chore(deps): update postgresql docker tag to v16.4.14

charts/tf-ocloud/Chart.yaml

@@ -9,7 +9,7 @@ maintainers:
     url: https://badhouseplants.net
 dependencies:
   - name: helm-library
-    version: 0.2.3
+    version: 0.1.5
     repository: oci://ghcr.io/allanger/allangers-helm-library
 annotations:
   allowed_workload_kinds: "Deployment"

common/environments.yaml

@@ -41,6 +41,52 @@ environments:
           enabled: false
       - redis:
           enabled: false
+      - postgres16:
+          enabled: true
+      - istio:
+          enabled: false
+  xray-1:
+    kubeContext: xray-1
+    values:
+      - base:
+          enabled: false
+      - velero:
+          enabled: false
+      - workload:
+          enabled: false
+      - backups:
+          enabled: false
+      - openebs:
+          enabled: false
+      - localpath:
+          enabled: false
+      - postgres17:
+          enabled: false
+      - redis:
+          enabled: false
+      - postgres16:
+          enabled: false
+      - istio:
+          enabled: false
+  xray-2:
+    kubeContext: xray-2
+    values:
+      - base:
+          enabled: false
+      - velero:
+          enabled: false
+      - workload:
+          enabled: false
+      - backups:
+          enabled: false
+      - openebs:
+          enabled: false
+      - localpath:
+          enabled: false
+      - postgres17:
+          enabled: false
+      - redis:
+          enabled: false
       - postgres16:
           enabled: false
       - istio:

installations/applications/helmfile-badhouseplants.yaml

@@ -12,13 +12,13 @@ repositories:
     url: git+https://gitea.badhouseplants.net/badhouseplants/badhouseplants-helm@charts?ref=main
   - name: bedag
     url: https://bedag.github.io/helm-charts/
-    #- name: open-strike
-    #  url: git+https://gitea.badhouseplants.net/badhouseplants/open-strike-2.git@helm?ref=main
+  - name: open-strike
+    url: git+https://gitea.badhouseplants.net/badhouseplants/open-strike-2.git@helm?ref=main
 
 releases:
   - name: gitea
     chart: gitea/gitea
-    version: 11.0.0
+    version: 10.6.0
     namespace: applications
     inherit:
       - template: default-env-values
@@ -28,7 +28,7 @@ releases:
 
   - name: app-vaultwarden
     chart: allangers-charts/vaultwarden
-    version: 3.1.1
+    version: 3.0.0
     namespace: org-badhouseplants
     inherit:
       - template: env-values
@@ -42,19 +42,10 @@ releases:
       - template: env-values
       - template: env-secrets
 
-  - name: app-tandoor-recipes
-    chart: allangers-charts/tandoor-recipes
-    version: 0.2.0
-    namespace: org-badhouseplants
-    inherit:
-      - template: env-values
-      - template: env-secrets
-      - template: ext-database
-
   - name: navidrome
     chart: allangers-charts/navidrome
     namespace: applications
-    version: 0.4.0
+    version: 0.2.0
     inherit:
       - template: default-env-values
       - template: ext-traefik-middleware
@@ -62,7 +53,7 @@ releases:
   - name: navidrome-private
     chart: allangers-charts/navidrome
     namespace: applications
-    version: 0.4.0
+    version: 0.2.0
     inherit:
       - template: default-env-values
       - template: default-env-secrets
@@ -70,7 +61,7 @@ releases:
   - name: server-xray-public
     chart: allangers-charts/server-xray
     namespace: public-xray
-    version: 0.6.0
+    version: 0.5.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values
@@ -82,7 +73,7 @@ releases:
     chart: allangers-charts/server-xray
     installed: true
     namespace: public-xray
-    version: 0.6.0
+    version: 0.5.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values
@@ -92,7 +83,7 @@ releases:
 
   - name: memos
     chart: allangers-charts/memos
-    version: 0.2.0
+    version: 0.1.0
     namespace: applications
     inherit:
       - template: default-env-values

installations/applications/helmfile-etersoft.yaml

@@ -11,9 +11,16 @@ repositories:
   - name: xray-docs
     url: git+https://gitea.badhouseplants.net/badhouseplants/xray-docs.git@helm?ref=main
 releases:
+  - name: openvpn
+    chart: allangers-charts/openvpn
+    version: 0.0.2
+    namespace: applications
+    inherit:
+      - template: default-env-values
+      - template: ext-tcp-routes
   - name: qbittorrent
     chart: gabe565/qbittorrent
-    version: 0.4.1
+    version: 0.4.0
     namespace: applications
     inherit:
       - template: default-env-values
@@ -21,11 +28,21 @@ releases:
       - template: ext-traefik-middleware
   - name: vaultwardentest
     chart: allangers-charts/vaultwarden
-    version: 3.1.1
+    version: 2.4.0
     namespace: applications
     inherit:
       - template: default-env-values
       - template: default-env-secrets
+      - template: ext-database
+
+  - name: nrodionov
+    chart: bitnami/wordpress
+    version: 23.1.28
+    namespace: applications
+    installed: true
+    inherit:
+      - template: default-env-values
+      - template: default-env-secrets
 
   - name: external-service-xray
     chart: ../../kustomizations/external-service-xray
@@ -35,7 +52,7 @@ releases:
   - name: server-xray-public
     chart: allangers-charts/server-xray
     namespace: public-xray
-    version: 0.6.0
+    version: 0.5.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values

installations/applications/helmfile-xray-1.yaml

@@ -9,7 +9,7 @@ releases:
   - name: server-xray-public
     chart: allangers-charts/server-xray
     namespace: public-xray
-    version: 0.6.0
+    version: 0.5.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values

installations/applications/helmfile-xray-2.yaml

@@ -9,7 +9,7 @@ releases:
   - name: server-xray-public
     chart: allangers-charts/server-xray
     namespace: public-xray
-    version: 0.6.0
+    version: 0.5.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values

installations/databases/helmfile.yaml

@@ -12,7 +12,7 @@ releases:
     chart: bitnami/redis
     namespace: databases
     condition: redis.enabled
-    version: 20.10.0
+    version: 20.7.1
     inherit:
       - template: default-env-values
       - template: default-env-secrets
@@ -22,7 +22,7 @@ releases:
     namespace: databases
     chart: bitnami/postgresql
     condition: postgres16.enabled
-    version: 16.4.16
+    version: 16.4.14
     inherit:
       - template: default-env-values
       - template: default-env-secrets
@@ -32,7 +32,7 @@ releases:
     namespace: databases
     chart: bitnami/postgresql
     condition: postgres17.enabled
-    version: 16.4.16
+    version: 16.4.14
     inherit:
       - template: default-env-values
       - template: default-env-secrets

installations/games/helmfile.yaml

@@ -13,7 +13,7 @@ releases:
   - name: minecraft
     chart: minecraft/minecraft
     namespace: games
-    version: 4.24.0
+    version: 4.23.7
     inherit:
       - template: ext-tcp-routes
       - template: default-env-values

installations/monitoring/helmfile.yaml

@@ -12,7 +12,7 @@ releases:
   - name: prometheus
     chart: prometheus-community/kube-prometheus-stack
     namespace: observability
-    version: 69.6.0
+    version: 68.5.0
     inherit:
       - template: default-env-values
       - template: default-env-secrets
@@ -20,7 +20,7 @@ releases:
   - name: grafana
     chart: grafana/grafana
     namespace: observability
-    version: 8.10.1
+    version: 8.9.0
     installed: true
     inherit:
       - template: default-env-values
@@ -28,7 +28,7 @@ releases:
   - name: loki
     chart: grafana/loki
     namespace: observability
-    version: 6.27.0
+    version: 6.25.1
     inherit:
       - template: default-env-values
       - template: ext-secret

installations/pipelines/helmfile.yaml

@@ -12,7 +12,7 @@ releases:
   - name: woodpecker-ci
     chart: woodpecker/woodpecker
     namespace: pipelines
-    version: 3.0.4
+    version: 3.0.1
     inherit:
       - template: ext-database
       - template: default-env-values
@@ -20,7 +20,7 @@ releases:
   - name: renovate-gitea
     chart: renovate/renovate
     namespace: pipelines
-    version: 39.185.0
+    version: 39.171.0
     inherit:
       - template: default-env-values
       - template: default-env-secrets
@@ -28,7 +28,7 @@ releases:
     chart: renovate/renovate
     installed: false
     namespace: pipelines
-    version: 39.185.0
+    version: 39.171.0
     inherit:
       - template: default-env-values
       - template: default-env-secrets

installations/platform/helmfile.yaml

@@ -30,7 +30,7 @@ releases:
   - name: db-operator
     namespace: platform
     chart: db-operator/db-operator
-    version: 1.34.0
+    version: 1.32.0
 
   - name: db-instances
     chart: db-operator/db-instances
@@ -55,7 +55,7 @@ releases:
 
