  rocket:
+    port: "8080"
+    workers: "10"
+  webVaultEnabled: "true"
+  signupsAllowed: false
+  invitationsAllowed: true
+  signupDomains: "https://vault.badhouseplants.com"
+  signupsVerify: "true"
+  showPassHint: "false"
+  database:
+    existingSecret: vaultwarden-postgres16-creds
+    existingSecretKey: CONNECTION_STRING
+    connectionRetries: 15
+    maxConnections: 10
+  storage:
+    enabled: true
+    size: 1Gi
+    class: longhorn
+    dataDir: /data
+  logging:
+    enabled: false
+    logfile: "/data/vaultwarden.log"
+    loglevel: "warn"
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  hosts:
+    - host: vault.badhouseplants.net
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: vault-tls-secret
+      hosts:
+        - vault.badhouseplants.net
--- a/badhouseplants/values/values.vaultwardentest.yaml
+++ b/badhouseplants/values/values.vaultwardentest.yaml
@ -0,0 +1,58 @@
+service:
+  port: 8080
+vaultwarden:
+  smtp:
+    host: mail.badhouseplants.net
+    security: "starttls"
+    port: 587
+    from: vaulttest@badhouseplants.net
+    fromName: Vault Warden
+    authMechanism: "Plain"
+    acceptInvalidHostnames: "false"
+    acceptInvalidCerts: "false"
+    debug: false
+  domain: https://vaulttest.badhouseplants.net
+  websocket:
+    enabled: true
+    address: "0.0.0.0"
+    port: 3012
+  rocket:
+    port: "8080"
+    workers: "10"
+  webVaultEnabled: "true"
+  signupsAllowed: true
+  invitationsAllowed: true
+  signupDomains: "https://vaulttest.badhouseplants.net"
+  signupsVerify: false
+  showPassHint: true
+  # database:
+    # existingSecret: vaultwarden-postgres16-creds
+    # existingSecretKey: CONNECTION_STRING
+    # connectionRetries: 15
+    # maxConnections: 10
+  storage:
+    enabled: true
+    size: 512Mi
+    class: longhorn
+    dataDir: /data
+  logging:
+    enabled: false
+    logfile: "/data/vaultwarden.log"
+    loglevel: "warn"
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  hosts:
+    - host: vaulttest.badhouseplants.net
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: vault-tls-secret
+      hosts:
+        - vaulttest.badhouseplants.net
--- a/badhouseplants/values/values.woodpecker-ci.yaml
+++ b/badhouseplants/values/values.woodpecker-ci.yaml
@ -0,0 +1,71 @@
+# ------------------------------------------
+# -- Istio extenstion. Just because I'm
+# --  not using ingress nginx
+# ------------------------------------------
+istio:
+  enabled: true
+  istio:
+    - name: woodpecker-server-http
+      gateway: istio-system/badhouseplants-net
+      kind: http
+      hostname: ci.badhouseplants.net
+      service: woodpecker-ci-server
+      port: 80
+ext-database:
+  enabled: true
+  name: woodpecker-postgres16
+  instance: postgres16
+  credentials:
+    WOODPECKER_DATABASE_DATASOURCE: "postgres://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{ .Port }}/{{ .Database }}?sslmode=disable"
+server:
+  ingress:
+    enabled: true
+    annotations:
+      kubernetes.io/ingress.class: traefik
+      kubernetes.io/tls-acme: "true"
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.global-static-ip-name: ""
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+    hosts:
+      - host: ci.badhouseplants.net
+        paths:
+          - path: /
+    tls:
+      - secretName: woodpecker-tls-secret
+        hosts:
+          - ci.badhouseplants.net
+  #image:
+  #  registry: git.badhouseplants.net
+  #  repository: allanger/woodpecker-server
+  #  pullPolicy: Always
+  #  tag: icon
+  enabled: true
+  env:
+    WOODPECKER_GITEA: true
+    WOODPECKER_GITEA_URL: https://git.badhouseplants.net
+    WOODPECKER_DATABASE_DRIVER: postgres
+    WOODPECKER_GITEA_CLIENT: ab5e4687-a476-4668-9fbc-288d54095634
+    WOODPECKER_OPEN: true
+    WOODPECKER_ADMIN: "woodpecker,allanger"
+    WOODPECKER_HOST: "https://ci.badhouseplants.net"
+    WOODPECKER_ESCALATE: true
+    WOODPECKER_BACKEND_K8S_NAMESPACE: woodpecker-ci
+  extraSecretNamesForEnvFrom:
+    - woodpecker-postgres16-creds
+agent:
+  #image:
+  #  registry: git.badhouseplants.net
+  #  repository: allanger/woodpecker-agent
+  #  pullPolicy: Always
+  #  tag: dev
+  enabled: true
+  extraSecretNamesForEnvFrom: []
+  env:
+    WOODPECKER_SERVER: woodpecker-ci-server:9000
+    WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 3Gi
+    WOODPECKER_BACKEND_K8S_NAMESPACE: woodpecker-ci
+    WOODPECKER_BACKEND_K8S_STORAGE_CLASS: longhorn
+  serviceAccount:
+    create: true
+  rbac:
+    create: true
--- a/badhouseplants/values/values.zot.yaml
+++ b/badhouseplants/values/values.zot.yaml
@ -0,0 +1,47 @@
+ingress:
+  enabled: true
+  className: ~
+  annotations: 
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  pathtype: ImplementationSpecific
+  hosts:
+    - host: registry.badhouseplants.net
+      paths:
+        - path: /
+  tls: 
+    - secretName: zot-secret-tls
+      hosts:
+        - registry.badhouseplants.net
+strategy:
+  type: Recreate
+service:
+  type: ClusterIP
+persistence: true
+pvc:
+  create: true
+  accessMode: "ReadWriteOnce"
+  storage: 5Gi
+  storageClassName: longhorn
+mountConfig: true
+mountSecret: true
+  #configFiles:
+  #  ui.json: |-
+  #    {
+  #      "log": {
+  #        "level": "info"
+  #      },
+  #      "extensions": {
+  #        "search": {
+  #          "cve": {
+  #            "updateInterval": "2h"
+  #          }
+  #        },
+  #        "ui": {
+  #          "enable": true
+  #        }
+  #      }
+  #    }
--- a/charts/namespaces/chart/.helmignore
+++ b/charts/namespaces/chart/.helmignore
@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
--- a/charts/namespaces/chart/Chart.yaml
+++ b/charts/namespaces/chart/Chart.yaml
@ -0,0 +1,24 @@
+apiVersion: v2
+name: namespaces
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"
--- a/charts/namespaces/chart/templates/_helpers.tpl
+++ b/charts/namespaces/chart/templates/_helpers.tpl
@ -0,0 +1,43 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "namespaces.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "namespaces.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "namespaces.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "namespaces.labels" -}}
+helm.sh/chart: {{ include "namespaces.chart" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
--- a/charts/namespaces/chart/templates/namespaces.yaml
+++ b/charts/namespaces/chart/templates/namespaces.yaml
@ -0,0 +1,19 @@
+{{- if .Values.namespaces }}
+{{- range $ns := .Values.namespaces }}
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ $ns.name }}
+  labels:
+    {{- include "namespaces.labels" $ | nindent 4 }}
+    {{- with $ns.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations:
