A huge amount of untrackable changes

installations/applications/helmfile-badhouseplants.yaml

@@ -26,23 +26,6 @@ releases:
       - template: ext-database
       - template: ext-tcp-routes
 
-  - name: openvpn
-    chart: allangers-charts/openvpn
-    version: 0.0.2
-    namespace: applications
-    inherit:
-      - template: default-env-values
-      - template: ext-tcp-routes
-
-  - name: vaultwarden
-    chart: allangers-charts/vaultwarden
-    version: 2.3.0
-    namespace: applications
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-database
-
   - name: app-vaultwarden
     chart: allangers-charts/vaultwarden
     version: 3.0.0
@@ -51,32 +34,13 @@ releases:
       - template: env-values
       - template: env-secrets
 
-        #- name: vaultwarden
-        #  chart: allangers-charts/vaultwarden
-        #  version: 2.3.0
-        #  namespace: applications
-        #  inherit:
-        #    - template: default-env-values
-        #    - template: default-env-secrets
-        #    - template: ext-database
-
-  - name: stalwart
+  - name: app-stalwart
     chart: allangers-charts/stalwart
-    version: 0.4.0
-    namespace: applications
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-tcp-routes
-
-  - name: stalwart
-    chart: allangers-charts/stalwart
-    version: 0.4.0
+    version: 1.0.1
     namespace: org-badhouseplants
     inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-tcp-routes
+      - template: env-values
+      - template: env-secrets
 
   - name: navidrome
     chart: allangers-charts/navidrome
@@ -133,9 +97,3 @@ releases:
           keel.sh/policy: force
           keel.sh/trigger: poll
           keel.sh/initContainers: 'true'
-
-  - name: app-open-strike-2
-    chart: open-strike/open-strike-2
-    namespace: org-badhouseplants
-    inherit:
-      - template: env-values

installations/pipelines/helmfile.yaml

@@ -26,6 +26,7 @@ releases:
       - template: default-env-secrets
   - name: renovate-github
     chart: renovate/renovate
+    installed: false
     namespace: pipelines
     version: 39.164.0
     inherit:

installations/platform/helmfile.yaml

@@ -100,7 +100,7 @@ releases:
 
   - name: external-dns
     chart: external-dns/external-dns
-    version: 1.15.1
+    version: 1.15.2
     namespace: platform
     inherit:
       - template: default-env-values

values/badhouseplants/org-badhouseplants/app-linkstack/values.yaml

@@ -1,15 +0,0 @@
-shortcuts:
-  hostname: links.badhouseplants.net
-  adminEmail: allanger@badhouseplants.net
-
-ingress:
-  main:
-    class: traefik
-    metadata:
-      annotations:
-        kubernetes.io/ingress.class: traefik
-        traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-        kubernetes.io/tls-acme: "true"
-        kubernetes.io/ingress.allow-http: "false"
-        kubernetes.io/ingress.global-static-ip-name: ""
-        cert-manager.io/cluster-issuer: badhouseplants-issuer-http01

values/badhouseplants/org-badhouseplants/app-stalwart/secrets.yaml

@@ -0,0 +1,27 @@
+config:
+    env:
+        secrets:
+            data:
+                SW_ADMIN_SECRET: ENC[AES256_GCM,data:dG2zVmvycL7TZM922XADQ/SwWMBrUvXd+BPwpxIvmaDnjejpEaHUfB0xhpkhZqhAB8M=,iv:5hDpUFLLGLf4VLj8h3weOZhiwJKYORg5uKVgXVXKbgM=,tag:9FQru61B5hDPcIoIUDvUtg==,type:str]
+                MINIO_ACCESS_ID: ENC[AES256_GCM,data:HvZa/kOy8ZI=,iv:T2433k3OmZTmPTx2QWEAELlN7zY37LUynapVWpASrJ0=,tag:Kvr4wIgq5dMmXRJDoxqGxA==,type:str]
+                MINIO_SECRET_KEY: ENC[AES256_GCM,data:Tv5VWQprCKtJCghzhZ8YD8/9,iv:hioZ+d0ns+Hr3pBVyfFWgcuRKDrPQmskSnU0XOMwhzA=,tag:nuFn0qV9UMy2ywiFfx5gHg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMTZGN2NSYXUzcXNJVUx2
+            YXE3Nk5MbnV1dyttUEtmUExabFYvOGdHcTBRCkM1WE9uNlF1OGh4NnNDL3NabXhi
+            OW1NcDlydUMraTVQV2tjLzVla2tpSnMKLS0tIHN6RXVJTzNvZlkyTmdDb09UTUNy
+            TVJyRVI5U2NmV1VIQTk4cjlYM1htMFkKkxsXzn+7nFiTs3mANqO0+f7/TTGKogFk
+            8ix4OpiA9b33kuqi4Z7bXx4ucyCmlDwtxuHvmOEOyW4yJ9F1cgm+Uw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-15T23:05:04Z"
+    mac: ENC[AES256_GCM,data:Kix/IdONJ79Lj1dc/gigpM7BUPyg7EIsPQzkhtu8+nbIQZQsm0CYqlqPx1V7w0r9vef+rCd/8GX8RdKw0o5ZaDZY5l0nXEi9E7dEtcHTYlrr8fqljcsGRAKmOiBRMkPh0jGTEPlFRtb0Inrn85rWUiMJP12hwIIS0t7GpAydKdI=,iv:1pMdzj1x0Hf65nmZ28Lv7yu6Y+suQKxv274nYl8J3HI=,tag:GQL8HOSswz2N56iNAS9l9w==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/org-badhouseplants/app-stalwart/values.yaml

@@ -0,0 +1,317 @@
+shortcuts:
+  hostname: stalwart.badhouseplants.net
+
+base:
+  workload:
+    initContainers:
+      prepare-config:
+        image:
+          registry: registry.hub.docker.com
+          repository: library/alpine
+          tag: latest
+          pullPolicy: Always
+        volumeMounts:
+          files:
+            config:
+              path: /app/config/config.toml
+              subPath: config.toml
+          extraVolumes:
+            config:
+              path: /app/etc
+        command:
+          - sh
+        args:
+          - -c
+          - cp /app/config/config.toml /app/etc/config.toml && echo "" >> /app/etc/config.toml
+    containers:
+      stalwart:
+        volumeMounts:
+          extraVolumes:
+            certs:
+              path: /app/certs
+            stalwart:
+              path: /opt/stalwart-mail
+            config:
+              path: /opt/stalwart-mail/etc
+
+        envFrom:
+          secrets: {}
+          raw:
+            - secretRef:
+                name: app-stalwart-db-creds-17
+
+extraVolumes:
+  certs:
+    secret:
+      secretName: stalwart.badhouseplants.net
+  stalwart:
+    emptyDir: {}
+  config:
+    emptyDir: {}
+ingress:
+  main:
+    annotations:
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.class: traefik
+      kubernetes.io/ingress.global-static-ip-name: ""
+      kubernetes.io/tls-acme: "true"
+      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+config:
+  files:
+    config:
+      enabled: true
+      sensitive: false
+      remove: []
+      entries:
+        # Ref: https://github.com/stalwartlabs/mail-server/blob/main/resources/config/config.toml
+        config.toml:
+          data: |-
+            [lookup.default]
+            hostname = "{{ .Values.shortcuts.hostname }}"
+
+            [server.listener."smtp"]
+            bind = ["[::]:25"]
+            protocol = "smtp"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."smtp-startls"]
+            bind = ["[::]:587"]
+            protocol = "smtp"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."smtps"]
+            bind = ["[::]:465"]
+            protocol = "smtp"
+            tls.implicit = true
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."imap"]
+            bind = ["[::]:143"]
+            protocol = "imap"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."imaptls"]
+            bind = ["[::]:993"]
+            protocol = "imap"
+            tls.implicit = true
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener.pop3]
+            bind = "[::]:110"
+            protocol = "pop3"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener.pop3s]
+            bind = "[::]:995"
+            protocol = "pop3"
+            tls.implicit = true
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."sieve"]
+            bind = ["[::]:4190"]
+            protocol = "managesieve"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."https"]
+            protocol = "https"
+            bind = ["[::]:443"]
+            tls.implicit = false
+
+            [server.listener."http"]
+            bind = "[::]:8080"
+            protocol = "http"
+            hsts = true
+
+            [store."minio"]
+            type = "s3"
+            bucket = "stalwart"
+            region = "eu-central-1"
+            access-key = "%{env:MINIO_ACCESS_ID}%"
+            secret-key = "%{env:MINIO_SECRET_KEY}%"
+            endpoint = "https://s3.badhouseplants.net:443"
+            timeout = "30s"
+            key-prefix = "/"
+
+            [store."postgresql"]
+            type = "postgresql"
+            host = "postgres17-postgresql.databases.svc.cluster.local"
+            port = 5432
+            database = "%{env:POSTGRES_DB}%"
+            user = "%{env:POSTGRES_USER}%"
+            password = "%{env:POSTGRES_PASSWORD}%"
+            timeout = "15s"
+
+            [storage]
+            data = "postgresql"
+            fts = "postgresql"
+            blob = "minio"
+            lookup = "postgresql"
+            directory = "internal"
+
+            [directory."internal"]
+            type = "internal"
+            store = "postgresql"
+
+            [authentication.fallback-admin]
+            user = "overlord"
+            secret = "%{env:SW_ADMIN_SECRET}%"
+
+            [tracer.console]
+            type = "console"
+            level = "info"
+            ansi = true
+            enable = true
+
+            [certificate."default"]
+            cert = "%{file:/app/certs/tls.crt}%"
+            private-key = "%{file:/app/certs/tls.key}%"
+
+  env:
+    secrets:
+      enabled: true
+      sensitive: true
+
+extra:
+  templates:
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-smtp"
+      spec:
+        entryPoints:
+        - smtp
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 25
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-smtps"
+      spec:
+        entryPoints:
+        - smtps
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 465
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-smtp-startls"
+      spec:
+        entryPoints:
+        - smtp-startls
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 587
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-imap"
+      spec:
+        entryPoints:
+        - imap
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 143
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-imaps"
+      spec:
+        entryPoints:
+        - imaps
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 993
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-pop3"
+      spec:
+        entryPoints:
+        - pop3
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 110
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-pop3s"
+      spec:
+        entryPoints:
+        - pop3s
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 995
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: kinda.rocks/v1beta1
+      kind: Database
+      metadata:
+        name: "{{ .Release.Name }}-postgres17"
+      spec:
+        secretName: {{ .Release.Name  }}-db-creds-17
+        backup:
+          cron: 0 0 * * *
+          enable: false
+        credentials:
+          templates:
+            - name: POSTGRES_HOST
+              secret: true
+              template: "{{` {{ .Hostname }} `}}"
+            - name: POSTGRES_PORT
+              secret: true
+              template: "{{` {{ .Port }} `}}"
+        deletionProtected: true
+        instance: postgres17
+        postgres: {}