   - name: authentik
     chart: goauthentik/authentik
-    version: 2025.2.1
+    version: 2024.12.3
     namespace: platform
     createNamespace: false
     condition: workload.enabled
@@ -79,7 +79,7 @@ releases:
     namespace: kyverno
     labels:
       bootstrap: true
-    version: 3.3.7
+    version: 3.3.6
 
   - name: kyverno-policies
     chart: kyverno/kyverno-policies

installations/system/helmfile.yaml

@@ -45,14 +45,14 @@ releases:
 
   - name: coredns
     chart: coredns/coredns
-    version: 1.39.1
+    version: 1.39.0
     namespace: kube-system
     inherit:
       - template: default-common-values
 
   - name: cilium
     chart: cilium/cilium
-    version: 1.17.1
+    version: 1.17.0
     condition: base.enabled
     namespace: kube-system
     needs:
@@ -62,7 +62,7 @@ releases:
 
   - name: cert-manager
     chart: jetstack/cert-manager
-    version: v1.17.1
+    version: v1.17.0
     namespace: kube-system
     condition: base.enabled
     missingFileHandler: Warn
@@ -115,7 +115,7 @@ releases:
 
   - name: traefik
     chart: traefik/traefik
-    version: 34.4.0
+    version: 34.3.0
     condition: base.enabled
     namespace: kube-system
     needs:
@@ -127,7 +127,7 @@ releases:
   - name: velero
     chart: vmware-tanzu/velero
     namespace: velero
-    version: 8.4.0
+    version: 8.3.0
     condition: velero.enabled
     needs:
       - kube-system/cilium
@@ -140,7 +140,7 @@ releases:
     chart: openebs/openebs
     condition: openebs.enabled
     namespace: kube-system
-    version: 4.2.0
+    version: 4.1.3
     needs:
       - kube-system/cilium
     inherit:

kustomizations/kyverno/etersoft/pvc-patch.yaml

@@ -1,7 +1,7 @@
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
-  name: append-node-name-to-pvc
+  name: replace-storage-class-by-openebs
 spec:
   rules:
     - name: replace-storage-class
@@ -11,7 +11,7 @@ spec:
               kinds:
                 - PersistentVolumeClaim
               namespaces:
-                - applications
+                - application
                 - platform
       mutate:
         patchStrategicMerge:

values/badhouseplants/org-badhouseplants/app-tandoor-recipes/secrets.yaml

@@ -1,25 +0,0 @@
-env:
-    secrets:
-        data:
-            SECRET_KEY: ENC[AES256_GCM,data:bLecWaJafPbXT2/dvKt3R2KNfuxxgQ6yLxviYbOf,iv:liuexfgYScH+eg/qSO23SQxE7hKpudgkOH3JRDkaa+A=,tag:DEcAbY6rg7mQnhsnukWtFA==,type:str]
-            SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:kx9ziZhxWcWTu1UG7BPi/sdG1tHhzugq65xxL3IPVx8i1oHXwy+00KaOEsIYP+TJqX5516Zq6JqtXe9dQwI4uVIy538FdXeEQDHKNS0xesSx8jG0tKa71GiqyQGBrBBxiy144za9y1QHB9k1pvuaza8mVEQOoktmMFfiHzEOhYDQxIzTulOMWxN2ImTsYSupHS6HLR13gDCyROVDzj1Io/U1VHxN5RZBPiqthNiB+/Aj+2FuCwAaxgEE6VVNFJlghi2yiZbl/PvZ3MDT+dAx/NijawVt0qdBBmPvB3jKZkgRN2tyystGiu47hnLosuzjrOjAMA6rP7XkT2gQ5e6hoLlJxWD5IiAHI+gQK7REbyJrEmSwwH0aCVsd1H4FOBNk+rfKpTIr7sRZFTVcZLtUdTZW6EW0XWmrBBPr5jodmouoFZY+dGlWP1vQkG+2eymw5aJCan0oq+x+J9dB+CVZc/2M1zBeRa6Crg7w3smCqOr46jkaRxfoDxV2NdRSla5zkwwFSS7MqPYlqre2oW+pgP7lvRa4MW9++5q+Zg==,iv:RZMNm66PhTWvjJG5jtpJW22TFInHw8LT04qui3fMLgA=,tag:ETMqmFO/8Kve/W55WP21dA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcTM5RTNIakwwZHNrQXE2
-            U2FsK1gwMDhUTDd1MVorbENtQXdnZjYrM1c4CmNQaG5TcU9wK25qQUg5a29UUXBK
-            WlZHK0M0dHEvZWVyZmJzR0RLU1pGWmMKLS0tIGk4TFArQnJyTWJJa3FJRlJhY0do
-            ZE81bENWM3ZUdlR0N2RKMnJkUnJxSG8Ky2ngwj6ZnToGhnAJChU8NXUG+XPPZc2F
-            fOD35BFO5bUNe+V8MkDLae+GQ1hr55r4WnvFpSWywRIjCFYmUJHTgQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-22T12:32:43Z"
-    mac: ENC[AES256_GCM,data:khcLV/lPaY6J5QQmX8466jx9bsXn+NwA3TLIUYs9ipKa539OjIWstwyydVxILSBCwEWGEW86c8EzLBwptBBgg6gehfRJAax5TAn0lBd1lAAiAxZhdNpc2tfoaMaUWfWdpwYjdrtnvAlAkN3/16nvx+TIq7WdU/cWsic96PqhU0A=,iv:I81QvtZ7S+mSAzoXhU0YBMN0L4K+SRHW3UtcSLxwK5s=,tag:gAeAIjyJ13A8gfE7ppBeRg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4