+    "helm.sh/resource-policy": keep
+    {{- with $ns.annotations}}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
--- a/charts/namespaces/chart/values.yaml
+++ b/charts/namespaces/chart/values.yaml
@ -0,0 +1,20 @@
+namespaces:
+  - name: giantswarm-flux
+    labels:
+      name: giantswarm-flux
+  - name: giantswarm
+    labels:
+      name: giantswarm
+  - name: monitoring
+    labels:
+      name: monitoring
+  - name: org-giantswarm
+    labels:
+      name: org-giantswarm
+  - name: flux-system
+    labels:
+      name: flux-system
+  - name: flux-giantswarm
+    labels:
+      name: flux-giantswarm
+  - name: policy-exception
--- a/charts/namespaces/kustomize/flux-system.yml
+++ b/charts/namespaces/kustomize/flux-system.yml
@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flux-system
+  labels:
+    name: flux-system
--- a/charts/namespaces/kustomize/giantswarm-flux.yml
+++ b/charts/namespaces/kustomize/giantswarm-flux.yml
@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: giantswarm-flux
+  labels:
+    name: giantswarm-flux
--- a/charts/namespaces/kustomize/giantswarm.yml
+++ b/charts/namespaces/kustomize/giantswarm.yml
@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: giantswarm
+  labels:
+    name: giantswarm
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Devops Bot	9963b01d97	Add renovate.json	2024-09-11 14:23:48 +00:00
Nikolai Rodionov	14dbe234ea	Cleanup namespaces	2024-06-22 13:28:53 +02:00
Nikolai Rodionov	697e5f3746	Add a storage to the vaultwarden test	2024-06-21 17:23:33 +02:00
Nikolai Rodionov	d6d93998cb	Update traefik	2024-06-15 20:45:50 +02:00
Nikolai Rodionov	6c83d67c9c	Huge upgraqde to everything	2024-06-15 12:20:06 +02:00
Nikolai Rodionov	10d7936625	Update releases	2024-05-18 15:36:38 +02:00
Nikolai Rodionov	21f198b0fa	Increase Gitea disk	2024-05-13 11:39:57 +02:00
Nikolai Rodionov	5d4eae3152	Some updates to the config	2024-05-11 20:52:58 +02:00
Nikolai Rodionov	262417f1cf	A lot of updates and disable loki	2024-04-20 13:51:38 +02:00
Nikolai Rodionov	ff0f34551a	Update charts	2024-04-01 11:31:15 +02:00
Nikolai Rodionov	bcab058394	Init helmule config	2024-03-26 22:25:21 +01:00
Nikolai Rodionov	c4dd8bd6e4	Install zot	2024-03-26 21:48:31 +01:00
Nikolai Rodionov	ba7a32a17f	Instll zot	2024-03-24 13:44:22 +01:00
Nikolai Rodionov	a47775d835	Update charts	2024-03-24 13:42:13 +01:00
Nikolai Rodionov	8a85d32722	Update releases	2024-03-22 11:16:58 +01:00
Nikolai Rodionov	2211d9b388	Update charts	2024-03-11 11:16:03 +01:00
Nikolai Rodionov	97117aa3f2	Update dbinstances	2024-02-29 16:04:12 +01:00
Nikolai Rodionov	630819f887	Fix ArgoCD oauth	2024-02-23 00:47:38 +01:00
Nikolai Rodionov	773b70bb3a	Udpate values	2024-02-22 22:15:27 +01:00
Nikolai Rodionov	e255ee4e99	Remove minecraft from the repo	2024-02-21 00:50:11 +01:00
Nikolai Rodionov	9b8c729d65	Update sops file	2024-02-21 00:36:23 +01:00
Nikolai Rodionov	c5ade9c28b	Update longhorn and openvpn	2024-02-21 00:08:14 +01:00
Nikolai Rodionov	b93d4e0b2b	Update bunch of releases	2024-02-21 00:03:04 +01:00
Nikolai Rodionov	cc1cf4e650	Update cilium	2024-02-20 23:48:21 +01:00
Nikolai Rodionov	3c8f6a243c	Update istio bundle	2024-02-20 23:44:23 +01:00
Nikolai Rodionov	5b478e594e	Cleanup the backup cluster	2024-02-20 23:44:08 +01:00
Nikolai Rodionov	fbf483cfc0	Update openvpn	2024-02-20 16:26:35 +01:00