values/badhouseplants/org-badhouseplants/stalwart/secrets.yaml

@@ -1,24 +0,0 @@
-env:
-    secrets:
-        data:
-            SW_ADMIN_SECRET: ENC[AES256_GCM,data:EzZUkRCBk1iIZuRQYmue6L/sUwqm96qVJ8nQs4ty2QwHGotrjifW8oWfxoE76WsgYYw=,iv:HQVcN7PTy7bN/pkjex/QxWNQhK2aPdWIiky2UJSKo3o=,tag:5Dt7yazdrcqGb73bK9Isgw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSUVFaU5uMnFJaFJTTXdO
-            T1FyM3RxTHdSWDJNZ21wN2dmU0g5OUIwSzN3Ck1KZXltR1pjbUMrbEhkaWtwQ0RW
-            NXlwckU2TlVTbTFzekJnWDg1WWR3bncKLS0tIFU1MHlkNzYxNEI3bkhqTmR0UFRV
-            dmpFS1B3S0h0K1BEa0RSUVBlYXZQUE0KjELkNpkCbGf7+ASkfTXpcu14VzBqlSaQ
-            hJwXowb60BjEDJvofQs93K1Rw+dtrqA6HGphcki5wzVF8T1VEFTCqg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-29T09:50:18Z"
-    mac: ENC[AES256_GCM,data:1iNJf9Li4yAyJtrPW4qZ8nNTFZQhxOK4Q2QU3Fg3IvBr8b9KyyyXAuZaA4iY2TYSWMtwN6Re7Fdkw7ZZb20dYMIMqAGOZvb9U11OY2/CIr+/dm2hVpsHv8E7Oe3hRQCLMvWbu9X6q/G4/y5i5ITq6TNME1+NAkRYgfX26/mL9Ws=,iv:I6e2GnN1b9CwuRhkxJq41ZR2zMUnitqYCRIiO1Rdi3M=,tag:2ObuHNCvYuhCdP+Cm20pAw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.2

values/badhouseplants/org-badhouseplants/stalwart/values.yaml

@@ -1,218 +0,0 @@
-shortcuts:
-  hostname: stalwart.badhouseplants.net
-workload:
-  strategy:
-    type: Recreate
-  initContainers:
-    prepare-config:
-      image:
-        registry: registry.hub.docker.com
-        repository: stalwartlabs/mail-server
-        tag:
-        pullPolicy: Always
-      mounts:
-        files:
-          config:
-            path: /app/config/config.toml
-            subPath: config.toml
-        extraVolumes:
-          etc:
-            path: /app/etc
-      command:
-        - sh
-      args:
-        - -c
-        - cp /app/config/config.toml /app/etc/config.toml
-  containers:
-    stalwart:
-      args:
-        - --config
-        - /app/etc/config.toml
-      mounts:
-        storage:
-          data:
-            path: /app/data
-        extraVolumes:
-          certs:
-            path: /app/certs
-          logs:
-            path: /app/logs
-          etc:
-            path: /app/etc
-      envFrom:
-        - secrets
-storage:
-  data:
-    enabled: true
-    storageClassName: openebs-hostpath
-    size: 1Gi
-    accessModes:
-      - ReadWriteOnce
-extraVolumes:
-  certs:
-    secret:
-      secretName: stalwart.badhouseplants.net
-  etc:
-    emptyDir: {}
-  logs:
-    emptyDir: {}
-ingress:
-  main:
-    annotations:
-      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-      kubernetes.io/ingress.allow-http: "false"
-      kubernetes.io/ingress.class: traefik
-      kubernetes.io/ingress.global-static-ip-name: ""
-      kubernetes.io/tls-acme: "true"
-      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-traefik:
-  enabled: true
-  tcpRoutes:
-    - name: stalwart-smtp
-      service: stalwart-smtp
-      match: HostSNI(`*`)
-      entrypoint: smtp
-      port: 25
-      proxyProtocolVersion: 2
-    - name: stalwart-smpt-startls
-      match: HostSNI(`*`)
-      service: stalwart-submission
-      entrypoint: smtp-startls
-      port: 587
-      proxyProtocolVersion: 2
-    - name: stalwart-imap
-      match: HostSNI(`*`)
-      service: stalwart-imap
-      entrypoint: imap
-      port: 143
-      proxyProtocolVersion: 2
-    - name: stalwart-imaps
-      match: HostSNI(`*`)
-      service: stalwart-imaptls
-      entrypoint: imaps
-      port: 993
-      proxyProtocolVersion: 2
-    - name: stalwart-pop3
-      match: HostSNI(`*`)
-      service: stalwart-pop3
-      entrypoint: pop3
-      proxyProtocolVersion: 2
-      port: 110
-    - name: stalwart-pop3s
-      match: HostSNI(`*`)
-      service: stalwart-pop3s
-      entrypoint: pop3s
-      port: 995
-      proxyProtocolVersion: 2
-files:
-  config:
-    enabled: true
-    sensitive: false
-    remove: []
-    entries:
-      # Ref: https://github.com/stalwartlabs/mail-server/blob/main/resources/config/config.toml
-      config.toml:
-        data: |
-          [lookup.default]
-          hostname = "stalwart.badhouseplants.net"
-
-          [server.listener."smtp"]
-          bind = ["[::]:25"]
-          protocol = "smtp"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."submission"]
-          bind = ["[::]:587"]
-          protocol = "smtp"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."submissions"]
-          bind = ["[::]:465"]
-          protocol = "smtp"
-          tls.implicit = true
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."imap"]
-          bind = ["[::]:143"]
-          protocol = "imap"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."imaptls"]
-          bind = ["[::]:993"]
-          protocol = "imap"
-          tls.implicit = true
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener.pop3]
-          bind = "[::]:110"
-          protocol = "pop3"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener.pop3s]
-          bind = "[::]:995"
-          protocol = "pop3"
-          tls.implicit = true
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."sieve"]
-          bind = ["[::]:4190"]
-          protocol = "managesieve"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."https"]
-          protocol = "https"
-          bind = ["[::]:443"]
-          tls.implicit = false
-
-          [server.listener."http"]
-          bind = "[::]:8080"
-          protocol = "http"
-          hsts = true
-
-          [storage]
-          data = "rocksdb"
-          fts = "rocksdb"
-          blob = "rocksdb"
-          lookup = "rocksdb"
-          directory = "internal"
-
-          [store."rocksdb"]
-          type = "rocksdb"
-          path = "/app/data"
-          compression = "lz4"
-
-          [directory."internal"]
-          type = "internal"
-          store = "rocksdb"
-
-          [tracer."stdout"]
-          type = "stdout"
-          level = "info"
-          ansi = false
-          enable = true
-
-          [authentication.fallback-admin]
-          user = "overlord"
-          secret = "%{env:SW_ADMIN_SECRET}%"
-
-          [tracer.console]
-          type = "console"
-          level = "info"
-          ansi = true
-          enable = true
-
-          [certificate."default"]
-          cert = "%{file:/app/certs/tls.crt}%"
-          private-key = "%{file:/app/certs/tls.key}%"
-env:
-  secrets:
-    enabled: true
-    sensitive: true

values/badhouseplants/secrets.external-dns.yaml

@@ -1,23 +1,23 @@
 env:
-  - name: ENC[AES256_GCM,data:RLLp8toAkoWLWRjp,iv:UUP3i5QkNBw/pgYmxHtRUDx0E6i42e/Ioh1z6WnLESk=,tag:+PEinrzkisEQx5gVCpdJ3g==,type:str]
-    value: ENC[AES256_GCM,data:RKiCvUOctYha7fusMWNrOKHPgmMMjuejDCip470QMHQcxY1S+yJfXA==,iv:ESfZNZimJkD5T4tzRPMu53H+ushbhOuXaOdX73MaWV0=,tag:F516VFRCw6k589vClX8Jfw==,type:str]
+    - name: ENC[AES256_GCM,data:iUkU/BNlitD6f6RQ,iv:x5aENGi0aw9gDh2a7h92DfxwQgdbacM3hHtnPVdIKWA=,tag:4vyOlP7XcC1F6pjnUieAuA==,type:str]
+      value: ENC[AES256_GCM,data:cFypu5mF+ktwjNFCBcy0U/1UIt4Fc/CAtH/SngvaaBXY0yinYzaiOQ==,iv:2VQ1Cpmppkz2ylt5NMP84o+0EQkI43jz267HNRjMugg=,tag:co3LJzwxbmxT09km65MVuw==,type:str]
 sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age:
-    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3eE5LTURCa1pyRjBocVpP
-        ZGxXMUZkUC9XK0xNb2duRnJiOHNzNGp0YXdrCkNvNWMvYWkyTHhQU1ZZeng2bmlz
-        bGRrd3p2dmx6MjBuc0lYakhMNERMOVUKLS0tIGpsRHcxdUFtTHlXVGZLTEZ0c0ov
-        b0RMSlFCM250MXJHbWhRTWtGbkxHc0kKpyzba8yp0xN1KjcUACcmlznH9vQtYAsL
-        3bm7Cw2AZO7nkdCxky/ITd8N3rbqAVGeM2CeTAxpcMbEXKq66/yqDA==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2024-10-15T15:21:16Z"
-  mac: ENC[AES256_GCM,data:aIXlmeiqaFu9Jn0zI1qyU3iAkhLKgqMwwLcLDlr+LeYX/88cZtzgP683jW3MYC/LxnNh4LG7v8EK/HViNnCkrvZ5iC9cibRPQYZJrkR3B3oGk4L+RxPws2VUa72pJsG0bQ8M2DDCoDO2T9OuuflqYENPLyYLL7D7CaeSj9w8G0A=,iv:EDaGmWFUnzp0vkIeR1J8iZ9+PjOMuRi4YltoqJAN0P0=,tag:DsSd6Nplvy0nIWaCJgnhgg==,type:str]
-  pgp: []
-  unencrypted_suffix: _unencrypted
-  version: 3.9.1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwMXNsQjEwYXdaR0Y3bktt
+            UGFYS09Nc29IR0w0YmpweUtyV2pPbXFPeFJnCjZkclRSVjREanorbk5MKzJybWJI
+            UDlwdlVqWGZockVVeFVrNnZlZGp1NUkKLS0tIDhnUzgxdlFWa1NicVJEUk81cXp5
+            M2xvSjRrNUx5OFRqbUFpSXdyZ04xVzgKMsBwKA8dVSW9BR2jSTBxMPKevual5P8I
+            V+YUcIIUAP1sFjs4jVhTduBSMI/ZSArWYIEX+dQ46oGDLcRzODm9xQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-16T14:21:33Z"
+    mac: ENC[AES256_GCM,data:5nE5vx69ESp0HW0/uxYGp8Lq35Cjb5UpSmNkx1H4ux67K3xs3zEBSrupDuUqzrrj/WFFgTf8fIAnfu//bEUvRqtqkIOb7eTqBlQTCzdKWLMvfwhv3WnfXLljJvZZH+e430z7ayw6psfNbwm5sPr+/sPSijg31xv8x9wN8LfZqno=,iv:BKyKMqQ/eLiDspSlvMh0/I7hKb3xn2BUQhuHwrl+Pfc=,tag:is4SHDuAT2c3Ip2O5ifgWw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/secrets.minio.yaml