values/badhouseplants/org-badhouseplants/app-vaultwarden/secrets.yaml

@@ -1,14 +1,14 @@
 config:
     env:
         secrets:
-            enabled: ENC[AES256_GCM,data:C4TSoQ==,iv:kG2QtaNWHSc2sdhzo8HnMnPE0Mixqs1dvFsAcke/Gw4=,tag:HhbVmIw5RQ9hipQqZ5J2pw==,type:bool]
-            sensitive: ENC[AES256_GCM,data:0wVOUg==,iv:FGxAd9h2e0LeWukZR/THhCscF3FWoK4dnkrX1mqSC+A=,tag:0rpeedT6x2V79WB5xRNbuA==,type:bool]
+            enabled: ENC[AES256_GCM,data:hwTU7Q==,iv:1/GEM3RSfu11iQVA5uEm/PoZm3Vr6CZ1w7Qc4edUqgc=,tag:gAUwZ4IekLiyyPZoM8FlLQ==,type:bool]
+            sensitive: ENC[AES256_GCM,data:tbFk/g==,iv:FaKXMZxlcdGB3YI5+RC9LZR7S9FNZ87yPrJZsDJlhqw=,tag:+V77+cV4fRLTzi75o5OYQg==,type:bool]
             data:
-                SMTP_USERNAME: ENC[AES256_GCM,data:82zb,iv:Z89+Wt6jGMQTZ73ghk1Ey504WYt2Li9XQ2gaH0SB8tI=,tag:RmqHxghik75E9LAABzyVxA==,type:str]
-                ADMIN_PASSWORD: ENC[AES256_GCM,data:ELi8dtNa/OhQKgrXbrgwHK95ntZjyzRSvQ==,iv:IVZbXZlFyCRMc3bW81Ak9UdjeGke0px9mGqrmaW7EHk=,tag:9xli08c0pqnxu2ktTbCMcg==,type:str]
-                ADMIN_TOKEN: ENC[AES256_GCM,data:CAAalqRcu9vsM1bjC76enJCSX/tc7yOd48mxGV0d5rTFxQz08b4JVhKyMzl7BRog7+PMtJkkTnRIXZHgj31FqhRylmHyuAn3iPc=,iv:PpZvZMhOEt6ecdkBcvAOSz+eZktPAzaAlYNjBSgiN/w=,tag:apHKw66HG7TYnpBNVyM7xA==,type:str]
+                SMTP_USERNAME: ENC[AES256_GCM,data:Bq10,iv:h17Bam1uR/dhz9um0ixzVPKHlqY5GtU6V2+CjTPvuaw=,tag:x+WCQVTySTyHAkoooZg2NA==,type:str]
+                ADMIN_PASSWORD: ENC[AES256_GCM,data:eeJY2z6+Is3+PtZsRC6oyrJ9ArPMBpa2VQ==,iv:hHf/6AYUT3wHbKHPd3dfiTbmoaWr5OSnnRC68/15A90=,tag:qEQyvC+MiAdy3GcpYBIWFQ==,type:str]
+                ADMIN_TOKEN: ENC[AES256_GCM,data:pMh4vnJ6t80okBE5ywe+8LBSb5U9owebWuavCYPwqQ7bpB7qNfYijTbWS0afZGag4wEeTe4t49dNeFTEZ0ztrfm4yXyKcLFCV1E=,iv:RmV55yv8ytW/LvuuK9IPTsKPPdgiIdKX5PnkF5YCKBc=,tag:uRsiwnhYm/1lRfhDjDKqJA==,type:str]
                 DATABASE_URL: null
-                SMTP_PASSWORD: ENC[AES256_GCM,data:g212PzN9/4hxBKMAWFNiR0qAnPPK/tkffg==,iv:1l6dikIQGSjznW9MsaCTdz0wLJmAhiL0ZOdN2J4Q0yA=,tag:tNbPdORUa6IBWgh0HHaNjA==,type:str]
+                SMTP_PASSWORD: ENC[AES256_GCM,data:xx56/9ha07j5fcwDBuzOuFiS6PG1JHE7rQ==,iv:bT47zy9xk5eNz/CCRV5WEy0PAiFsBBxUxkZTCRASfE0=,tag:h3V9peXifp9lT/84TzWKLw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -18,14 +18,14 @@ sops:
         - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoLys3dkJDK2lrQ0d4ZlJi
-            eFRTSmx1RUtZRnpxdkNvVFFCeXl6dDcvWXdvCitoNkcwVFFxRVJ6dkNUbGVPb1pU
-            b3E4ZjZibFF6QytNdUhXNDFLZXRpSEUKLS0tIHpZTmFXNnptVzJmZFhIU2haRWhR
-            UjNEN1BlREFVak1xdmQzaFY1dHVyM3cKuvMIrQUL1cuw3Odz/Cv+kZV9ZZzBozSW
-            XimhDSkxNrH5OsGC1Jxz/8JOv8abBs4NROzffVdyqtZZzXOLzw3mJQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoaG8vRkM1cll5VDlUVW5v
+            WVA0SjdaOWkrTVoydERvcmFjN3ppTjFQdEZvClZENVpYWXMwTVoyOXFYL0xSRGFw
+            NnZDWUM1MGNla3daMU42dEptZzkrWUEKLS0tIG0reXRYMmpuOVZWbXJTbXYyaWJK
+            TE1rZDJ0QmY4VXJSZXoxMTRkNFgrZncK2AL7+jWWeEiV4ERoaCN9M4H1qlzz9i+F
+            23w3rtioCm2hJcBCnswU8Bs7OsBZqC8++35V1U54WktynWnPUcjcrw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-02T08:58:16Z"
-    mac: ENC[AES256_GCM,data:px+D6tlAZU6GzlE8/jLc0BaPyRwsfE1jRROy2mX7bhFTIW3lZqt/zangO46fFH5hXZjY5wLNIktCDbawIbUFwAp0vrmXxctZoAftl9hpdtW6ann3yfyv3pdcs7/BKu3s5QUswx6D13iLU0dvzyG4vGcQNmKpxuPQYLuDp2o74hM=,iv:2Y+wsS7QcgQ/8umZ+a21QjU25Yq24Y7UWjXVy9Gmvoo=,tag:APVtby5NCOQxrPAjIbMJ+w==,type:str]
+    lastmodified: "2024-12-29T11:38:09Z"
+    mac: ENC[AES256_GCM,data:d9902N6sfF3aMokh9rZemL97i2hkwoPdAaJOoy/xFvFyDa2pxKuhwGJH4QU6JRnoqtay1HtnHsDXLggdxHgmUbUtNReVQdPbJhSHRhlDsuAM2ed+GCnecFQE9ggpRnwDn1wjemBqpn40uo9ka4XyMtuLJ9uaHqXRuFR+8y8oW18=,iv:EspFcGUXPgtgXzEWB1fE5O3ig0JJBIca+b6LLb9wJ0s=,tag:6UexlW0uVZUUG/zleiXnZQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.2