Nikolai Rodionov	a20017c9b7	Start setting up shadowsocks	2024-02-20 15:44:31 +01:00
Nikolai Rodionov	a6b30b3337	Cleanup db-operator	2024-02-17 02:20:54 +01:00
Nikolai Rodionov	4d5ee1f6c5	Update db-operator	2024-02-16 15:51:18 +01:00
Nikolai Rodionov	21ff595d40	Some small chagnes	2024-02-16 15:47:14 +01:00
Nikolai Rodionov	d67cf1a273	Add new ns	2024-02-13 15:49:31 +01:00
Nikolai Rodionov	99972808b7	Increase limits	2024-02-11 09:00:05 +01:00
Nikolai Rodionov	1cb2c5f259	Increase limits	2024-02-11 08:57:07 +01:00
Nikolai Rodionov	f4c9224ae6	Enable limits and store minecraft logs	2024-02-11 08:39:37 +01:00
Nikolai Rodionov	fb6a016b66	Revert "[Minecraft] Password plugin update" This reverts commit `0591ae21ce`.	2024-02-10 22:00:32 +01:00
Roman	0591ae21ce	[Minecraft] Password plugin update	2024-02-10 23:46:29 +03:00
Nikolai Rodionov	b1f183d712	Updates after the disaster recovery	2024-02-10 19:12:55 +01:00
Nikolai Rodionov	9c7e44e757	Sync after the disaster recovery	2024-02-04 09:31:09 +01:00
Nikolai Rodionov	9cf8656ba5	Fix the cluster	2024-01-26 16:53:34 +01:00
Nikolai Rodionov	896e939c2d	Fix the gitea-allanger repo	2024-01-22 08:49:03 +01:00
Nikolai Rodionov	25ea4c4254	Fix the push workflow	2024-01-22 08:36:36 +01:00
Nikolai Rodionov	a95c4a9406	Update the email workflow	2024-01-22 08:35:56 +01:00
Nikolai Rodionov	0f533964ea	Some updates	2024-01-20 11:57:09 +01:00
Nikolai Rodionov	238231bdc8	Update release	2024-01-11 04:37:37 +01:00
Nikolai Rodionov	2c33823d90	Use longhorn for vaultwarden	2024-01-06 21:50:12 +01:00
Nikolai Rodionov	5b7fd5117e	Install Tandoor	2024-01-06 21:16:12 +01:00
Nikolai Rodionov	5236fd1cd7	Update releases	2024-01-06 06:29:15 +01:00
Nikolai Rodionov	dd6db7b7cd	Update releases	2024-01-06 05:03:34 +01:00
Nikolai Rodionov	aa101786e0	Enable storage for Vaultwarden	2024-01-04 11:19:28 +01:00
Nikolai Rodionov	18b8a3ec56	Upgrade db-operator	2024-01-03 21:01:47 +01:00
Nikolai Rodionov	41ff1dadbf	Upgrade vaultwarden	2024-01-03 14:55:12 +01:00
Nikolai Rodionov	af37b8011b	Update db-oeprator version	2024-01-03 11:11:24 +01:00
Nikolai Rodionov	106c701ce1	Fix etersoft cluster's config	2024-01-01 13:56:35 +01:00
Nikolai Rodionov	afed983626	Update OpenVPN	2024-01-01 13:50:42 +01:00
Nikolai Rodionov	e54ea10a13	Use dev woodpecker image	2023-12-26 13:21:25 +01:00
Nikolai Rodionov	1a7066aa7d	Update smtp password in vaultwarden	2023-12-25 20:45:29 +01:00
Nikolai Rodionov	fb8a6f55f3	Start using reflector with Redis	2023-12-24 15:09:37 +01:00
Nikolai Rodionov	1ddab7a67f	Install reflector	2023-12-24 14:48:53 +01:00
Nikolai Rodionov	e2b0647c94	Use official woodpecker images	2023-12-22 16:26:11 +01:00
Nikolai Rodionov	91dfbedf64	Switch to woodpecker dev	2023-12-14 20:16:09 +01:00
Nikolai Rodionov	04534d43d7	Update db-operator	2023-12-13 09:55:58 +01:00
Nikolai Rodionov	31da33b9d9	Update releases	2023-12-13 09:47:00 +01:00
Nikolai Rodionov	f9c8716904	Use custom woodpecker image	2023-12-13 09:45:43 +01:00
Nikolai Rodionov	a4a64011e3	Increase Prometheus storage	2023-12-10 22:25:20 +01:00
Nikolai Rodionov	b675368776	Update retention config for Prometheus	2023-12-10 08:50:51 +01:00
Nikolai Rodionov	7365a42479	Udpate outdatec chart	2023-12-09 22:45:00 +01:00
Nikolai Rodionov	cb7188064a	Setup check-da-helm	2023-12-08 17:03:50 +01:00
Nikolai Rodionov	94f81a9213	Remove a strnage file	2023-12-08 14:11:02 +01:00