@@ -1,33 +1,33 @@
-rootPassword: ENC[AES256_GCM,data:sJGSChjXcFdQLw3y6SHcCGAlnGk=,iv:vaiYnGKy3me55xu02nMfk74ee23fbFu2YwRA1gal6ig=,tag:HwxHK4RVxyYuLgwjqHdsJQ==,type:str]
+rootPassword: ENC[AES256_GCM,data:CtIVMGYDrJ55wS6ZfLipEur8VeM=,iv:Vz4o+1JInlowgKwYN1bI9oxhTm/Yq8B5uhxIBh3SZ10=,tag:xyH66UMou4nalSzGps60Kw==,type:str]
 users:
-    - accessKey: ENC[AES256_GCM,data:cv2x9ZOcgDQ=,iv:lnotFIWXhfIzUB1ELZ7Wg5eWpFPLe8Yy9sOgIwGgy7o=,tag:jZ34pMSPHdwLqvGQSCFaBg==,type:str]
-      secretKey: ENC[AES256_GCM,data:5jnXunyWDFlMhbTKvcl9aVxUgg==,iv:0M4oTh7xsHlaMIIeY0oKZnL0eBuLLC6GwHbadKQ4hKo=,tag:R3Ol1JTv8bCx2vC0L6r/1g==,type:str]
-      policy: ENC[AES256_GCM,data:AcLMNdGxifg=,iv:FztbxQiFUY0ePW8b0oObzI4JcLTgsxO5OEUDk9UM/rA=,tag:EBO/UYMl9f6oLPY3WJa54Q==,type:str]
-    - accessKey: ENC[AES256_GCM,data:6D3o,iv:e6jnfVOkPdDmCg0v5alDuonepiI/+uoRthE+ftYiH1M=,tag:LNZe6/iYsvBu50Ko1MjG5g==,type:str]
-      secretKey: ENC[AES256_GCM,data:C9ID123+9FdAOT3HDoSDVyJPDmscebPhiA==,iv:JB2A2/UkD5CjG8FmxeHVTJTnrfOO+X1mqdwq1XN27wg=,tag:HHOWRWFZgn25ee33JR/X1w==,type:str]
-      policy: ENC[AES256_GCM,data:Z5RW,iv:Plr4yqz5/BqGNg3BS8Tuh8ogH7I8lG3HRVT79obBipI=,tag:XudAwmcQIyUCBk+gz4oI3A==,type:str]
-    - accessKey: ENC[AES256_GCM,data:OCq2b0+8qR7z,iv:E8urI+iZuVjY8s4azAyPGqLchq5AYhzWOxPb6FamQKg=,tag:UCdntq8CwZESAFkYPPuszw==,type:str]
-      secretKey: ENC[AES256_GCM,data:s9+00AeOVth550s71oGdRyKEX3Y=,iv:VVEP4UEmMOexVTCSEFUgYYldy/H3eC8ZC6ix9pFhjH4=,tag:cCyLKkkf8GQJM0bR7pBQPg==,type:str]
-      policy: ENC[AES256_GCM,data:JyMlqYaTbbEA,iv:3R2tPzimIRFrFbUHWVc2+ZzcAyL/hVTvrrdHA8GGR7g=,tag:kKReqB7g/MQ5XDUFdgFQUQ==,type:str]
-    - accessKey: ENC[AES256_GCM,data:E24PEOI=,iv:Y/Mv2+v/njmtgIoH58HdRBsZ/zY5EbjL4ivyOmNz2Dw=,tag:R/M2xUvEyRcsb72kUjqhcg==,type:str]
-      secretKey: ENC[AES256_GCM,data:HMtrVFMGTMbM0iB3XBycWiRV6Xo01xcOsA==,iv:ArLTABNf/hPlx7F/+TeU80SUHB/zHAWRPw2KSAVyeWs=,tag:BfS/+2YJKj2pOc7IvIanLg==,type:str]
-      policy: ENC[AES256_GCM,data:fp9kBiA=,iv:gIQ0Rag6WxAc5vE8SqtgdUUWg2bm+LNdthrWJ39+WcI=,tag:rXsrF8Vl/ziP5hwyCQwufA==,type:str]
-    - accessKey: ENC[AES256_GCM,data:s28I8iqDqiv3,iv:QlywXCiFPLltb8PBebAlmXI1AL9nZeW675FslV5WdNc=,tag:PJuZ3ZwElC1jUZtAQ8Gotg==,type:str]
-      secretKey: ENC[AES256_GCM,data:HLRPdu3o/Th02ReYHAfG9Y3A1Hc3U7FBJw==,iv:JLYBpYOm1Q3ris2cuCO8jWpviujLBXAj7sjIBVJLhK8=,tag:vRRX8Hk5KSKw5wPmrs2HUw==,type:str]
-      policy: ENC[AES256_GCM,data:fqE3hImxx7QY,iv:0ld3h1yFeaxW8GOoM/PIlAX2Ew2N8323POTxKYCzlcI=,tag:S7LAxvxMaB17lEy+U5WkZQ==,type:str]
-    - accessKey: ENC[AES256_GCM,data:GE6aFDONIgA=,iv:wIegWijhuJlsrVazFnIjns88j4MFMz361nDH9Cf6J6k=,tag:MiuPQNc3A/bUI9A2lXhgPw==,type:str]
-      secretKey: ENC[AES256_GCM,data:dWt9DXB4mY+CIjNkdB3x0X2h,iv:KadnV3zXxLc2EHf0vPuwM5pRGuBySjgSFDZitvMGKbI=,tag:S0rMIsjY2ZGTVRVtCcDSYQ==,type:str]
-      policy: ENC[AES256_GCM,data:v2+9cOzKtPk=,iv:QVpl9CQwQtXigEen44BehN6aWdr+wTYsrK6THti/6Sw=,tag:0nffXvx+pLnXC4Thzk1GBw==,type:str]
+    - accessKey: ENC[AES256_GCM,data:wqwCa8NXAns=,iv:3oVMHIJ06q8OdpdufDH2R1CnV83ltweluMIFEplnoGw=,tag:1uLJAU0u+gMXHxBRbJ7mrg==,type:str]
+      secretKey: ENC[AES256_GCM,data:JnqlayhzqKro+tdDY70//ty9pg==,iv:2Vu8ZxKR3gMHQ99AbP5HAjAJJY4hnnXLtlBzShzgdjg=,tag:zk+tFw7sURDE+T4dDF3Bqg==,type:str]
+      policy: ENC[AES256_GCM,data:KOonZYe6MYk=,iv:o62YxxnBcpDhcnp6qrbJxDpm8GMzFl85QOw4Fd9Ask0=,tag:UBsKKdw5JLmOA5N9HHaVCA==,type:str]
+    - accessKey: ENC[AES256_GCM,data:hQkz,iv:eJrFbiYcuRrZYRtk1UN3fL4+48nNUEdIKcCqH5RUShQ=,tag:HxnFCMdIB8HfixkUvE+LGw==,type:str]
+      secretKey: ENC[AES256_GCM,data:R5uGEV5xGu2nCk4H18B7rXWyD+S3huHgig==,iv:WFjo+mHK5z6wXZZicezTlPwnlyU2mu7WljKz8lft9dg=,tag:P91sHa0yG88ka6fTIGrXEA==,type:str]
+      policy: ENC[AES256_GCM,data:qeqH,iv:VrawQSqW+rhiS7NXdI7l81fy+c6GJkxYyfLEHYfrayc=,tag:JGQ7uxkPPzH4uUA0ZicKPg==,type:str]
+    - accessKey: ENC[AES256_GCM,data:CSzeTJP1kUMA,iv:VoD9gDtPUTQzWCxXMVfMH55M+OCrOtTzI5SgQUpUCpY=,tag:B4pjW91ENd66sPbh3JOxuA==,type:str]
+      secretKey: ENC[AES256_GCM,data:rJu+Fo+SgZrGQ9nwEXih9gSZJqo=,iv:4RRUgquy8J3OODzktlGfIPwkVtCZa6SCsegYuTCsPyk=,tag:DjTKVpvzL0WlWKEVzAiiyw==,type:str]
+      policy: ENC[AES256_GCM,data:ZLRECDxDQcRQ,iv:x6qIPiRmIEdugU5WtFoErBbvpvS5QklaM6VzQlfSwcM=,tag:ZLbqfthesZmmfh4GVL+JTQ==,type:str]
+    - accessKey: ENC[AES256_GCM,data:JnhlVBg=,iv:TBkM5z4ZeVxHyOnsAoMmWg6I/V7f962NbzqcvKtTkBE=,tag:di+TL5BRI1hLxnBLoB3P/g==,type:str]
+      secretKey: ENC[AES256_GCM,data:v00te7PKaNYXJ9C7eaN+w0Etl90qCShjsw==,iv:zIYh3qoDXp9ZOMPMGEzye3eu4bFHie5W58WrXRZdxME=,tag:C9Pq60Z4hQeIPJ2iIb5YMw==,type:str]
+      policy: ENC[AES256_GCM,data:H4WdjEk=,iv:WY52cXnGTug6I/F+ybQOtHED2fkoSULpJa/rP9smacw=,tag:GfoAGESDyb/oKmPU2N+IsQ==,type:str]
+    - accessKey: ENC[AES256_GCM,data:F3Y/yMIvFPWX,iv:6qj9h1amuusGuOon9h/DKPjT7dk/akMVKMSLuKR80Bs=,tag:f2pEP3pYju2EbMYPZg+ijA==,type:str]
+      secretKey: ENC[AES256_GCM,data:krN8EIKt9cjd3EsKIAmdoSQ9y+IHy1LIeg==,iv:dk3wH2yY/IDBTEahYACAYsImNfiq9Zd697BcLvD0QzU=,tag:LYhBXJ1rml4ts7kEtfnJ7A==,type:str]
+      policy: ENC[AES256_GCM,data:sdydid+WXGxv,iv:P7plZmbxi3egYqYqzxc01T9/1edpZf1+RFTDCcezNn8=,tag:dLtii9vqw6s3lVXGO4KAMg==,type:str]
+    - accessKey: ENC[AES256_GCM,data:hHjmZVAqUlY=,iv:liIg6UHUUl6B6eyFuWog2yu9UwrCP7hRHj4RRCnFdi4=,tag:UeEmUEm9ky6QvCc2KE5GEQ==,type:str]
+      secretKey: ENC[AES256_GCM,data:Gw3TRUHOkxYKCLh8giPOsC7n,iv:Kr9qbns7RI2kTFIphwIwJT9M6H2pCFKs+dRbnFdz8Jo=,tag:rKEQ7+5wt2mqK7QjVLJR7g==,type:str]
+      policy: ENC[AES256_GCM,data:c8J+dTNf+TU=,iv:yWxrOJvuSFPByV0vDcAVZSAhsiE/1m/PdjsqdJQv+zE=,tag:aQwQThS+FeeoxJWdDGG4JQ==,type:str]
 oidc:
-    enabled: ENC[AES256_GCM,data:iPRMVw==,iv:7+wiaPH+5p2jrN5V6HswUiM91aEw/ldUg1mHkZ+w9So=,tag:7e8wuwGn5JnJ2MWBkGDp7A==,type:bool]
-    configUrl: ENC[AES256_GCM,data:l5PfhY5UKYTKQEGDfR7K70O90f+46Yn3WBGA4fd/aewX1a19lEDfCVVUnEIH8wfkuCfWCatUHROohXmYDyHpNvzjrfWNaPvY6GFO78dFHtsQNViTZ4ZBu3w=,iv:pywiejbamZHmB1C03sDx7d+I7SoqTauV2VRPxQr28M8=,tag:eqda+SkyCs+cMVrVpgv+yg==,type:str]
-    clientId: ENC[AES256_GCM,data:0mSKgQ4=,iv:2tBcW5pyl6CnQy/iUNoetrfYV9RCkC8h1qmfSdCeOtw=,tag:2iCUmKWAi/lV5riGczLAmw==,type:str]
-    clientSecret: ENC[AES256_GCM,data:7vfYBA306AZHFw6yBWt4yeEPTbTv9E4nLywCNw7JNJs5uZ4dc4CaKgUnxkPsQT4RNqeY2RvitVwY5Ru9pfcLGKjBchfdzyHZx510LJXrRAjwWvA6S7DbuVtmzQPt/afkjyRNnSmiSh3p1Qq4tm9cUcCq1liicDt1VpbegMYZwe8=,iv:pBi1lX8Tnl2WrWD6m3WYwbrUp4mmsR7rdkAfJ/3tvD8=,tag:VbBw5EUHba/wzm9Px0oljg==,type:str]
-    claimName: ENC[AES256_GCM,data:BhPyfRA6,iv:45Kwdw8y6CmRvgXK1q1V2Kul0Eojopdd8jP9b5F1xP4=,tag:mkYeV+KfyBv1CXpZDEdIbw==,type:str]
-    redirectUri: ENC[AES256_GCM,data:gTBj75u9a92gz/x2RQhRaenVYHh2U/EWPs8Yfc3XMZ3A3p5288DDTcrE+BzJKiA=,iv:jsAgOw/Aar7xlhQrB2HhOq9kInXeDRqBDfBVdpW33Kc=,tag:+XjmwVvugLE50UNBiVpaMw==,type:str]
-    comment: ENC[AES256_GCM,data:wqDr/C7UgdRdwr2BvxtXYnqiXlk=,iv:22Ox/IUWztNSYLrhkNRhNclXiCfaNSXFip4AmLHBBLw=,tag:oplGVbVwQml9n74JweeGjQ==,type:str]
+    enabled: ENC[AES256_GCM,data:iZ4KHw==,iv:tqyJs/qDfsn8hzGlBf7QZlfBpqImkSHgcDAjlGpleWw=,tag:v9qEwW0eOInDMGf1RMf6LQ==,type:bool]
+    configUrl: ENC[AES256_GCM,data:meUwpcosuZ30Q+T9XhdhDV5u8UNY6QeEjHvvjc+4+bw5prPz7UpvanwvY2kz87kxjh/Jbr8vBe5BqCF1av1QlkLcpIRzVI/L3Fh3YInsuvNSdR1NITNZCM0=,iv:Is0pXDLvGInFiwbYgAi8vWvMRnoGcWsYqa1PWr7ks3w=,tag:qwAP3iBq8oj7DCDhH3V5AQ==,type:str]
+    clientId: ENC[AES256_GCM,data:tXLjOTg=,iv:bZqJa1VIcW3ohIACqruhDz+W49AX03qwCS5JniX7FWY=,tag:kcd6p07kflnOs/0huSUe3Q==,type:str]
+    clientSecret: ENC[AES256_GCM,data:iR8vf8S4WYxRw5d26ROva1dWRa8VjbXEG6CT3TYiVTe0GJxzeihmD3kes7D2Ps94TsWChUho73GVlNrwMFyDLmC63xiwIRTYLsmxEjH2hxpRa0ickzzJ7yYiSm63TV7nMh87hq+ZZvBWA8W4NCA036uNSVNYUg5p/traBo7250M=,iv:28LxFf7QUtW3t2hVH+bFVSqemLozy43Ii2AJJ715TGc=,tag:GATqHiD3f+3sYtpGHlpMcQ==,type:str]
+    claimName: ENC[AES256_GCM,data:JPQZn+sE,iv:R7POgpEIk0l/5LD7viJ2CYpNNdGuUEUa35190UEzcgo=,tag:7fNRwiTx2s8ep8Ij2J0ekw==,type:str]
+    redirectUri: ENC[AES256_GCM,data:M4PIfUybd3oEsRl8NOnDaWqWKfJPady/n76RD/jYTwpQs2f7Yk4hKbAJo6HAghw=,iv:wGM0+MldvRrf5kJjepEIJcQwzr0B/NhHJaranZI3/4s=,tag:PPOiO85oYW2Y0wuZgEtkNA==,type:str]
+    comment: ENC[AES256_GCM,data:L1MieehjgkbmkzoZPfKcZneiDAc=,iv:/yHluidYeCmGZu2XiEH0XyC3/GIThFHQbTblmKWShe8=,tag:oAd34cZnaULR2wnLGyzMEA==,type:str]
     claimPrefix: ""
-    scopes: ENC[AES256_GCM,data:RGNvYxjR9jtmtvOvUAGhvrzpCPN4xhgcrdjr,iv:IgMUDeuF2EzSjyxLh4bFynUs1fSXebhMan04whxetSc=,tag:JdmYRGDl1y1uL7DAs+tAvg==,type:str]
+    scopes: ENC[AES256_GCM,data:JDHNBeFHOnU6atZ2bChXlcOKQdsvCWBNNpCQ,iv:jSUNd0I32fvDbaIE5OYvyXRu/cvYnPn8H0j5bbfYzh8=,tag:DmzMYBN5VFCejbLYh8En9w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -37,14 +37,14 @@ sops:
         - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzQjBWMTdGUVUrZ1dHSVRh
-            c1dCSGt6WXpWRFgzTStTa0lURzRMbHlEbGljClJxdjdFdFEyaFE1cXZOVUxybGpy
-            V2paMk5pQUplcWx0ZGM1MmtrMyt6ZGsKLS0tIHIwZzNCbmhpNUxUWjBwUkhjWDQy
-            YWlEVVNhU0Y0aHlwbGxZaVNYZFFMUm8KHtPp7rhWctd/5hTSkZxgUdUYcm04Syck
-            f2uanLd+LcS51+TaEyS6kPvvmnbr3vWBXmC2YlDodlFKtaa5wZ82hg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMGwvaUl5T2swV2I0ODMv
+            VmZtUFJYQVNUc3hUTHZjOGxHUjhqMEdKNUFFCjgwUjhaT2hGQTRSd3NNMnhkUHFO
+            bS9QZDZtVE5oV3dmR1RkcVpPTVAvQ1kKLS0tIFdaNnRqVGJCMk5zVkNBRWN6TWNv
+            TlBsSmVENGw0TFhmemxmOXp1MHhseVkKwwpMCzto0h5CgE/xBX1rLlqhCzGRfOTu
+            JHvvn7OffKO0XDHBw/BRVJFtd9nbZPvlj/PNi5I7voFY8aJmxh5rfQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-29T09:24:10Z"
-    mac: ENC[AES256_GCM,data:oepHWEe6sICVh2GSR0MFFeq/aCZUdF/darh8V4zUeB5FND6hvo1Jr7QkEE+b8PR+C4PsPTra8RSWieXsv3ZypSvs1fdYmve2fvCK7S/juExcVLYo2MjhtKqxkNffBOoY1D6bBjgJXD3s2u1BVHjUOqa5Swmn19kQs0c1VE0E55M=,iv:UvRVRBicxz2hvQk6pq3S9zh7zOq/KKi5jlMf4WdYUog=,tag:mxCXgDh0dNtckTgLSezqfA==,type:str]
+    lastmodified: "2025-02-15T23:35:02Z"
+    mac: ENC[AES256_GCM,data:C0/AtGBnOsnky+yGVLuUquN7mdyewemGcaXu39H81CCjYgPx2sgheIMW14FjzCbAsVazoWaK0/cReTl0Pzlgjev1C7C+BE3RgVLMP7VtlLhPjJO8Qu7YKCxS3QCUh0UqDq/apoZoxtL1sKRBvfbpTOHa9xYfVzPrXcIcxuM/FC0=,iv:t12yHlPHy3CW6btSaI4d1yeIb+Giwh2WzBaxhavf6U8=,tag:oMG2zgRps18oPUtR642CJg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.9.4