values/badhouseplants/secrets.minio.yaml

@@ -1,33 +1,33 @@
-rootPassword: ENC[AES256_GCM,data:edKknfs0kqBVSTQ4CQUdRdKH22c=,iv:PcSajWchrPOfdPek9OP5s0nfWlFWToHTfLZ89iBZeSs=,tag:5kK4eHmNza1arao76EVHzA==,type:str]
+rootPassword: ENC[AES256_GCM,data:CtIVMGYDrJ55wS6ZfLipEur8VeM=,iv:Vz4o+1JInlowgKwYN1bI9oxhTm/Yq8B5uhxIBh3SZ10=,tag:xyH66UMou4nalSzGps60Kw==,type:str]
 users:
-    - accessKey: ENC[AES256_GCM,data:mjmjYJCJofI=,iv:4nN3dt4CKACC7C1/Zfn76SixKmTW4NUxDj+WWbp4DSo=,tag:4lNCTXo+isM+/crCNRtEyA==,type:str]
-      secretKey: ENC[AES256_GCM,data:qkQbZVszNgwmjSvtMtNlEjVBKw==,iv:k+xYu3RFJNovJMBrNqO7QICIvkhe0niHnbGSEwaXe9s=,tag:A2j4EgUB4+3ywZMbroydUw==,type:str]
-      policy: ENC[AES256_GCM,data:KOG9rF5sQtA=,iv:g+KBqLtKBmuj8saUomFjewp1/MiTqXNqxOua2rL19yc=,tag:ibsvSJsGbNuqp5Q8azpcog==,type:str]
-    - accessKey: ENC[AES256_GCM,data:JvnF,iv:T2eXmfOvFInwpsHzrV4oY9vTsJkdHKvb4+UEriunGQw=,tag:MEudOOKBDi42DU+w7K8MEQ==,type:str]
-      secretKey: ENC[AES256_GCM,data:NVFcExw9K2Xw5SbtvXLh3OfoGXNe0IhGmA==,iv:lW0gJ/l3v6BWGCKK/W8B/T2cWq9i6akk2gcsxqPAJpU=,tag:4hxkcaOBc8lHwkMQbzXCbg==,type:str]
-      policy: ENC[AES256_GCM,data:TzNg,iv:/5IRuuS/lO0eo9dos0nNjFoar9PPYlDna5G0dezORvg=,tag:5vyT7jsmU561wFh5NXXG7w==,type:str]
-    - accessKey: ENC[AES256_GCM,data:42SdqYzhNp6Q,iv:pzLnTOITSXJQ8mSNEE+H7EMpa/KO3+W2WJndRgs96Ps=,tag:fZBGTCRPvjRny9FcpvUEmg==,type:str]
-      secretKey: ENC[AES256_GCM,data:J7qAgeWCk6ASt5xBqyrlRNbzQWc=,iv:KC2rpT+lZMyWCch32ycvDtCtqtEWPst/xt5KE1kfYuQ=,tag:9K/Aj54OrbC2qeRWE1bXYg==,type:str]
-      policy: ENC[AES256_GCM,data:DOlqPrIkMCai,iv:q6lULKICvr74qPC/hp90E0XBOFNEs9sYZGfMkcfGZx8=,tag:grNwZst6JUXTpirYIz2XAw==,type:str]
-    - accessKey: ENC[AES256_GCM,data:sy6+E6w=,iv:oHZeQp3BwjB94V/sYxqH5d2L60QMI9m4ZrbolKLRBC4=,tag:7huBXPr027Sn3agLTMd28A==,type:str]
-      secretKey: ENC[AES256_GCM,data:BD4AjbQj9EEK9tKuyaD2OQ2Xrdjg0OlYpw==,iv:52AzwMOA97K40T+QbJ+0Pr4yNdNLw+yfWDEXsEWyIpM=,tag:j+CUMCoUykq05i81C8kEiw==,type:str]
-      policy: ENC[AES256_GCM,data:+BUO1Qo=,iv:kH4rHe5wb0xqOfI2vBGXcyMSCzuSEOCYZ1D8P+7KcnY=,tag:l3twpA6C+gvDZv4qeevVsQ==,type:str]
-    - accessKey: ENC[AES256_GCM,data:FAtE8kxRyrLC,iv:M2O1MPh1s0r1gNof/2oUybxQxDIOTR3HNfFOLyi6kPA=,tag:gf5HJZbfmn2XTutqeAo0uw==,type:str]
-      secretKey: ENC[AES256_GCM,data:GV4Hrq5p1mh3chle1XrvlTpPn7EGQFy1tQ==,iv:xYTNNavejVJmtKLPS9OzFbamcZaz+eRtAn68gGddby0=,tag:HkareuwAwA7QWE6mLO4Bug==,type:str]
-      policy: ENC[AES256_GCM,data:iHNhp3SM29lZ,iv:/y927HxGNOVuayMc1hl8DB/l8l5ioMXb0Fkf7RAA2qw=,tag:w0oC4RgAmYKaWq5sredNTQ==,type:str]
-    - accessKey: ENC[AES256_GCM,data:u2jY6VH7W3c=,iv:vR5C1FqK5wxY2QXxKKxaaadoWqPptxtLUGsjmyq0q/E=,tag:enHvPhEd6KahnVq6KjFhQw==,type:str]
-      secretKey: ENC[AES256_GCM,data:BQTRMAKezwRAtLE3jhFK71Cp,iv:M1VmxliYG0+VNuiDr++hJPe2fa/X32ZJCYAD/VDwYNU=,tag:8jIzJHhE5k7QAjm8vnlYrQ==,type:str]
-      policy: ENC[AES256_GCM,data:6qgyKj01Big=,iv:wB3Adf71VPXTu668fq+yLT2gCPru6nDVqqdnh63OfCs=,tag:d5xLh1eLZEXxksg/DxfVHQ==,type:str]
+    - accessKey: ENC[AES256_GCM,data:wqwCa8NXAns=,iv:3oVMHIJ06q8OdpdufDH2R1CnV83ltweluMIFEplnoGw=,tag:1uLJAU0u+gMXHxBRbJ7mrg==,type:str]
+      secretKey: ENC[AES256_GCM,data:JnqlayhzqKro+tdDY70//ty9pg==,iv:2Vu8ZxKR3gMHQ99AbP5HAjAJJY4hnnXLtlBzShzgdjg=,tag:zk+tFw7sURDE+T4dDF3Bqg==,type:str]
+      policy: ENC[AES256_GCM,data:KOonZYe6MYk=,iv:o62YxxnBcpDhcnp6qrbJxDpm8GMzFl85QOw4Fd9Ask0=,tag:UBsKKdw5JLmOA5N9HHaVCA==,type:str]
+    - accessKey: ENC[AES256_GCM,data:hQkz,iv:eJrFbiYcuRrZYRtk1UN3fL4+48nNUEdIKcCqH5RUShQ=,tag:HxnFCMdIB8HfixkUvE+LGw==,type:str]
+      secretKey: ENC[AES256_GCM,data:R5uGEV5xGu2nCk4H18B7rXWyD+S3huHgig==,iv:WFjo+mHK5z6wXZZicezTlPwnlyU2mu7WljKz8lft9dg=,tag:P91sHa0yG88ka6fTIGrXEA==,type:str]
+      policy: ENC[AES256_GCM,data:qeqH,iv:VrawQSqW+rhiS7NXdI7l81fy+c6GJkxYyfLEHYfrayc=,tag:JGQ7uxkPPzH4uUA0ZicKPg==,type:str]
+    - accessKey: ENC[AES256_GCM,data:CSzeTJP1kUMA,iv:VoD9gDtPUTQzWCxXMVfMH55M+OCrOtTzI5SgQUpUCpY=,tag:B4pjW91ENd66sPbh3JOxuA==,type:str]
+      secretKey: ENC[AES256_GCM,data:rJu+Fo+SgZrGQ9nwEXih9gSZJqo=,iv:4RRUgquy8J3OODzktlGfIPwkVtCZa6SCsegYuTCsPyk=,tag:DjTKVpvzL0WlWKEVzAiiyw==,type:str]
+      policy: ENC[AES256_GCM,data:ZLRECDxDQcRQ,iv:x6qIPiRmIEdugU5WtFoErBbvpvS5QklaM6VzQlfSwcM=,tag:ZLbqfthesZmmfh4GVL+JTQ==,type:str]
+    - accessKey: ENC[AES256_GCM,data:JnhlVBg=,iv:TBkM5z4ZeVxHyOnsAoMmWg6I/V7f962NbzqcvKtTkBE=,tag:di+TL5BRI1hLxnBLoB3P/g==,type:str]
+      secretKey: ENC[AES256_GCM,data:v00te7PKaNYXJ9C7eaN+w0Etl90qCShjsw==,iv:zIYh3qoDXp9ZOMPMGEzye3eu4bFHie5W58WrXRZdxME=,tag:C9Pq60Z4hQeIPJ2iIb5YMw==,type:str]
+      policy: ENC[AES256_GCM,data:H4WdjEk=,iv:WY52cXnGTug6I/F+ybQOtHED2fkoSULpJa/rP9smacw=,tag:GfoAGESDyb/oKmPU2N+IsQ==,type:str]
+    - accessKey: ENC[AES256_GCM,data:F3Y/yMIvFPWX,iv:6qj9h1amuusGuOon9h/DKPjT7dk/akMVKMSLuKR80Bs=,tag:f2pEP3pYju2EbMYPZg+ijA==,type:str]
+      secretKey: ENC[AES256_GCM,data:krN8EIKt9cjd3EsKIAmdoSQ9y+IHy1LIeg==,iv:dk3wH2yY/IDBTEahYACAYsImNfiq9Zd697BcLvD0QzU=,tag:LYhBXJ1rml4ts7kEtfnJ7A==,type:str]