Nikolai Rodionov	a616f03d71	Re-install woodpecker	2023-12-08 14:10:32 +01:00
Nikolai Rodionov	30b59f6daa	Update outdated release	2023-12-07 12:35:38 +00:00
Nikolai Rodionov	234da9a023	Update woodpecker chart	2023-12-07 12:35:38 +00:00
Nikolai Rodionov	9c137f574d	Update woodpecker to 1.0.0	2023-12-07 12:35:38 +00:00
Nikolai Rodionov	35599488dd	Update woodpecker to 1.0.0	2023-12-07 12:35:38 +00:00
Nikolai Rodionov	a9dc7658b9	Fix certs	2023-12-07 13:34:01 +01:00
Nikolai Rodionov	663e29ebef	Update postgres	2023-11-26 15:34:08 +01:00
Nikolai Rodionov	f94338d176	Update some releases	2023-11-26 10:34:11 +01:00
Nikolai Rodionov	f57301153a	Use newer woodpecker	2023-11-19 10:30:01 +01:00
Nikolai Rodionov	4b364c9c18	Setup promtail and loki	2023-11-18 13:12:26 +01:00
Nikolai Rodionov	fd7813a840	chore: Upgrade important helm releases	2023-11-17 11:16:20 +01:00
Nikolai Rodionov	c1da28126d	chore: Upgrade some unimportant helm releases	2023-11-17 11:11:20 +01:00
Nikolai Rodionov	627f433ff1	chore: Upgrade some unimportant helm releases	2023-11-17 11:07:29 +01:00
Nikolai Rodionov	693169f963	chore: Upgrade istio	2023-11-17 11:02:07 +01:00
Nikolai Rodionov	4f258d9140	chore: Upgrade longhorn	2023-11-17 11:01:25 +01:00
Nikolai Rodionov	fb0d11beee	Add escalation to woodpecker	2023-11-14 08:38:24 +01:00
Nikolai Rodionov	ff64516cf7	Update charts	2023-11-12 22:19:26 +01:00
Nikolai Rodionov	4412cc5fbd	Update outdated releases	2023-11-08 15:15:41 +01:00
Nikolai Rodionov	76a7c5d4ef	Remove badhouseplants-brew bucket	2023-11-07 03:55:40 +01:00
Nikolai Rodionov	a9bf45dcef	Fix the image on the Etersoft VPN	2023-11-05 16:17:21 +01:00
Nikolai Rodionov	3a74881b27	Update sso for Minio Etersoft	2023-11-04 20:00:56 +01:00
Nikolai Rodionov	3a7df6e695	Use apply instead of sync in ci	2023-11-04 19:57:56 +01:00
Nikolai Rodionov	f4cbb2b5c5	Create etcd bucket in etersoft	2023-11-04 19:55:29 +01:00
Nikolai Rodionov	654731b7ef	Add some manifests for badhouseplants	2023-11-04 19:54:19 +01:00
Nikolai Rodionov	b9954063cb	Upgrade Longhorn	2023-11-04 13:54:32 +01:00
Nikolai Rodionov	e18424d98a	Enable indexer for Gitea	2023-10-30 16:07:26 +01:00
Nikolai Rodionov	f61ffc4161	Upgrade mail-server version	2023-10-30 13:26:00 +01:00
Nikolai Rodionov	4c55426441	Set a correct version for Argo	2023-10-29 14:57:24 +01:00
Nikolai Rodionov	4f42d4e73f	Disable cdh workflow	2023-10-29 10:56:21 +01:00
Nikolai Rodionov	fb90882fcc	Upgrade outdated releases	2023-10-29 10:55:28 +01:00
Nikolai Rodionov	164e4b2ffb	Increase Gitea disk	2023-10-23 08:27:52 +02:00
Nikolai Rodionov	cffa11820f	Update OpenVPN	2023-10-23 08:21:55 +02:00
Nikolai Rodionov	e1ce435597	Try the matrix build	2023-10-22 14:29:28 +02:00
Nikolai Rodionov	283bcc5cd2	Install and test woodpecker-ci	2023-10-22 13:17:41 +02:00
Nikolai Rodionov	eed6c898c5	Update outdated releases	2023-10-22 13:17:16 +02:00
Nikolai Rodionov	45e4555218	Update vaultwarden and fix some values	2023-10-20 21:52:24 +02:00
Nikolai Rodionov	871ceb8e06	Install vaultwarden	2023-10-20 21:42:57 +02:00
Nikolai Rodionov	5201e2a589	Fix broken helmfile	2023-10-20 07:40:46 +02:00
Nikolai Rodionov	63df23af17	Start managing gateways with helmfile	2023-10-17 14:56:57 +02:00
Nikolai Rodionov	250ee3ef26	Add some smtp settings	2023-10-15 17:21:49 +02:00
Nikolai Rodionov	212930ec1a	Install email server	2023-10-14 16:24:13 +02:00
Nikolai Rodionov	54a7dad780	Update releases and increase Gitea storage	2023-10-14 07:41:40 +02:00