values/badhouseplants/secrets.stalwart.yaml

@@ -1,24 +0,0 @@
-env:
-    secrets:
-        data:
-            SW_ADMIN_SECRET: ENC[AES256_GCM,data:EzZUkRCBk1iIZuRQYmue6L/sUwqm96qVJ8nQs4ty2QwHGotrjifW8oWfxoE76WsgYYw=,iv:HQVcN7PTy7bN/pkjex/QxWNQhK2aPdWIiky2UJSKo3o=,tag:5Dt7yazdrcqGb73bK9Isgw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSUVFaU5uMnFJaFJTTXdO
-            T1FyM3RxTHdSWDJNZ21wN2dmU0g5OUIwSzN3Ck1KZXltR1pjbUMrbEhkaWtwQ0RW
-            NXlwckU2TlVTbTFzekJnWDg1WWR3bncKLS0tIFU1MHlkNzYxNEI3bkhqTmR0UFRV
-            dmpFS1B3S0h0K1BEa0RSUVBlYXZQUE0KjELkNpkCbGf7+ASkfTXpcu14VzBqlSaQ
-            hJwXowb60BjEDJvofQs93K1Rw+dtrqA6HGphcki5wzVF8T1VEFTCqg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-29T09:50:18Z"
-    mac: ENC[AES256_GCM,data:1iNJf9Li4yAyJtrPW4qZ8nNTFZQhxOK4Q2QU3Fg3IvBr8b9KyyyXAuZaA4iY2TYSWMtwN6Re7Fdkw7ZZb20dYMIMqAGOZvb9U11OY2/CIr+/dm2hVpsHv8E7Oe3hRQCLMvWbu9X6q/G4/y5i5ITq6TNME1+NAkRYgfX26/mL9Ws=,iv:I6e2GnN1b9CwuRhkxJq41ZR2zMUnitqYCRIiO1Rdi3M=,tag:2ObuHNCvYuhCdP+Cm20pAw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.2