+      policy: ENC[AES256_GCM,data:sdydid+WXGxv,iv:P7plZmbxi3egYqYqzxc01T9/1edpZf1+RFTDCcezNn8=,tag:dLtii9vqw6s3lVXGO4KAMg==,type:str]
+    - accessKey: ENC[AES256_GCM,data:hHjmZVAqUlY=,iv:liIg6UHUUl6B6eyFuWog2yu9UwrCP7hRHj4RRCnFdi4=,tag:UeEmUEm9ky6QvCc2KE5GEQ==,type:str]
+      secretKey: ENC[AES256_GCM,data:Gw3TRUHOkxYKCLh8giPOsC7n,iv:Kr9qbns7RI2kTFIphwIwJT9M6H2pCFKs+dRbnFdz8Jo=,tag:rKEQ7+5wt2mqK7QjVLJR7g==,type:str]
+      policy: ENC[AES256_GCM,data:c8J+dTNf+TU=,iv:yWxrOJvuSFPByV0vDcAVZSAhsiE/1m/PdjsqdJQv+zE=,tag:aQwQThS+FeeoxJWdDGG4JQ==,type:str]
 oidc:
-    enabled: ENC[AES256_GCM,data:IotxfQ==,iv:vi5Fn3a7My9nyOb67zTTEzHLoFS8IsEQMcQ2i8f2Nns=,tag:/DMVcbOb0s5mZH3uuStXXQ==,type:bool]
-    configUrl: ENC[AES256_GCM,data:Y7/Qzdy1RLbFgX3ynK6v8KIP5D5qKmwtRx3VCFWVJoch+q5tqHYnENgTcagkOwkHEhQY8DFcSJRrj7VwSGU6f/Rd4LrPdVboe8IRGFdaaZHXobwVooHGlCs=,iv:urkXua9hA6dVcltwwD2ZAb1ysZjU5eKegM2ifWtO5wc=,tag:zgs9I0aVVyAbuyd80ajlZQ==,type:str]
-    clientId: ENC[AES256_GCM,data:aZraoow=,iv:XhlAZly8Pb4LFzt4K1XWyvdeEQnU9VEpn9jHvwdm+34=,tag:T5CvtIU6SJ/hUM69GUfSHg==,type:str]
-    clientSecret: ENC[AES256_GCM,data:WtIcgBfFGvfswBTRAp8IqUV5o6HAklMs8C6Yu9xNjadqtcvuUARMeVLGddioZJZFDu9e9wrX/O9Z5nAZrPjSNLVjjlC6hZL3OhqkMYhkowD7g0lLlTcBtWrQ0gzzKzgEv3AxldHlpGvsj7xKFzrH9Og0Dpw6ysYSV2pdRT654zE=,iv:JyHrOmIhP8yf/X5cI9kLNrvPPWhtTiSqj7id2/qE9Hc=,tag:MhApKAE5DVjGihxzqQPZBQ==,type:str]
-    claimName: ENC[AES256_GCM,data:Brw0M+jN,iv:V4YgI6J+QD2TnlQwBekS1PBI/Hgc0n/iIttPzNPK3eA=,tag:cDSu70i0QkVDHjoa+wKEvw==,type:str]
-    redirectUri: ENC[AES256_GCM,data:Hrg/3/GLHX2vEQwSuRJi2rtFekVNN0Idtt4IQ5fHxdRzLkKiBGi7kesHfquju8Q=,iv:OMeIhw8DWKJN2RZLxv/14+nI363tLjzKniffjT5t204=,tag:AokFVHtetOF0vLMBFpvuHQ==,type:str]
-    comment: ENC[AES256_GCM,data:ILnDkL8NNhKHkpZABUmpJ3nsxRY=,iv:Q6Ndcr7LzyViOKmtfX6ZSf0O5/6+ehRRn0V9Alrec7w=,tag:dxZxfUIEEMTHTHwQNHOHgg==,type:str]
+    enabled: ENC[AES256_GCM,data:iZ4KHw==,iv:tqyJs/qDfsn8hzGlBf7QZlfBpqImkSHgcDAjlGpleWw=,tag:v9qEwW0eOInDMGf1RMf6LQ==,type:bool]
+    configUrl: ENC[AES256_GCM,data:meUwpcosuZ30Q+T9XhdhDV5u8UNY6QeEjHvvjc+4+bw5prPz7UpvanwvY2kz87kxjh/Jbr8vBe5BqCF1av1QlkLcpIRzVI/L3Fh3YInsuvNSdR1NITNZCM0=,iv:Is0pXDLvGInFiwbYgAi8vWvMRnoGcWsYqa1PWr7ks3w=,tag:qwAP3iBq8oj7DCDhH3V5AQ==,type:str]
+    clientId: ENC[AES256_GCM,data:tXLjOTg=,iv:bZqJa1VIcW3ohIACqruhDz+W49AX03qwCS5JniX7FWY=,tag:kcd6p07kflnOs/0huSUe3Q==,type:str]
+    clientSecret: ENC[AES256_GCM,data:iR8vf8S4WYxRw5d26ROva1dWRa8VjbXEG6CT3TYiVTe0GJxzeihmD3kes7D2Ps94TsWChUho73GVlNrwMFyDLmC63xiwIRTYLsmxEjH2hxpRa0ickzzJ7yYiSm63TV7nMh87hq+ZZvBWA8W4NCA036uNSVNYUg5p/traBo7250M=,iv:28LxFf7QUtW3t2hVH+bFVSqemLozy43Ii2AJJ715TGc=,tag:GATqHiD3f+3sYtpGHlpMcQ==,type:str]
+    claimName: ENC[AES256_GCM,data:JPQZn+sE,iv:R7POgpEIk0l/5LD7viJ2CYpNNdGuUEUa35190UEzcgo=,tag:7fNRwiTx2s8ep8Ij2J0ekw==,type:str]
+    redirectUri: ENC[AES256_GCM,data:M4PIfUybd3oEsRl8NOnDaWqWKfJPady/n76RD/jYTwpQs2f7Yk4hKbAJo6HAghw=,iv:wGM0+MldvRrf5kJjepEIJcQwzr0B/NhHJaranZI3/4s=,tag:PPOiO85oYW2Y0wuZgEtkNA==,type:str]
+    comment: ENC[AES256_GCM,data:L1MieehjgkbmkzoZPfKcZneiDAc=,iv:/yHluidYeCmGZu2XiEH0XyC3/GIThFHQbTblmKWShe8=,tag:oAd34cZnaULR2wnLGyzMEA==,type:str]
     claimPrefix: ""
-    scopes: ENC[AES256_GCM,data:ZP6O/NVbf67rZujeJVpgHsxjN2jtuP6rmjFB,iv:6DSLl24QqUZVD3hbd9Khxah1yEyri0FUTSVEceZTkDw=,tag:/C+y4oP7cOibwalDPzpv6w==,type:str]
+    scopes: ENC[AES256_GCM,data:JDHNBeFHOnU6atZ2bChXlcOKQdsvCWBNNpCQ,iv:jSUNd0I32fvDbaIE5OYvyXRu/cvYnPn8H0j5bbfYzh8=,tag:DmzMYBN5VFCejbLYh8En9w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -37,14 +37,14 @@ sops:
         - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbVVjMlVGckdFazhPWVov
-            a2NTQWU5RGlmTGFSeFZqaW04MU1rVXQ3blhBCnNwQ1daNzY3L1JPK3FCVDFETU00
-            SnAxM0dNM0RlaEpJc21WamtJV0ZsNzQKLS0tIFdFK3pvemtJa1FyRnl5TnBZdjdh
-            aVR2T3dIQkFOSWV5S0QzZE51RGNPYmMKGTDousxnJn8mBe4AiYSz+zApYEQVQU0e
-            DQMlPYEQbmeT25G3C8XksSvEslTtPs9jwZv+mPTDXgzihxe8V6VQDQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMGwvaUl5T2swV2I0ODMv
+            VmZtUFJYQVNUc3hUTHZjOGxHUjhqMEdKNUFFCjgwUjhaT2hGQTRSd3NNMnhkUHFO
+            bS9QZDZtVE5oV3dmR1RkcVpPTVAvQ1kKLS0tIFdaNnRqVGJCMk5zVkNBRWN6TWNv
+            TlBsSmVENGw0TFhmemxmOXp1MHhseVkKwwpMCzto0h5CgE/xBX1rLlqhCzGRfOTu
+            JHvvn7OffKO0XDHBw/BRVJFtd9nbZPvlj/PNi5I7voFY8aJmxh5rfQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-01T19:07:25Z"
-    mac: ENC[AES256_GCM,data:4PN2B86mG1Vy4BhV3hI0ec7nBowJnz1PDgDz1SGdKIzshxkEl9tAAt4eGnT5dwndO78R+cmmpbKOdSZXecE1PAHmGyp8e4vi/Y0F8EXTTl2rXcST3Lg5ivuIswKxpNhn7ZMZaUiJMFqOJUK5liGR8vzrNhJc6oPi65LJR8XgnII=,iv:XSm8C570MqHELojSxUUHmNppEVvHX0033BOXWxP4Bhk=,tag:hwWJuHYMdZd+OH2HJG3CIw==,type:str]
+    lastmodified: "2025-02-15T23:35:02Z"
+    mac: ENC[AES256_GCM,data:C0/AtGBnOsnky+yGVLuUquN7mdyewemGcaXu39H81CCjYgPx2sgheIMW14FjzCbAsVazoWaK0/cReTl0Pzlgjev1C7C+BE3RgVLMP7VtlLhPjJO8Qu7YKCxS3QCUh0UqDq/apoZoxtL1sKRBvfbpTOHa9xYfVzPrXcIcxuM/FC0=,iv:t12yHlPHy3CW6btSaI4d1yeIb+Giwh2WzBaxhavf6U8=,tag:oMG2zgRps18oPUtR642CJg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4