Nikolai Rodionov	ccaba4e70d	Some updated to minecraft	2023-10-11 19:22:39 +02:00
Nikolai Rodionov	89df5ff10c	chore: Update Istio	2023-10-11 07:58:37 +02:00
Nikolai Rodionov	eaf3f3988d	Update Prometheus	2023-10-10 18:23:26 +02:00
Nikolai Rodionov	546d887d98	chore: Update outdated charts	2023-10-10 15:14:28 +02:00
RNRod	35eae889b2	Delete old postgres Issue: #116	2023-10-04 21:35:19 +02:00
RNRod	bf6685ce6d	Migrate funkwhale to postgres 16 Issue: #116	2023-10-04 21:31:06 +02:00
RNRod	0c7fbbd079	Migrate gitea to postgres 16 Issue: #116	2023-10-04 21:30:41 +02:00
RNRod	548700c1dd	Add a script for postgres migration Issue: #116	2023-10-04 21:28:48 +02:00
Nikolai Rodionov	b495f09261	chore: Install postgres 16	2023-10-04 04:34:39 +02:00
Nikolai Rodionov	b2e58102ce	upgrade some releases	2023-10-03 10:53:34 +02:00
Nikolai Rodionov	4843cdbedb	chore: Upgrade releases	2023-09-26 06:48:37 +02:00
Nikolai Rodionov	357dba4476	Disable backups for minecraft	2023-09-23 16:51:07 +02:00
Nikolai Rodionov	4739b983bc	Upgrade db-operator	2023-09-23 15:30:12 +02:00
Nikolai Rodionov	a941f7df16	Remove drone runner from the etersoft cluster	2023-09-22 10:29:40 +02:00
Nikolai Rodionov	63968337e2	add telegram notifications for outdated charts	2023-09-20 21:52:07 +02:00
Nikolai Rodionov	8cfd4bf88d	Use another redis db for funkwhale	2023-09-14 10:28:18 +02:00
Nikolai Rodionov	1d5e6f6d93	chore: Upgrade releases	2023-09-12 10:39:42 +02:00
Nikolai Rodionov	af236d75a1	chore: Update MetalLB	2023-09-09 05:06:14 +02:00
Nikolai Rodionov	b149d953f3	chore: Some updates that are not critical	2023-09-09 00:39:02 +02:00
Nikolai Rodionov	2cae97fccb	chore: Update drone	2023-09-09 00:08:38 +02:00
Nikolai Rodionov	a68bf4502a	Update minecraft config and Paper	2023-09-07 00:31:47 +02:00
Nikolai Rodionov	39893c3390	chore: Fix gitea version	2023-09-03 11:15:21 +02:00
Nikolai Rodionov	1c50200fa2	chore: Upgrade releases	2023-09-03 11:13:25 +02:00
Nikolai Rodionov	0d4f0c1053	Update backup setup	2023-08-24 21:35:08 +02:00
Nikolai Rodionov	2d8bb5ff39	Downgrade openvpn	2023-08-24 21:34:15 +02:00
Nikolai Rodionov	6aaeb5db0d	Add 'faster minecarts' to Minecraft again	2023-08-22 23:51:31 +02:00
Nikolai Rodionov	162b2dd602	Add 'faster minecarts' to Minecraft	2023-08-22 23:46:39 +02:00
Nikolai Rodionov	8183029ebd	Update outdated releases	2023-08-19 09:15:58 +02:00
Nikolai Rodionov	bb6617b58c	Update OpenVPN	2023-08-19 09:14:35 +02:00
Nikolai Rodionov	39160f7e66	Update db-operator chart to 1.10.0	2023-08-17 11:10:47 +02:00
Nikolai Rodionov	e3760ca400	Migrate to the new openvpn setup	2023-08-16 20:55:56 +02:00
Nikolai Rodionov	15bbc19939	minecraft: Override server properties	2023-08-15 17:41:10 +02:00
Nikolai Rodionov	5ac35a5a60	Fix the name of restic repo	2023-08-15 17:27:55 +02:00
Nikolai Rodionov	12c1a0ca31	Enable default secrets for minecraft	2023-08-15 17:25:31 +02:00
Nikolai Rodionov	b755239823	Enable restic backups for minecraft	2023-08-15 15:40:59 +02:00
Nikolai Rodionov	ced4bcd4c5	Add new bucket to minio and setup rcon	2023-08-15 14:53:20 +02:00
RNRod	e3848a49cc	install gravity control plugin for minecraft server	2023-08-14 18:42:56 +02:00
Nikolai Rodionov	3643ea788b	chore: Upgrade outdated releases	2023-08-14 11:31:49 +02:00
Nikolai Rodionov	77429c2c36	Setup a new XOR patched VPN	2023-08-09 21:15:25 +02:00