values/badhouseplants/secrets.zot.yaml

@@ -1,25 +1,25 @@
 configFiles:
-  config.json: ENC[AES256_GCM,data:/fAmvOe5kzboNsk/qhDrQ+wutaK1YE2W44MspKTwtOCVQLggGInfTCzlvTCgJibpeSXh7T8KF1IbIzG/pvIAB5zbXL/GxycU35iwhEC4llayb5aNovGmI5WdyhoRh7ldX0aSD6msKtvU1L5G9eTV0IZ9e2Td1/6CRnFr1a6DruFzPyIv+RLWaFUmTZzWbnFHM3zOvNFQ6Hr9L/niLIKvdhiTRzaqglfFgbNJzNfFQCKph3Y9P8K8YFtKST0G++xjI0GePhJdquQ4iwilq6Z9Khed9F+DpH/5k+wCBnPdt/Oto5mKc3d+XFMNznx3taKsVfR43hVdc6Z4qdu0YnHdHH5y++eI7MD0dVJPSl0QdkSN8yIcxj0VIoSFejhlwjQeZ47ySIDtNenkL75VCeZhPbahfwPIiIUDaLe2Gn6KFMDa7Q6VDi0atr3Lh6h2BYDrzf1wVEQhZFSChdS89T5okm7vUTMPIjFc43ag0uPjN3qLdHBRniMHzOIUnue/5h6ok9IkTD7veGpYkbPvQFWYJsl2sEDJ+lTlTc5t6QRFoL01J23YkzoIz9nRwe3h8SX+0VYsXXsS27OHlfY6laP++GPvdpTmAhTsmvDIyjMSUv1WpzETnaxm8Ym2MB/9rJloIpGhgsdLN2MxOrAaYMMJZeiQJZxnEWiKTl9moB0BtHM7Bs7/NeSU84yO9QZRvGoGWi0A0Hh9VbdPkpgMQbyL6wpCrQQ5msPTXef3K9MetiMLXbORrFyVE9BuxrGXVzF0d7DQOUiYzqSltW5Bf1eZ9uDrcHI1y3Hmn8Uh2Ga+ua2K5qT+XLjyybDwd4IlAUtaTnxcFBXALwuSrb6JYJZqeHZ7oxEfTMHDYcWviJA6xII1TzGRN8uJVKp14yTAcR3yVa/UcSOXdI7kBimS5oZPzUeE7KJeFZwcJiJdmsWEq3MExeJQ2o6ffdVdrR2AVH/VhYNJNG/Mrq3Vc+9WVQNQxapR6vapNx7FjQlFeDP5+YLzAzwCjgQcAi2i2gDqCIypfKJLFAJQidTEy10AG6Jx6hvUiQJfupazBvt2n/Snuyh/BQmdoIWYWlFhTspXMXrYAl9wV6a7H4QPa7Ijza+hZSpOa+vclfHXrBEIBo/KPt+k1Ly9sZZR1DFnVsR4BSxdTAvnLgJlr/qrgIw8j30Tczj5QOAjUNF3UeOVycODGoPlW+8jm96IaL+Ez3tTxDSFPR45BywVK06MRqKF4lL+h2nNOebTQDkQqVBglXOuXZrKA2UdKRFA/GaoGUjAaOGvG1ARpmU4oujECEaTkiCa1naCMs9Jx2PvKdHwPR97QE7nXrsgv7YhnYGKKfrgZRBz0v7259ZtZ9zShr0tOI8psVA6GRgg5Ly9Wz7j761get+VFCK6toOW3VQ1wBfEr++CfhvFfoWPQszfvjAqESvXcW16ScliWm4FoNm2XqtQi/q/R84sXSDNZq0dpauZEL70kuOGU4xSFNZQQSQ9AGDjv1wJYZuGp9T6M/GWUlplQaEj72DwZxDK7l5EWGa2FI/NZzUi/KxGI6c1YSR4bZQ02uOgDRHd679NnXUwsGyZ+kbwhvgOEQLIYzCJhtjvz7/l8weHkVn0MDm0Jnn4nk09FH4xkULr3kH/+eknSTVI1HB72GlOSnAR1v4dJfxzNRmRCmfqlPNS2PYWBjhRf5HbqdCAHhb2BYkijDS2JQlCW+0Yxdlem+7ScLCapidg5B5riP59NqVa+ZNoB34bw6rFCj4Pg165BMPezG8j1OYe8I133/zAuaQg4HwSY0O1M5O7xU3W2SftbBh0T0C23e/7aARvx+FFWXD0WtK1IaSmeXiJo/SclgQa+KkVd5JRB3GYvDwsP7Eens9lX63F73mub56v6hCZ0p2+rm7DVn2U/zUHTKmoy0YMkAU4Sg2aR1Gy9ZenX9Qkja3Tvw539GtvI9XYbHFgajuDnvmDOcq2+QKVHJtHk3rQ/h8ShB6KgzmIiQp7FW3otvwWN2WS7yXYNwJtQy2hf5fbQwnd/fO54vS/xQ0XiEJeOrjpVImAbJJDoy1YlP/tzVZj2SOHkuKw12m0Zvk78Oj0fPwx0SwRLe2GFkmBS+WJhPNp2y6lWJpVPxBt5DRhZGuwsJQxx/5vhVZpJQGGt7ojo31++IZYtG7GkcnyMPJvBJSgAZ7LpAsqIZHwWFpL+1kjcHcmQ0O0goNL0JFNfWYUEH1z8SF1cFjFv57XnyWcNwepgia5o0JZSOwtDlbrfsYhrc9rvqk36xxXSnpiqUYHUNskOF2lUcPPJZZmLTJE4pXt0AA7itP69OtLo47qeP+5F3rN51X804LSzE5h5tUMG0+t4u0fR/+MiJhwj+C4iDJ0kYb7lkyIYFLrkJ7TB5eIPfECbwCIdpHI5ylBD/ZYVetJnCtd1pTNFuP8BBxS2yjq2/AzuGDYYG7Cn+AB9ISmVI285t+8wGmweArXNXmzkeiwFE915WnpsDHPYp8wEYfASWx2oDx+CbMQzAEM6vmaxM92BizZDb5cjRqSpZN3uzjG8SaCI6L6UOJaCu19YGRWNp3O3vetsV7YVaSFPjPaAMS2p9UWzJETPBXY+GA9LI94rwfhreRTCEAK0abxbUyqc9NRLcdGmM7i5gwD+zBu9hjPqDJWxwNnUP/Dt2qXcPK1qXvAdJRDSAm4724CtyuuDshukL/F/x+oB1PNNnqzUrszTSjuzx834x9DzRG+KBB94RRuePsWksEPr5i5LhImb8BLz7AD7GCl/OsgCWF4VrwlS4cPvvChnaWV6CyGMjwUXHu0xt0tNBjQYPVF8gB7sjDo1AwP3tvcP9bqIu1KpzXPlrs53NpOgoRdETSW+P3Eh3pu5/WfT1Q6iRvhDmcSKRmtdUB+cd8yodTbTSKl2Dd1CQ5qEVR8+GvlqdTo+f2vtB3LDx1Kn544KNSwS9GF60PJmsSDHJf1BEkewQIt/LWeJrerXY3N/QgNR4+hz4BkVumh6zRjQTjetuFWznZKZQG6gHaatQGPeffL9n8xfORruhQUPeSrnbyOr9+91LJ1K0pnfIMRByUM/VK04/zekenh88x/Aj1DfQ/ELQ1tOfZJgCUBy3ox5jttYqNsyU2NRhKx+KYd0U1PJVLf0PBPfjFTqCBjG5bL/zJnAxx4eUgC1nTlswuRqlnkhHHjUcSumPcFjgbwspd43mC3HkX40XcGtzw4iPC1bv3JwQyfXb7cOPHRXFw2YnXiBWtOMXtF/piMILb+EE4gxWVWxFKHxwQhhnOrzXnS1sQMbbBb5/0U0K0UGnZygKAfptkFHzgPg24lxQGl54x0EtvNCJFhumq/wbauhX5TczitO8okgiJaH6hWuSASzHVqVPc3M5DNDZ4iBkOOOn1UPVpd0UnN28sjVv7ogPwcjNGJ6mK9BYCyNP+64HlpyYFbtCCF4A6u/PCI8ZBPhcgnnLxvGEW9m73fFI+xUWxzVvsVKZX/JHuOGu8RwN25/WaRr6wnN9sLkbUpkoQFisGrT8w78EZIVVmo5DgawJR/XDi0FjUkf2Gmmmvl5JuGq+HDpnswF8uPNMoXWJlACmn4LKV2Zl/aaYxa6vBfjAGFADtpP9JJS62iJyZ/+uBhYpw0x/NfDLnqbcGWKAwYP5vmrPlbTRB8irIUErcVW2bm8geEstj0W4UnYsAW1LX1vn9fajDW8yHPyI+3ejvAL39mAQ7csSqfI5uTEJGWDSJ3r9BYKydE/lvfKH+Pqfd/QEVD8Y5wSnfG3P0GlYYd2nEgAaM07ziPZ3BrA/+sAYF3o6+m+JXVKDW0vNqHymS1E6gdsur03vPFnIrolMwlOFq7DUdBf138r+fcBL9kqQVKpcLsRsFsduKeqC/pZwB79hKXp5kaR/S12jCTD9gGNhxS+xiRafpBF9kYoy6P2R6sHk4c+3k8iBEJr1iPsPvfPWMOrLJuP972tpmvYgi3llEJZp9usblT3Dr8CiTh1/DmHn7qAg==,iv:Ly38JP1MKsdms6UotTYCUCHDzTpc0LHNcU1rz4opPc0=,tag:9o6NALA1c/gAbnLcWlysAg==,type:str]
+    config.json: ENC[AES256_GCM,data:AmfyqvKW4RhxD3mbFNP9Qt6oKzvpPY78ysCwCDoQAHW2exl9p7JtQh/8M66HyE5dogTyKYfl5cpKrgafWu7ndfN6gCF6puHPC5uELFmJLpla/hrhivpBBjcSj5n4Nc3mgJVSndJvyvkOa4c8N7NInr41LDh+Ndv6kbEelyTOQw9gng5eeI/jSzYX6y3Zrt7oc+5FBbOABihBbz8Yfxww1QHnY6YDyuoSVrjf9Z3kQKxW4sJRviBNJGE+OCWB9oJ3RQ2RecamlX0XkmZyuqDCXU52OAIm8c5qDVd6QJR2so5wvrN0o2OWC8BMKLDWLw/TLO4AS9K4OWoJUlOGE2z3qxUG8moMxzHw2rCzBq1rMJaeho0/CZGiVPQWWzoruRurVCQoLXt6L5+oQSQj4ibpeJkP/Wnq3inT0EzEr41uas8kj7DdEJ+pKKy5tUdJXm5CRQfgFB8QdSbq/VE0alrsZ43iYNCj+CKWwnjPJ4ZGQJkNQKpRaBqrhnaGpuRDbJASSffSksrRxCunv1O2aqzY/gyrRieTU11SpCnQZ4ll/mhW6lhyuvLb741rV6vAHzaRnranhzLBECVIo/dy84tqNZ5OXUdXHBPRMzr+UX+2GdvcfGgzfaAJIeMul5Nl+nQAS/PmQOfejNTBGNQKKbz/i0+Mv/AwJvdpWA2laYjABPubFVM4671LPjVhEcFRsjnfYWs2MY43woTXVrjKZFghH5h4frwFAs/OhsYcPR0bOHMhF8brQgPHCsPWp5NhyhwRq7310krGyca1xdBvj+2oZHOohIvXk6hEHO7MFTOrn9iAeiGOnCn22GQZaK7EE2aKMleMJwfIo2Dyy6X+s007K+3Jjbt4yvUruB7hHkcVYyfHUABJLbkXPNUJ7xLgbcRXIaHJHlZ11prhBp2UDUgw9oSt/1kUHI2ZU46AfglWlGyd4xd4SgGmhs4R++P/O6GviVJXbIDGEA7UA5h6hlMNx3vuKRnjRl4OpSZbWQZh23dK1Kh1E5hV8TqbaPI8Wv7mvGd5QVRWMhwJp5dW004waifhrZNlZm4xEld1GFupK+ForBX0QLkk8juD1GBuYbawO8YTKDg5xlAKQtlVUmEPvVsAiGArYuPWuN34OqazWLvzXM1UFK9sztEPHwXgA+sOitOAOjEBfnFY0tYe6m3xrnHRNqLV2L1YK1F1V6g/+j60YHc3lofw87KpaaVJD7xF+HR9Ly2VskOmu2KTVD+j/ZIJWjGw96Asf0K5mKzBkyFGaFFYNpeHw9A3cGVYCYy7S9bFMVlPhoCJzAY4fyTw9GtpYKrXzL/u6hSOa0FRW5uvfvbCcK0spfT/CqFHkeRhNxleCvAkONZUfdKWdwvySUuRlV8rZfLOHX6IgosepvyH0WVaJpp6GBD1jyricfvp3eLocEY9Ih2eTB3j6IML10qMItdWv377B4Jnch/e3enNruivvptxAvq+rseiN+IHA/m6+xB9ZNmhIphTCfLyn1/pNb4uLfcMCldKqjzaIkAWcO+BhHJWLWvbms40uWsQ5tzdaZRcmvKonPGSKiOfouCOKZvos7uVmyTsXDFZu/2JweYu7DqrrxcJ4+dVzwcPA+FXI7DSV08n2DyOAMY8KjWkCw4pXIrT4BRCXjZaJbU5YE/25P/u9o3wjyv0+MICiGKGnNj869VG58CHjx+cjQegAAxC6XAk7egCXkRGZMJS0vnIlIAU7bDf6fYsTiOZ5BUtnjflFOA+z0apdzDjtA3aMdhzYjNmk2kLMo5w5h8k3k/GJKJFes/FiGJGQInaYizJDU1NewKZbm9kMNZsjUCVJG9aH2gXTngfRBGhgYAZG3ENBHR0wexsbBu8YpSzHduyzvrhvIlYFkdHVL4Pj6kdBeqA6FMWb9pVbIMlqW8tJeo+6TgBWUR9mWzEtGcUVpm9VxHorE9A7ten40ZR1nOpIDv4549LbxsqCrX3+VMUgVl/8eVj0iLCsKvThhuCRWB9gUfNBlHw4bxvteXMLiqhiuHY4X+8y9N9IlJKLtW6Pf2SedvrPNuTbJvPBog5YaKN63au7q6MNQZdAWhkKgcpgSwPwT4bK/uTsvrk0VAChThsMYUvgGY9NnN0qLlgZzQspFAhnBbnM3kCMjV8zgw8sPh3m8jfei+Hxz3CVF2gFGgcgG259hNjORZDqTXRiRZkVc/TtFXJKsPCuOK1ieGc4m+yqPUMp58tjL09tfAO3jmS4FY/FW4YohLPgtlvs+IFsJ+gh2VHGNNDuHUMwjRsBG/Mg9Ayz37jEphtRbE5Z09BN2b9v9aqzVrmMPW5N1DcaF5+aO8qqumUg3GC1dP7meybanfSF0qGtPH9VE8upqFqUWmaNDlPgPZ6KNwEDJyiAdRtnb2CA9B9ejM1A3BizjzcXMK/nTOs2+b79lmpXs0ziesNvDHuB3hyW8JePmmgBQF0GWx1lPNErBLYCeGKINSpUXn87OE7egKNlhjIEm//GqmPFA565uVkyhFgx/k0yw1FKLFP9M2ToJGScwV/wfIRXtcPioZ92uvrchKK2b756SDNIIR624jeHZioYmXvQMeG+S4vRPFz/QXKKdQ2OVaLhhWz3nocv9FivKb4rGRLm9FxcuGsY6DsiAjyYKkXIfcT/qXgMOnyj1BHBReFcrDHWb8CwMNSJ/tOewmToyIbe/lwbDUB5fOKO11tiXmLvaoSIJDU6k3Ls5z+A3IY/7wQbfwQb7Dnd+4w414ajfdJDJ7SqlBpTCjlrhJzmUXsqd14mlgmcmPBu4I9x8/kiYaIzHXUh3vS9URX2+3ifoXJm+KaiPTiGPJQIhoEH1kDFGm3PTxeFizgqlmQd3nPSDSUDaeE1fg3H2fn4/QxCJYTK2MZhTl52aswDwa8UWiv1zfCmtVLW2/MasVyjcPxu1PfCdGF59VKUQHQg1QJKSCYZ2tZmd+JiRLVSyXoUtyqJ5V4u4lSzhaUv+8ApaHRCVOEh5HwPtaDYVLrdcigxKmiMiqCAGdYEpPD6pn1N+KKCSQx/nhUTRBQ+4CEIEJBz7Yv+LLgkWD0T8tZb9pTAjt8MLNzeglomsAPX/LRkxgXbLUIvlcTH0jvDMPmvLCshzDvtckIzOj4bFdxVEdLo0JA8URFp3oP5pTqZGJXR4fx4Kgl/cXJwyX43VttNDPyc96KIBF33oy8c+z17OyQplcoFzFBpvaqA0cvmcl2BBtI1On4jYsx0VSbqKyOU4JawLcLcAOOTjYyYAC2iGxnn8gSoZF1DK83G/GRF1y23XDeoWSl9WMVgOiK35od3ZRjeaH/5Rq0Nq54bbJE4sN4DyjFJXkDbP10Rj3/BZp88AlFMCZk+9O2bUCbTzyqP9YO9QrgsnWxnms92BRXu/KBL+G9Ya3MH8DOMjXuFkuhN47PeZpMohW9ECVx1jHuC4eIpihh0oZKVBd2mULx48pYIHf8Fp2Ab4fafqUD7Tka4pN9apcZo/u04z5DW9q2S3T+c4G+r4O0y0R1GLDcTvTzVRxyzm2D1t87C9tZ1X3uPkQlechr86l5I4ylNghutX5wPlFSwjxKMy+ZUd09cKKDeG1GMvf5dXmhY4dvxxynFue1Ykq+ymLETogIdn7MZigUs0hjd2QgaQ5H/uarpjb8apovRPqyXUgfGQ06JjZcSCVLTuBeGahi1mI/WR2eM399idK5arUYhmjBIINVu2Wm47tgKiwYYJYdoV3MwbbNudMZDr4MP8HK+TTHmf03CXQId9htKOgJDosnNMiB+QcGGPaV2W5hv4bQ/QwGeFE7ZR+4h4NnrezE1OGfiqLYnCGZcmUl5G8WjMj5DW0nyQ5gHJwS1kitwxYzFwwKPYUv7Y5Sq182HdQ7Ox8wP74XAjlW+1ha5+tcJymNe8H9viPU/Z1QipmuZTgpNop/tLH6gc0qNkTlT2qpM0EY81lqQAB4j3IB9AFk91x+gOBszTXp/w+T1ZgfJ9+btxQnK03EqAPaI6G1n1ifpRg=,iv:O08z9Dz3ywRjsFu3Uu22+87/ZoElw0hmvsYPKYaBFuY=,tag:ph4Zi+Br9cdGIlldKw4TGg==,type:str]
 secretFiles:
-  htpasswd: ENC[AES256_GCM,data:ypD56yI24fQKQpnjVwI8gdU5CrVhXiCGADUfNuv4a0pQ1LoRgPAHQRdzo5lnUd3qYt6EMytVzREr8UNMuYMOgVqLagcMWysC2oGYSc4x+DiBxmNgvfFmOEW8o/CF4qou7ev2SArKuMyuRX90qzkiMp8o3le6eLwbshL/74GNbjwxeKIgq0cx5Q==,iv:nRs/PJSjiE9VBjhzXuWLSPIX0oyJXyexRAyxI9Ex6AY=,tag:MMoAZP9VUO1k3Uzmo/FQAQ==,type:str]
-authHeader: ENC[AES256_GCM,data:Xgix86b5wpqxLN8q/NecVtJ+cpRyYqdxNpFWTz+/yS49gmAzzVBgA56QqZDUKdkw,iv:5HcLyVlmSV6gG74xfewjEFxnqCQuYoiQslqL9gDxFhQ=,tag:R9y3LwvizL9snTXcBaUZ3Q==,type:str]
+    htpasswd: ENC[AES256_GCM,data:qdx8p+CfYhStN+gKUI5Zt5KD5R0AfZQUiERw+SVXgp7+zxYbcj/ZcdKgxLi06U2HJs1QTNdoTx5eDW5QY0CNUMxKdoGM7JSZwr0dckRAT3xGKyMUbzz4CTdi5UOSRX3EtI8F65tCDLWlneFWrWRzGgIOq6gNQV0TqGyzNfQClZ470AanPcpWFg==,iv:vZJF925Zq7xPsV9OLOF5eSMqNwtCc7FNfWNV/AQFdjQ=,tag:P/IezO7b4vYKA82OJUusVw==,type:str]
+authHeader: ENC[AES256_GCM,data:pa9BRXRwPJHQyD0vzQjkgKu8YCbQwFAFgz3swq+Ofl12r5t5JFfKkU35zEKb7wJq,iv:xL2e/6sFxO4/FZRDsBxgzNujsLnIXO4LeEHsscjMIXk=,tag:oeb368hj+PWh9y4pLN2mNg==,type:str]
 sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age:
-    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRHQ3OWNzYm5uWE51ZExY
-        ZU5tWHVnVlFiQS84TXovNllza25GUTdramxvCkwycHR6RXZUSUtZVjZSclJHWlht
-        bXcrOS8wREtla3p0eHBqZFVUdERtU00KLS0tIHNHenRiLzBwQzBOeEpCSWlPVVRi
-        bGRLRkphQnlHeWlPRysxS1JhSmpqd3MKOTrVSZCfw43CTmkUjZ94xHTGRDpdIOCC
-        turoYL+HZAeT81pI6cE4V6id7ep5kjJOVbXY3sLJ1nBNrYw5dscxpQ==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2024-10-14T08:08:22Z"
-  mac: ENC[AES256_GCM,data:UmIKltGrKM5geOIDHAykozPUKeW5fm0rIAb4TO8DZlhx2HA9esT+pWPQRKp8IiS1HogcXdoKT8wJisCZtlJ8xLDyl8dJZitsJ+DQI85QqsxaGzMhK1VnLwIja27MnzapNXplBdZ7wFRON09poY9lfN00QIE8UPqEpHy4aT+OLCE=,iv:m7ao4dl1qfj/FPIBrSaLeWbrJO4t7ssm6ssoYuFzm3g=,tag:cGMrLk99Ac3hFYn6VDytdw==,type:str]
-  pgp: []
-  unencrypted_suffix: _unencrypted
-  version: 3.9.1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5QkNnYjFxN0xVVUFHOEJB
+            NnZicWVWOTg1Z1hGSmNjQU43RG9PNTR5Y2lnCmJLOTQvQndxN1dKV3pyZWdKOFpo
+            V0ZZbjRhK0tIaXVERnBFSFpybUEvNWsKLS0tIEY3d25aTlNCaVpxUCtkdGduN056
+            VFRWdXhMYmd6am9aTXNUYXRaWllpYncKxYAq1sg0mAvAjX7mfekZOcR9y9e5gSF1
+            L74UaXFN/OeQwzqlA0W+EuBeMvj5Xrp7ENconJ0P3ecAFa/t8VujPg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-12T16:13:40Z"
+    mac: ENC[AES256_GCM,data:N6uiTszn+I+L2HmWDLG9/h1sttQQltvfM/7Lq3tdRei6fn6Erog6u8IKbr0guRe/sJdt0SMB0xE9gB46Ldwyv7U+Ut5gMSxrxz7FEZSBeH5ZKegGvmkPIqafwL8frZqwlR/3Kmbegs9yAM9VEZ/qcprx2M4gpffiKTATxbm0rI4=,iv:8OMSYrUxcOeuVnbOXoPgs42QPTXLOICnLvXuSbQBz6k=,tag:QPqwsHn1ktM9O2rsohMIIA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/values.external-dns.yaml