values/badhouseplants/secrets.tandoor-recipes.yaml

@@ -0,0 +1,25 @@
+env:
+    secrets:
+        data:
+            SECRET_KEY: ENC[AES256_GCM,data:EUJXsWqV8l2YN5NkXvKqQRT86P3TS9d5fca8/vhN,iv:lFIhGFtCW9vAYwc5dSmkBYOqo6B5YcZygu6zAZ1qsrc=,tag:tIVk7YyN+bciP2wl/zMZOQ==,type:str]
+            SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:ZOHbv2LiZFBpxwCwD3we2U/NN1WW5vT14Fata5mA0amjPiXMuGgZYjUhA78ukZPbVVtZ4NTrOj/xLT1SfIzqDi0noDFmFuLVvQ6kjZ7/qdjPXUS5BV+63Bd9aZcrsyAWGujDhzMcjJe7ravIh6ChuIdqq1tkP6FL7fKcpg8Y1PFkIy2PfPjtxogmiOEbakmIJJ56ykPn8O6g5zFa69o7MsVueJAKk7fR1n9SBeZg/bKGC/iY5i1bnAqRdpQO5zRliZfNvrtz0Dk7Cl+jwCjl3cn4lp1u1sBINvAE5x0vrxWKPLkW23hgMIaRAvFB99FiBdY8UjBNM30NNiQKr051S8IgMyTE7w54yZZQZrFprqE1VplKSuuF5ope5CRS1mu/FxiZFjl0T4cYGxJt49S6cVlL2ihKO8Kkw+Jw7FRe+1hfaF/3i1S4O2g6adbAStlnaFvJgXRUiZt7grQDsSqy6tr6hemlOOpVp+b9//NBxb+rXWqUSph1dmo03viRAW3OZKzl7tohrJbirMxHUN6gAIBAvnd0go3qbaWjNg==,iv:nfSnL0kLCvM6d5UtMqp//7FCoWBVdftRPJAWRTtu8Fc=,tag:o7S4B6rMP6bZnHguw/w2Cw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3NnFEV3ZJQ1Z4Z1FGb3Fj
+            bzRkVjUrTUFIYjVmRXVYMFVsaWtKc1lWU3lZCnp5QzAvR0FXalR2QlhNOWcxZ0Rh
+            OHJzak9vdWU0WlZYSVE2ZW5hUVcwdDAKLS0tIFZsNURiSjU4ZjZtNmh0K0xRaUpv
+            UjA3U3FDL200V3JPQ2Zmb1c0V0hYcDAKbq2ywx3x9aiG+pCA/e87ja/1HfuA1o+n
+            BNeRIrOo6y4DBoCfaYVZc8U8m46Ul18RyGePsGUTVp1SSX54XfPb0w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-25T12:38:20Z"
+    mac: ENC[AES256_GCM,data:yGvodMxMZWnExrWayPH0tRdDHvzeVf4dLi/AlEU/Smfh16K1rM2vnVLuo2EhBbaGj4nPl+VHGFdMgz+AhnnUhTtV0ez2uIPyGDLBJL5JhDG2937FjvJ7qduT9b/h7u+y9V4jxquaFruCAOX+uRLmsKuEucEuAAkMydRmRAM3HBk=,iv:KJpcAWasTALTBDgTYV4dh9QR8NIUmu5O5vhbZiknLyw=,tag:esfjk8CBlNByqU21l6zW4g==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2