@@ -1,4 +1,15 @@
 provider:
   name: cloudflare
-domainFilter:
+domainFilters:
   - badhouseplants.net
+excludeDomains:
+  - ru.badhouseplants.net
+policy: sync
+txtOwnerId: badhp
+txtPrefix: badhp-ext-dns-
+logFormat: json
+logLevel: info
+sources:
+  - service
+  - ingress
+  - crd

values/badhouseplants/values.loki.yaml

@@ -63,6 +63,10 @@ distributor:
   replicas: 0
 compactor:
   replicas: 0
+gateway:
+  replicas: 1
+  affinity:
+    podAntiAffinity: ~
 indexGateway:
   replicas: 0
 bloomCompactor:

values/badhouseplants/values.minio.yaml

@@ -100,7 +100,7 @@ buckets:
     policy: false
     purge: false
     versioning: false
-  - name: memos
+  - name: stalwart
     policy: false
     purge: false
     versioning: false

values/badhouseplants/values.stalwart.yaml

@@ -1,218 +0,0 @@
-shortcuts:
-  hostname: stalwart.badhouseplants.net
-workload:
-  strategy:
-    type: Recreate
-  initContainers:
-    prepare-config:
-      image:
-        registry: registry.hub.docker.com
-        repository: stalwartlabs/mail-server
-        tag:
-        pullPolicy: Always
-      mounts:
-        files:
-          config:
-            path: /app/config/config.toml
-            subPath: config.toml
-        extraVolumes:
-          etc:
-            path: /app/etc
-      command:
-        - sh
-      args:
-        - -c
-        - cp /app/config/config.toml /app/etc/config.toml
-  containers:
-    stalwart:
-      args:
-        - --config
-        - /app/etc/config.toml
-      mounts:
-        storage:
-          data:
-            path: /app/data
-        extraVolumes:
-          certs:
-            path: /app/certs
-          logs:
-            path: /app/logs
-          etc:
-            path: /app/etc
-      envFrom:
-        - secrets
-storage:
-  data:
-    enabled: true
-    storageClassName: openebs-hostpath
-    size: 1Gi
-    accessModes:
-      - ReadWriteOnce
-extraVolumes:
-  certs:
-    secret:
-      secretName: stalwart.badhouseplants.net
-  etc:
-    emptyDir: {}
-  logs:
-    emptyDir: {}
-ingress:
-  main:
-    annotations:
-      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-      kubernetes.io/ingress.allow-http: "false"
-      kubernetes.io/ingress.class: traefik
-      kubernetes.io/ingress.global-static-ip-name: ""
-      kubernetes.io/tls-acme: "true"
-      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-traefik:
-  enabled: true
-  tcpRoutes:
-    - name: stalwart-smtp
-      service: stalwart-smtp
-      match: HostSNI(`*`)
-      entrypoint: smtp
-      port: 25
-      proxyProtocolVersion: 2
-    - name: stalwart-smpt-startls
-      match: HostSNI(`*`)
-      service: stalwart-submission
-      entrypoint: smtp-startls
-      port: 587
-      proxyProtocolVersion: 2
-    - name: stalwart-imap
-      match: HostSNI(`*`)
-      service: stalwart-imap
-      entrypoint: imap
-      port: 143
-      proxyProtocolVersion: 2
-    - name: stalwart-imaps
-      match: HostSNI(`*`)
-      service: stalwart-imaptls
-      entrypoint: imaps
-      port: 993
-      proxyProtocolVersion: 2
-    - name: stalwart-pop3
-      match: HostSNI(`*`)
-      service: stalwart-pop3
-      entrypoint: pop3
-      proxyProtocolVersion: 2
-      port: 110
-    - name: stalwart-pop3s
-      match: HostSNI(`*`)
-      service: stalwart-pop3s
-      entrypoint: pop3s
-      port: 995
-      proxyProtocolVersion: 2
-files:
-  config:
-    enabled: true
-    sensitive: false
-    remove: []
-    entries:
-      # Ref: https://github.com/stalwartlabs/mail-server/blob/main/resources/config/config.toml
-      config.toml:
-        data: |
-          [lookup.default]
-          hostname = "stalwart.badhouseplants.net"
-
-          [server.listener."smtp"]
-          bind = ["[::]:25"]
-          protocol = "smtp"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."submission"]
-          bind = ["[::]:587"]
-          protocol = "smtp"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."submissions"]
-          bind = ["[::]:465"]
-          protocol = "smtp"
-          tls.implicit = true
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."imap"]
-          bind = ["[::]:143"]
-          protocol = "imap"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."imaptls"]
-          bind = ["[::]:993"]
-          protocol = "imap"
-          tls.implicit = true
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener.pop3]
-          bind = "[::]:110"
-          protocol = "pop3"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener.pop3s]
-          bind = "[::]:995"
-          protocol = "pop3"
-          tls.implicit = true
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."sieve"]
-          bind = ["[::]:4190"]
-          protocol = "managesieve"
-          proxy.override = true
-          proxy.trusted-networks.0 = "192.168.0.0/16"
-
-          [server.listener."https"]
-          protocol = "https"
-          bind = ["[::]:443"]
-          tls.implicit = false
-
-          [server.listener."http"]
-          bind = "[::]:8080"
-          protocol = "http"
-          hsts = true
-
-          [storage]
-          data = "rocksdb"
-          fts = "rocksdb"
-          blob = "rocksdb"
-          lookup = "rocksdb"
-          directory = "internal"
-
-          [store."rocksdb"]
-          type = "rocksdb"
-          path = "/app/data"
-          compression = "lz4"
-
-          [directory."internal"]
-          type = "internal"
-          store = "rocksdb"
-
-          [tracer."stdout"]
-          type = "stdout"
-          level = "info"
-          ansi = false
-          enable = true
-
-          [authentication.fallback-admin]
-          user = "overlord"
-          secret = "%{env:SW_ADMIN_SECRET}%"
-
-          [tracer.console]
-          type = "console"
-          level = "info"
-          ansi = true
-          enable = true
-
-          [certificate."default"]
-          cert = "%{file:/app/certs/tls.crt}%"
-          private-key = "%{file:/app/certs/tls.key}%"
-env:
-  secrets:
-    enabled: true
-    sensitive: true

values/badhouseplants/values.traefik.yaml

@@ -16,7 +16,6 @@ ports:
     proxyProtocol:
       trustedIPs:
         - "192.168.0.0/16"
-      insecure: true
   ssh:
     port: 22
     expose:
@@ -47,9 +46,9 @@ ports:
     exposedPort: 25
     expose:
       default: true
-    proxyProtocol:
-      trustedIPs:
-        - "192.168.0.0/16"
+      proxyProtocol:
+        trustedIPs:
+          - "192.168.0.0/16"
   smtps:
     port: 465
     protocol: TCP

values/badhouseplants/values.velero.yaml

@@ -7,6 +7,13 @@ initContainers:
         name: plugins
 configuration:
   logLevel: error
+  repositoryMaintenanceJob:
+    requests:
+      cpu: 250m
+      memory: 256Mi
+    limits:
+      memory: 256Mi
+    latestJobsCount: 2
   backupStorageLocation:
     - name: hetzner
       provider: aws
@@ -33,8 +40,8 @@ configuration:
       config:
         region: us-east1
         s3ForcePathStyle: true
-        s3Url: https://s3e.badhouseplants.net
-        publicUrl: https://s3e.badhouseplants.net
+        s3Url: https://s3.ru.badhouseplants.net
+        publicUrl: https://s3.ru.badhouseplants.net
   volumeSnapshotLocation:
     - name: hetzner
       provider: aws