values/badhouseplants/values.gitea.yaml

@@ -41,7 +41,6 @@ clusterDomain: cluster.local
 resources:
   limits:
     memory: 1024Mi
-    cpu: 512m
   requests:
     cpu: 512m
     memory: 1024Mi

values/badhouseplants/values.traefik.yaml

@@ -10,12 +10,12 @@ ports:
         readTimeout: 0
         idleTimeout: 0
         writeTimeout: 0
-        forwardedHeaders:
-          trustedIPs:
-            - "192.168.0.0/16"
-        proxyProtocol:
-          trustedIPs:
-            - "192.168.0.0/16"
+    forwardedHeaders:
+      trustedIPs:
+        - "192.168.0.0/16"
+    proxyProtocol:
+      trustedIPs:
+        - "192.168.0.0/16"
   ssh:
     port: 22
     expose:

values/badhouseplants/values.velero.yaml

@@ -9,10 +9,10 @@ configuration:
   logLevel: error
   repositoryMaintenanceJob:
     requests:
-      cpu: 300m
-      memory: 512Mi
+      cpu: 250m
+      memory: 256Mi
     limits:
-      memory: 512Mi
+      memory: 256Mi
     latestJobsCount: 2
   backupStorageLocation:
     - name: hetzner

values/etersoft/secrets.minio.yaml

@@ -1,21 +1,21 @@
-rootPassword: ENC[AES256_GCM,data:kxg0YirkjeeTaKueH1G4RijoLjLGxHJP2w==,iv:FM83CGAl7E/xEh9k+GPy/z5apxlAb6/HEhznGcUcu64=,tag:Obw7iPuQltcaWwjZfAh7xQ==,type:str]
+rootPassword: ENC[AES256_GCM,data:OjZ/T/pAAotJvTUjkJ1yGooWnz6NfLZR2w==,iv:uG8cnfJJsx8yrAo1PONBPNF4pDC0PQz6LDpb97FRf58=,tag:/1KQ7Zp+UqA7TCloNkI5Xw==,type:str]
 users:
-    - accessKey: ENC[AES256_GCM,data:h01uNoYYTNs=,iv:YkdniZm4pFzcEa+MfXazBClz6RrnYjzAh+3IbnVE0nQ=,tag:SFZ8HnM8N99CNLvEnWBXqA==,type:str]
-      secretKey: ENC[AES256_GCM,data:sr33gCJYEd2k7bbZNHKVgvOmUN235YJoUg==,iv:hGFkM9cS0cv+GOWpxn1YPjDJBqSZl3RHRrUM9TQt0A0=,tag:Uu7ItlGDxayQhG9vmSNp/Q==,type:str]
-      policy: ENC[AES256_GCM,data:QPL12F5ZWVI=,iv:wXBHgWlI6kFvGH6rp5pLEEcT7S2i58K3Pwa4D4407ks=,tag:JckGYguaJfvHK/sgSuKICQ==,type:str]
-    - accessKey: ENC[AES256_GCM,data:oJrvlRNB,iv:RTYdPqj5Q77NvJIUsRw7PA/7yhZ1YzjRWCYfvshXoCU=,tag:5gtdnE9cIUvZWWpQsO+2oA==,type:str]
-      secretKey: ENC[AES256_GCM,data:nZGlehkE2OhNjXLZk/4syI/xKRGmRmzltw==,iv:24Q/OVU2Rtz5ZmUcgJ6ZsOfXv97PXHL9456C5ccsVAA=,tag:xbU/qLleiUwUBzB1dU6/Ew==,type:str]
-      policy: ENC[AES256_GCM,data:eC7ZPjG/,iv:cEbFEZygJ7ntGA174A3p/RXhjK1QFVY1ldLiZFsaJ8M=,tag:cknvoIX5NONoni1mInssgg==,type:str]
+    - accessKey: ENC[AES256_GCM,data:xaBSF0dMBQQ=,iv:1q33eR4d4Fw2m2m7d+gdT29/X8HKJAOyNcNO1vlNf+k=,tag:mcMkLEVqP7IgN6DcLjTagw==,type:str]
+      secretKey: ENC[AES256_GCM,data:GSjy0MYT5DAAIN86CATL68kqJGy7RApNLw==,iv:mVjOAzqLFB30plV2ZAHGNrphuwHhVY0gga2SH995NUM=,tag:rPxGHyfJIdzA10I1rhwb/Q==,type:str]
+      policy: ENC[AES256_GCM,data:SRhftF+GquY=,iv:b3kR9lbrz85Ji/9kcOwAtDJXhoSLa/ujiMAUHWrabRQ=,tag:Pg1YnFxUfFZeeda/Hc2OZw==,type:str]
+    - accessKey: ENC[AES256_GCM,data:De9lLs2l,iv:KL2afECLR7M5566v9aUzEr+vzOgld3yMJzjbP4wRpcQ=,tag:wXv33DjN+wm0FCa3/fQYfw==,type:str]
+      secretKey: ENC[AES256_GCM,data:FZDF6R2m0Z/UX9ywn4jgCsj+NcFh9v0aXA==,iv:Vr3icnAhYDZwyQVVHXnmZavP/8VEbIQs4nTOQNb8uyM=,tag:CowIx47b8T+kf/qhpBuqIg==,type:str]
+      policy: ENC[AES256_GCM,data:87m39jSs,iv:H2Yv8c8S13cm+Pi26UNeeS5f76ewskLsnT3aKyIAAT8=,tag:ixKsbZbZyVk5kS/Jqh35Cg==,type:str]
 oidc:
-    enabled: ENC[AES256_GCM,data:ZzHQSw==,iv:pAM6Sg5FOqk3OevwXxNz6+HoA+S9JKn3qXKBrvtQOjw=,tag:jIjUzOpsDTrmWXnVQZvOLQ==,type:bool]
-    configUrl: ENC[AES256_GCM,data:wM3MMDLR0hD0moLuOJbVV0FXEAcRpGQCiWZHIRfaer5WzSAnQH/8/PVkOnFy16uzsAf1IFbQIOjaXDw1alv3WxczIKpfXiR8mfNI013fCs+tURdOPCSdziQf9G1+sar9/Fs=,iv:95nxS+kP5Ml3WWbN6kGQxH0E/hLDUMp664OrQVZhH80=,tag:0PvfH+J9SQGwBJ/Kh7zgCA==,type:str]
-    clientId: ENC[AES256_GCM,data:UlETcj+fUPFDh2thR2Q=,iv:EF5QHrfstIqT5MYvrkQkUtcquG9SIsruYKSaR9adz5E=,tag:/yYOxzIIgoCRqsFSHyQanw==,type:str]
-    clientSecret: ENC[AES256_GCM,data:elh+rgMPMxJ3Tf+ufv4FBVQRBY+HeWbaSz4Mjx+CQIGzVBYDw2TaImgZbdIN7X+tVRdKjBUad7Bd4VUZoZt8kIacT4usJRQC9qErhMjnuT+OGzq6mSpXMztAzbGpL76L44S893sRkUkVwDpA6p4vqPSe5vMiaXZZAANIrhIDcRo=,iv:FIr6pRpJ3FlRchQs2Hg25bJu4HFYSy9HFiDhOPDPang=,tag:0pWGuHVwrlm11SqFKYj5ag==,type:str]
-    claimName: ENC[AES256_GCM,data:EOYQcSX7,iv:7ELctRaFlUmE/I9ExsLjMSCOrwLyTrJt5RQeDMqcZXI=,tag:CAEcRcWu0jkHxIdWFwoQvA==,type:str]
-    redirectUri: ENC[AES256_GCM,data:ek2cRHXtOCy9yNRrCyW6GFULz9ql7vzFIYc/7OBBlqQZmzMVEiNJ0B8Wej5TELIJ+do=,iv:IMr3J6Vcs7mT+agAcwaV8av7PUuOtvCdvLOOIKYwN2U=,tag:hLgtwpqtgsyoIF574C8UYA==,type:str]
-    comment: ENC[AES256_GCM,data:io98WZF69zRwoaDz1WXgb3gJ+Ac=,iv:Uw3p8734k25N+GZhQQ225Ye5mJInR4LcJ9LPcppEsgY=,tag:hvx6FxcwajTmC4gQGErWmQ==,type:str]
+    enabled: ENC[AES256_GCM,data:P8GEXQ==,iv:qeB8rYpZny+1NX/fLQi3Uu1rwdHHDC2VZSCl2HbbqYU=,tag:N+zfQUX6onM+YCJRUiFImw==,type:bool]
+    configUrl: ENC[AES256_GCM,data:u0u2AxsupS4rC/C3PWZgNNrTyO12T/De81QHRa7NkiC/bb8hKJVutchNBpVr0zNg+Y9aRPo8cSlbepUVhFx5sZtdkaz98GeI5QmUzsi39LM7S9Mmp6fKP4aJTo4/vhXYF/A=,iv:d/g4Yxnpf4KlrAr1WjBNkKiobKHDYqgh7YwmTwpos60=,tag:CiOLeDM74ZOJav6Pmzzunw==,type:str]
+    clientId: ENC[AES256_GCM,data:doeMKUeB2L01bKiOjJw=,iv:Up3TS5W+ksedwN/lZRvSjBQ8QOty/0CCOQGzYZ6R9fE=,tag:vVuoKODoutu+oZPq8klJXw==,type:str]
+    clientSecret: ENC[AES256_GCM,data:YTg+KYc6oioRt5prvHTkA4GIhQgS/Oi3rpwpOSX/ImH9DHLxXcJnPDKzmW8DWTmG1YIkpJEfLWT+SAa3xz6jpd4EB0y5f86j8h0Ih00z5CS6HyfvFdwqSvKpK6B6b7LIE1x1wSbS4+0un1x6/zUKeqgkes3WMXfHzZCTnalWmqY=,iv:oas5s8SZauwoZHGPKQ1Kj0inn403ZSIrfUORBCAuPcw=,tag:+cB21h3D0jmDAO+MN5eU6A==,type:str]
+    claimName: ENC[AES256_GCM,data:GzxNUVk1,iv:SULbiq6jxrILbpVhxxxfUSsCfK2PvQ3cgrwefL4HykM=,tag:9vQ397kbTqP2hRetfCY+OA==,type:str]
+    redirectUri: ENC[AES256_GCM,data:goPjtLTzVlwNcibzNS7ys9MwvyxC0Zod6oI6Ubnh3EQvPMVbV8jqR9VveHmNiLo=,iv:Bk3Ul5icqIi04knqBvTH7osv8GLqmX5YFe0Y8lE03UM=,tag:W2sSoLEe88/r8WRLIdtl1g==,type:str]
+    comment: ENC[AES256_GCM,data:03n7KL8FN+RVac2Q6CDrGExDeXE=,iv:CKkwPr8qRkDKcWaSeSqRMeZCbnI67QKN2yQiVDTjTUs=,tag:A7PwDaoCvuHAdmYYDSYsSw==,type:str]
     claimPrefix: ""
-    scopes: ENC[AES256_GCM,data:mK8Vczvi5SSVPW6k9pLx2aOaXUdfujXE1G77,iv:M8TxsGfsnvdRyBo94JitBnx366MuRY5Q6vLNmCs0hp8=,tag:YaobqJvS7u6B9x0MN5VMzA==,type:str]
+    scopes: ENC[AES256_GCM,data:06/xU5KnOnzSNksTrJxP31n+yL/uhm6oM6y+,iv:G84tDpX+qzWRYiQHaQDO9kHzK/15XRBLu2BGPmCeh7Y=,tag:kmdsIpB+BgejOxhuOy2XHQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -25,14 +25,14 @@ sops:
         - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFYlFwMzFCaG8wbk5ZcDI4
-            OU93MVNoZGNyL0h0WFhRM254eDF6Y2FkZjMwClJEcHNZcFVlaTB4eDlsMm5QaEYy
-            NE0rd3EzUytaVEc5Y3I0MUpJWnI1NkUKLS0tIHBlS1dKMG9kcXpJSHMzbDhXcGJx
-            OXIvTU1uSVFXenF5QU82VHFta3ZmS0UK86P5geFl4PEMgKqBW2AlQfyTjT84TRfE
-            NjjFcpeFsUa3GoSm+NHxjzXbEEWkQsVsLWqS48IAPhOiICyWPwiznA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUkJLbjYrYXAvSDZLeWo3
+            NGdNSDcxSTltd29oWmpiRXZxUE5NSE1jSUNnCjVnK2M5OEtaTjJDdDkwSzlDMHRv
+            b1ZRUDh2UUF5b0xsNjE3V1JpYTJIc3MKLS0tIFVLcXh2c05aNGY1TlNzRy9SVXV2
+            ZFM2eDBOZkdiV2p4d2tXYnZXRWJidjgKAL4Y+39jbNZo8cXZ7vmfxbfnrmOluE3A
+            XWl5Udebr3cJ14UwP59mYFVL6A/0GaYuRqOwN3omJX4NEMKmzvJf4g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-20T16:42:14Z"
-    mac: ENC[AES256_GCM,data:DyBFmjgWcRCkEEpuDUL2M4w6DcJ+YiVaUZcCuHReTKZRuE0BcYn8TCKYqaILKM4B0ClLK4aYH194ZNysEMDoAVDnLaTWPa3as8dW8mwpeaPmV80CbnKsRLMajwWJi7T8LBYrHaSSZx8eCRHvXFaB3u8B7t31vmzwutlpu5BKQqc=,iv:RzcPzF0rrSVZNSuG/Juv/gFtSdPqgImU+jO0Z3oQVzQ=,tag:KkEecRrbBDImiTBhn4T0pQ==,type:str]
+    lastmodified: "2025-02-08T19:47:27Z"
+    mac: ENC[AES256_GCM,data:hq8mAa0SIALlMh7xCAJ17l1IIHTStP5EAkqri9ueGDjLMDPdO2ewRL70SiNpP3CZgBvvqx2y/iwHrl8TKUGG1oiMK+CpKBZZG5JG53S4cDfvjk9koP0ZKek55MsqFVnhFNjoDhJUCKWnKmm+X4YuntmtNfsmkgWKuVGIDWcJ07Q=,iv:27ITELnJRW1M9XR02q2eEGSdUNWYCtBvameZBVo9iFo=,tag:gAOZsUZmSXcrlNLZVphVqA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4

values/etersoft/secrets.vaultwardentest.yaml

@@ -1,11 +1,13 @@
-config:
-    env:
-        secrets:
-            enabled: ENC[AES256_GCM,data:nQ+V6A==,iv:V3S80SWwPd4CmIpcE7h8JlzqlMhJPwRa3QjQ0Ezl9po=,tag:J1bNAB6vQzuZLK+QPGl/Mw==,type:bool]
-            sensitive: ENC[AES256_GCM,data:O1M/Pw==,iv:FcXRYnWleruNLWWB5SvXKKh2VDrpq1NmFgZ0qXtwz8A=,tag:MPaozYmtMvIp2ik2NMv50A==,type:bool]
-            data:
-                ADMIN_PASSWORD: ENC[AES256_GCM,data:YDMg09xZG26MR+d4wcEtqGDnID8piLNX4uFFa1rnrde3qek2ZYzm5RDGhRjUbABgj3g=,iv:Q0wi8tDfkzDDfBHFNEm9EItmIEwhX/13LiZ9cvb9QBo=,tag:zugAhXY26VPRsS1Sz+KCkg==,type:str]
-                ADMIN_TOKEN: ENC[AES256_GCM,data:FZtTW2AVZsSlsF0kaZOkpaOvpYmjaVTJ3joSXU+6ylS16iItp4ggqfZe/EMjKDImqB42XrOt+c90hWu21a/RlGe7iGt+av9mkG3/932STxgUaPHB8A==,iv:GOb9mOurT3qeXcO4GmX38kQNFQx4ylAQ7Z/n5GCaVao=,tag:raZZSHBg9mPKnwaYB4yoaA==,type:str]
+env:
+    secrets:
+        enabled: ENC[AES256_GCM,data:zzAqZw==,iv:eNmoXsT7ME8Ayq1+6SKVMAmNfMXbaCHhbpoIVSCMmEs=,tag:rXlJGUtPQm0ulut18xuEpQ==,type:bool]
+        sensitive: ENC[AES256_GCM,data:p+tT+Q==,iv:0W4zA1+9Q6eDx6OMAscdDc0GveZgo/zW6in/PdfZo5E=,tag:SBplDU0DWQHzS0zQbhlOmA==,type:bool]
+        data:
+            #ENC[AES256_GCM,data:lUhrHf0qCaIFA/03PexzwaG8BZPx4jJ1E7+D8RSusZsegYVEAcP13XkQ,iv:/aKm2fUtjUWb7zGipYLjFSoPv6JEhrt0lneEHcLY2vk=,tag:0TrN03ApXMyDLbghPU3lEw==,type:comment]
+            ADMIN_PASSWORD: ENC[AES256_GCM,data:NkRDv5wL9+q30cydrbxaG5kSkEjSVk1kj4H1OipjaWkSKR1gUyVfFcmd1NCWldDNAK8=,iv:i26l6IFjyHqHXVadTGBl3wKDtRyykTca20mNaItl6kM=,tag:iYDdkUBE0GorA+zhu1ogfg==,type:str]
+            ADMIN_TOKEN: ENC[AES256_GCM,data:3LzUfxviYj5PSsm9bUn7pkLdVR7ggFHToXKvKIEw61d1MY6Ph3qVMr32KKJlbwh25by/hUQgSa1/WxxJDbBWsMzP9PikTov6lwFzMMOS/DDBM9ctxw==,iv:9zDoNV+Gbij9N95tKLd7Aa5c63UswSIG0nauGLS39Jg=,tag:wZE8U1t6GEqt7Obj4mqWcA==,type:str]
+            DATABASE_URL: null
+            #ENC[AES256_GCM,data:/5YuWuePwRN26Y2mCmGqI2FeDzZnsEyucbj1TR8j2LoCmhE=,iv:GMB4Y6LMAodfF6ItU5cRffMSPZh/85VHuLWOSo5YXdc=,tag:/h4vqzl5ZBy4msVe96l4Uw==,type:comment]
 sops:
     kms: []
     gcp_kms: []
@@ -15,14 +17,14 @@ sops:
         - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzUGtWT09WOVlGRnc3aVVp
-            VWdMbHFPMTAwSGFOd3dBSDUrbFB2R3VOaVVRCkptckpBR1JHcW12bEVIQ3pBOHJN
-            emQ0VmorbjhSeUNhTGJMMWFKMWZrelEKLS0tIFRDMkRiV0owWnNLWFFKSVAzZ1Bi
-            eWt3a0J4b1F3ejFwZlRlblcyWGYrY00KvZ737upypCW8nDPa01uHVTtHgGcKhEFv
-            MSa0WYeEa3ArffR6gPtH4uAErL0B7+slSvTFVt6HJ5z1VdgIWlMBZg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQRHYvUG9ybVdOUk56alc1
+            VFUrS1lxT0srSG1uRldVUkZxY0NDaDZFUFJRCklsejBiNm9pelZYRTdlTGcvMSta
+            TS9lMElyMGJCa1pPN0J0amxDOFlQbGsKLS0tIE1mYlpwZEhES2Zrdk84UExjeXlz
+            akQ2M3NTc2hDRCt0OFJMMmVKZzg5UXMKqFkcNzqp9uhVu67/APA5XbqMVzv4RegS
+            at9pmPCxTlWQoPjzGtuF+l7J5lkS2KrU0wROC62AggnmEY1dMOSzqw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-02T08:58:13Z"
-    mac: ENC[AES256_GCM,data:hYtrnn0dXtv/9vZ82hu6wsFVXvP56QNKrz1vb6o8+BVOc9cWheDAyPwhv3SHibkSSXb7Bw0qCXN0w43+zxT03HTxHAWb/zk/YD39Vv8iWvGc5Wuyduh/pPZn52MrQr4Gyqf/QQQMwvDkWwXQ0t6Y8XU+HF+XDz2NKE2NyZzOOa8=,iv:Rg7AUYEhqWHJqvZi32F7b9Ux4fv1o0Gmavw6SQe+hao=,tag:5clTc1DJrfFzMiTEPtj7Fw==,type:str]
+    lastmodified: "2024-11-06T09:06:31Z"
+    mac: ENC[AES256_GCM,data:uDSzjE3cnkzY2ADj/v6PkaB4XVla9+N5J7H/+b7Erc9cSdbV7utvBjhxDeMpnrurO10mNDtvgPEJ00e/bDz4Ru3tl6OXSeY9lvvKZTHi69i5e8naX6t6M2xv7rKyLe8gw5GzwSGfKGpsJeTKsUuKN2tAcoy23THC1Mauulj6G2A=,iv:85JA9+1rps4OUzFrXsy0e/NS0SZPfYpPHP0hjy/uCRQ=,tag:K/Oj9TyQIJXvuo6gwPzzRw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.1

values/etersoft/values.external-dns.yaml

@@ -1,13 +1,7 @@
 provider:
   name: cloudflare
-domainFilters:
-  - badhouseplants.net
 policy: sync
 txtOwnerId: eter
-txtPrefix: eter-ext-dns-
+txtPrefix: eter-ext-dns
 logFormat: json
 logLevel: info
-sources:
-  - service
-  - ingress
-  - crd

values/etersoft/values.vaultwardentest.yaml

@@ -1,38 +1,91 @@
 shortcuts:
   hostname: vaulttest.ru.badhouseplants.net
-
+ext-database:
+  enabled: true
+  name: vaultwardentest-postgres16
+  instance: postgres16
+  credentials:
+    DATABASE_URL: "{{ .Protocol }}://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{ .Port }}/{{ .Database }}"
+workload:
+  kind: Deployment
+  strategy:
+    type: RollingUpdate
+  containers:
+    vaultwarden:
+      mounts:
+        storage:
+          data:
+            path: /app/data/
+        extraVolumes:
+          logs:
+            path: /app/logs
+      envFrom:
+        - environment
+        - secrets
+        - secretRef:
+            name: vaultwardentest-postgres16-creds
 ingress:
   main:
     class: traefik
-    metadata:
-      annotations:
-        kubernetes.io/ingress.class: traefik
-        traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-        kubernetes.io/tls-acme: "true"
-        kubernetes.io/ingress.allow-http: "false"
-        kubernetes.io/ingress.global-static-ip-name: ""
-        cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+    annotations:
+      kubernetes.io/ingress.class: traefik
+      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+      kubernetes.io/tls-acme: "true"
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.global-static-ip-name: ""
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+    rules:
+      - host: vaulttest.ru.badhouseplants.net
+        http:
+          paths:
+            - backend:
+                service:
+                  name: '{{ include "chart.fullname" $ }}-main'
+                  port:
+                    number: 8080
+              path: /
+              pathType: Prefix
+    tls:
+      - hosts:
+          - vaulttest.ru.badhouseplants.net
+        secretName: vaulttest.ru.badhouseplants.net
+extraVolumes:
+  logs:
+    emptyDir: {}
 
-config:
-  env:
-    main:
-      enabled: true
-      sensitive: false
-      data:
-        DOMAIN: https://vaulttest.ru.badhouseplants.net
-        DATA_FOLDER: /app/data/
-        ROCKET_PORT: 8080
-        SHOW_PASSWORD_HINT: true
-        SIGNUPS_ALLOWED: true
-        INVITATIONS_ALLOWED: true
-        SIGNUPS_DOMAINS_WHITELIST: "test.com"
-        SIGNUPS_VERIFY: false
-        WEB_VAULT_ENABLED: true
-        LOG_FILE: /app/logs/log.txt
-        LOG_LEVEL: debug
-        DB_CONNECTION_RETRIES: 10
-        DATABASE_MAX_CONNS: 10
-        ORG_GROUPS_ENABLED: true
-        ORG_EVENTS_ENABLED: true
-        ORG_CREATION_USERS: ""
-        SMTP_SECURITY: 'off'
+storage:
+  data:
+    annotations:
+      volume.kubernetes.io/selected-node: yekaterinburg
+    accessModes:
+      - ReadWriteOnce
+env:
+  environment:
+    enabled: true
+    sensitive: false
+    data:
+      DOMAIN: https://vaulttest.ru.badhouseplants.net
+      #SMTP_HOST: mail.badhouseplants.net
+      #SMTP_SECURITY: "starttls"
+      #SMTP_PORT: 587
+      #SMTP_FROM: vaulttest@badhouseplants.net
+      #SMTP_FROM_NAME: Vault Warden
+      #SMTP_AUTH_MECHANISM: "Plain"
+      #SMTP_ACCEPT_INVALID_HOSTNAMES: "false"
+      #SMTP_ACCEPT_INVALID_CERTS: "false"
+      #SMTP_DEBUG: false
+      DATA_FOLDER: /app/data/
+      ROCKET_PORT: 8080
+      SHOW_PASSWORD_HINT: true
+      SIGNUPS_ALLOWED: true
+      INVITATIONS_ALLOWED: true
+      SIGNUPS_DOMAINS_WHITELIST: "test.com"
+      SIGNUPS_VERIFY: false
+      WEB_VAULT_ENABLED: true
+      LOG_FILE: /app/logs/log.txt
+      LOG_LEVEL: debug
+      DB_CONNECTION_RETRIES: 10
+      DATABASE_MAX_CONNS: 10
+      ORG_GROUPS_ENABLED: true
+      ORG_EVENTS_ENABLED: true
+      ORG_CREATION_USERS: ""

values/etersoft/values.xray-docs.yaml

@@ -1,5 +1,3 @@
-shortcuts:
-  hostname: xray-docs.ru.badhouseplants.net
 workload:
   metadata:
     annotations:
@@ -37,3 +35,4 @@ extra:
       spec:
         basicAuth:
           secret: xray-docs-auth
+