values/etersoft/secrets.external-dns.yaml

@@ -1,23 +1,23 @@
 env:
-  - name: ENC[AES256_GCM,data:RLLp8toAkoWLWRjp,iv:UUP3i5QkNBw/pgYmxHtRUDx0E6i42e/Ioh1z6WnLESk=,tag:+PEinrzkisEQx5gVCpdJ3g==,type:str]
-    value: ENC[AES256_GCM,data:RKiCvUOctYha7fusMWNrOKHPgmMMjuejDCip470QMHQcxY1S+yJfXA==,iv:ESfZNZimJkD5T4tzRPMu53H+ushbhOuXaOdX73MaWV0=,tag:F516VFRCw6k589vClX8Jfw==,type:str]
+    - name: ENC[AES256_GCM,data:I+XVWWOUmm7Cd4mQ,iv:rfUzb5HMPVyNfzkCP2frVDxD+v4lTPzILRifcS3uG6s=,tag:1sXONdAjMZ85S8abMVZM1A==,type:str]
+      value: ENC[AES256_GCM,data:h8sYBvFfm7uFoklqXE7QLNkikl1ihHz/KN4uYiZlRJBZkiUBbTk/Vg==,iv:/y6RdHVWwwBym5HiBaxEatTWG7I/gNY9ZIaQc4bk9h0=,tag:PytkOjvY3fy6XeLNmGPrXA==,type:str]
 sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age:
-    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3eE5LTURCa1pyRjBocVpP
-        ZGxXMUZkUC9XK0xNb2duRnJiOHNzNGp0YXdrCkNvNWMvYWkyTHhQU1ZZeng2bmlz
-        bGRrd3p2dmx6MjBuc0lYakhMNERMOVUKLS0tIGpsRHcxdUFtTHlXVGZLTEZ0c0ov
-        b0RMSlFCM250MXJHbWhRTWtGbkxHc0kKpyzba8yp0xN1KjcUACcmlznH9vQtYAsL
-        3bm7Cw2AZO7nkdCxky/ITd8N3rbqAVGeM2CeTAxpcMbEXKq66/yqDA==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2024-10-15T15:21:16Z"
-  mac: ENC[AES256_GCM,data:aIXlmeiqaFu9Jn0zI1qyU3iAkhLKgqMwwLcLDlr+LeYX/88cZtzgP683jW3MYC/LxnNh4LG7v8EK/HViNnCkrvZ5iC9cibRPQYZJrkR3B3oGk4L+RxPws2VUa72pJsG0bQ8M2DDCoDO2T9OuuflqYENPLyYLL7D7CaeSj9w8G0A=,iv:EDaGmWFUnzp0vkIeR1J8iZ9+PjOMuRi4YltoqJAN0P0=,tag:DsSd6Nplvy0nIWaCJgnhgg==,type:str]
-  pgp: []
-  unencrypted_suffix: _unencrypted
-  version: 3.9.1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBra0RUWVFDUXN0ejAxemE2
+            VFlRcEtLNDJUblA3ZmoyMExPWWpjZzlVYjJzCnZVZDNSbnpjcFRUQ0hOMWxLNUZi
+            RTg5Z2JVZzVoVFVYSVErcWdnbHVvVVkKLS0tIHdZMjVsc3lHRzlJODRWSEh0Wm8w
+            M09rOXZ3OHZVUUVlWWIwaTN0Z2RqRmcKe1ny6FJIFwR6Un0HBFZK2KXkzUQA63rU
+            JR7mpEzr2h2oXxOmyc7HeFFi2R66zendFzfhNcvSlm2L5td2Pnxyxg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-16T14:21:42Z"
+    mac: ENC[AES256_GCM,data:SNHNvmPCt/6Xwd6xoCh5uHF1erhWpTfzEQ/krTvYtByvT7XvDtXjtslJqAa8RkNPl2QV34epWcj/Ff6xud9tvLdAR4Gj4MPJD8WBLUUFul4rvoXfaHyHhSanYmiOhdF0mArE81qsBY918LFS5fdWMrxCNDrHbDtW76KBoLcDUto=,iv:8/ZxjrER1151RGjSdICVjj8ptyQn60SInakqABXWQZE=,tag:/bQsE3TCXoMbXoAF1UErOw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/etersoft/values.external-dns.yaml

@@ -1,5 +1,7 @@
 provider:
   name: cloudflare
-domainFilter:
-  - badhouseplants.net
-  - nrodionov.info
+policy: sync
+txtOwnerId: eter
+txtPrefix: eter-ext-dns
+logFormat: json
+logLevel: info

values/etersoft/values.minio.yaml

@@ -9,11 +9,11 @@ ingress:
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
   path: /
   hosts:
-    - s3e.badhouseplants.net
+    - s3.ru.badhouseplants.net
   tls:
-    - secretName: s3e.badhouseplants.net
+    - secretName: s3.ru.badhouseplants.net
       hosts:
-        - s3e.badhouseplants.net
+        - s3.ru.badhouseplants.net
 consoleIngress:
   enabled: true
   ingressClassName: traefik
@@ -25,16 +25,16 @@ consoleIngress:
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
   path: /
   hosts:
-    - min.e.badhouseplants.net
+    - minio.ru.badhouseplants.net
   tls:
-    - secretName: min.e.badhouseplants.net
+    - secretName: minio.ru.badhouseplants.net
       hosts:
-        - min.e.badhouseplants.net
+        - minio.ru.badhouseplants.net
 rootUser: "overlord"
 replicas: 1
 mode: standalone
 environment:
-  MINIO_SERVER_URL: "https://s3e.badhouseplants.net"
+  MINIO_SERVER_URL: "https://s3.ru.badhouseplants.net"
 tls:
   enabled: false
   certSecret: ""

values/etersoft/values.qbittorrent.yaml

@@ -24,13 +24,13 @@ ingress:
       traefik.ingress.kubernetes.io/router.middlewares: applications-torrentauth@kubernetescrd
     enabled: true
     hosts:
-      - host: tor.e.badhouseplants.net
+      - host: tor.ru.badhouseplants.net
         paths:
           - path: /
     tls:
-      - secretName: tor.e.badhouseplants.net
+      - secretName: tor.ru.badhouseplants.net
         hosts:
-          - tor.e.badhouseplants.net
+          - tor.ru.badhouseplants.net
 persistence:
   config:
     annotations:

values/etersoft/values.server-xray-public.yaml

@@ -1,13 +1,13 @@
 certificate:
   enabled: true
   certificate:
-    - name: xray-public-e.badhouseplants.net
-      secretName: xray-public-e.badhouseplants.net
+    - name: xray-public.ru.badhouseplants.net
+      secretName: xray-public.ru.badhouseplants.net
       issuer:
         kind: ClusterIssuer
         name: badhouseplants-issuer-http01
       dnsNames:
-        - xray-public-e.badhouseplants.net
+        - xray-public.ru.badhouseplants.net
 
 traefik:
   enabled: true
@@ -18,7 +18,7 @@ traefik:
       entrypoint: xray-internal
       port: 443
 shortcuts:
-  hostname: xray-public-e.badhouseplants.net
+  hostname: xray-public.ru.badhouseplants.net
 ingress:
   main:
     enabled: true
@@ -33,7 +33,7 @@ ingress:
 extraVolumes:
   certs:
     secret:
-      secretName: xray-public-e.badhouseplants.net
+      secretName: xray-public.ru.badhouseplants.net
 
 workload:
   replicas: 2

values/etersoft/values.uptime-kuma.yaml

@@ -9,12 +9,12 @@ ingress:
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
     external-dns.alpha.kubernetes.io/ingress-hostname-source: defined-hosts-only
   hosts:
-    - host: uptime.e.badhouseplants.net
+    - host: uptime.ru.badhouseplants.net
       paths:
         - path: /
           pathType: ImplementationSpecific
 
   tls:
-    - secretName: uptime.e.badhouseplants.net
+    - secretName: uptime.ru.badhouseplants.net
       hosts:
-        - uptime.e.badhouseplants.net
+        - uptime.ru.badhouseplants.net

values/etersoft/values.vaultwardentest.yaml

@@ -1,5 +1,5 @@
 shortcuts:
-  hostname: vaulttest.badhouseplants.net
+  hostname: vaulttest.ru.badhouseplants.net
 ext-database:
   enabled: true
   name: vaultwardentest-postgres16
@@ -35,7 +35,7 @@ ingress:
       kubernetes.io/ingress.global-static-ip-name: ""
       cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
     rules:
-      - host: vaulttest.badhouseplants.net
+      - host: vaulttest.ru.badhouseplants.net
         http:
           paths:
             - backend:
@@ -47,8 +47,8 @@ ingress:
               pathType: Prefix
     tls:
       - hosts:
-          - vaulttest.badhouseplants.net
-        secretName: vaulttest.badhouseplants.net
+          - vaulttest.ru.badhouseplants.net
+        secretName: vaulttest.ru.badhouseplants.net
 extraVolumes:
   logs:
     emptyDir: {}
@@ -64,7 +64,7 @@ env:
     enabled: true
     sensitive: false
     data:
-      DOMAIN: https://vaulttest.badhouseplants.net
+      DOMAIN: https://vaulttest.ru.badhouseplants.net
       #SMTP_HOST: mail.badhouseplants.net
       #SMTP_SECURITY: "starttls"
       #SMTP_PORT: 587

workdir/ingress.yaml

@@ -1,30 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/issuer: my-ca-issuer
-    kubernetes.io/ingress.allow-http: "false"
-    kubernetes.io/ingress.class: traefik
-    kubernetes.io/ingress.global-static-ip-name: ""
-    kubernetes.io/tls-acme: "true"
-    meta.helm.sh/release-name: minio
-    meta.helm.sh/release-namespace: platform
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-  name: minioself
-  namespace: platform
-spec:
-  rules:
-    - host: s3self.badhouseplants.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: minio
-                port:
-                  number: 9000
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - s3self.badhouseplants.net
-      secretName: s3-tls-secret

workdir/sandbox.yaml

@@ -1,30 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: selfsigned-issuer
-spec:
-  selfSigned: {}
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: my-selfsigned-ca
-spec:
-  isCA: true
-  commonName: my-selfsigned-ca
-  secretName: root-secret
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  issuerRef:
-    name: selfsigned-issuer
-    kind: ClusterIssuer
-    group: cert-manager.io
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: my-ca-issuer
-spec:
-  ca:
-    secretName: root-secret