test

.pre-commit-config.yaml

@@ -11,10 +11,10 @@ repos:
           (?x)^(
             .*secrets.*yaml
           )$
-          #  - repo: https://github.com/codespell-project/codespell
+  - repo: https://github.com/codespell-project/codespell
-          #    rev: v2.2.4
+    rev: v2.2.4
-          #    hooks:
+    hooks:
-          #      - id: codespell
+      - id: codespell
   - repo: local
     hooks:
       - id: check-sops-secrets

.woodpecker/helmfile.yaml

@@ -0,0 +1,41 @@
+when:
+  event:
+    - push
+matrix:
+  include:
+    - NAME: badhouseplants
+      ENV: badhouseplants
+.opts: &opts
+  secrets:
+    - sops_age_key
+  image: ghcr.io/helmfile/helmfile:latest
+  backend_options:
+    kubernetes:
+      serviceAccountName: woodpecker-ci
+      #resources:
+      #  requests:
+      #    memory: 1200Mi
+      #    cpu: 2
+      #  limits:
+      #    memory: 1200Mi
+      #    cpu: 2
+steps:
+  diff:
+    !!merge <<: *opts
+    when:
+      - branch:
+          exclude:
+            - main
+    commands:
+      - sed -i "/\b\(kubeContext\)\b/d" common/environments.yaml
+      - helmfile -e "${ENV}" diff --concurrency 1 > ./diff
+      - cat ./diff
+  diff:
+    !!merge <<: *opts
+    when:
+      - branch:
+          include:
+            - main
+    commands:
+      - sed -i "/\b\(kubeContext\)\b/d" common/environments.yaml
+      - helmfile -e "${ENV}" apply

common/environments.yaml

@@ -11,7 +11,7 @@ environments:
       - backups:
           enabled: false
       - localpath:
-          enabled: false
+          enabled: true
       - openebs:
           enabled: true
       - postgres17:
@@ -21,7 +21,7 @@ environments:
       - redis:
           enabled: true
       - istio:
-          enabled: true
+          enabled: false
   etersoft:
     kubeContext: etersoft
     values:

common/templates.yaml

@@ -37,12 +37,6 @@ templates:
   default-env-secrets:
     secrets:
       - '{{ requiredEnv "PWD" }}/values/{{ .Environment.Name }}/secrets.{{ `{{ .Release.Name }}` }}.yaml'
-  env-values:
-    values:
-      - '{{ requiredEnv "PWD" }}/values/{{ .Environment.Name }}/{{ `{{ .Release.Namespace }}` }}/{{ `{{ .Release.Name }}` }}/values.yaml'
-  env-secrets:
-    secrets:
-      - '{{ requiredEnv "PWD" }}/values/{{ .Environment.Name }}/{{ `{{ .Release.Namespace }}` }}/{{ `{{ .Release.Name }}` }}/secrets.yaml'
   # ----------------------------
   # -- Extensions
   # ----------------------------

installations/applications/helmfile-badhouseplants.yaml

@@ -1,21 +1,42 @@
 bases:
   - ../../common/environments.yaml
   - ../../common/templates.yaml
-
 repositories:
+  - name: softplayer-oci
+    url: zot.badhouseplants.net/softplayer/helm
+    oci: true
+  - name: allanger-oci
+    url: zot.badhouseplants.net/allanger/helm
+    oci: true
+  - name: requarks
+    url: https://charts.js.wiki
+  - name: ananace-charts
+    url: https://ananace.gitlab.io/charts
   - name: gitea
     url: https://dl.gitea.io/charts/
+  - name: mailu
+    url: https://mailu.github.io/helm-charts/
+  - name: bedag
+    url: https://bedag.github.io/helm-charts/
+  - name: bitnami
+    url: https://charts.bitnami.com/bitnami
   - name: allangers-charts
     url: ghcr.io/allanger/allangers-charts
     oci: true
+  - name: robjuz
+    url: https://robjuz.github.io/helm-charts/
   - name: badhouseplants-helm
     url: git+https://gitea.badhouseplants.net/badhouseplants/badhouseplants-helm@charts?ref=main
-  - name: bedag
-    url: https://bedag.github.io/helm-charts/
-  - name: open-strike
-    url: git+https://gitea.badhouseplants.net/badhouseplants/open-strike-2.git@helm?ref=main
-
 releases:
+  - name: funkwhale
+    chart: ananace-charts/funkwhale
+    namespace: applications
+    installed: false
+    version: 2.0.5
+    inherit:
+      - template: default-env-values
+      - template: default-env-secrets
+      - template: ext-database
   - name: gitea
     chart: gitea/gitea
     version: 10.6.0
@@ -25,23 +46,29 @@ releases:
       - template: default-env-secrets
       - template: ext-database
       - template: ext-tcp-routes
-
+  - name: openvpn
-  - name: app-vaultwarden
+    chart: allangers-charts/openvpn
+    version: 0.0.2
+    namespace: applications
+    inherit:
+      - template: default-env-values
+      - template: ext-tcp-routes
+  - name: vaultwarden
     chart: allangers-charts/vaultwarden
-    version: 3.0.0
+    version: 2.3.0
-    namespace: org-badhouseplants
+    namespace: applications
     inherit:
-      - template: env-values
+      - template: default-env-values
-      - template: env-secrets
+      - template: default-env-secrets
-
+      - template: ext-database
-  - name: app-stalwart
+  - name: stalwart
     chart: allangers-charts/stalwart
-    version: 1.0.1
+    version: 0.4.0
-    namespace: org-badhouseplants
+    namespace: applications
     inherit:
-      - template: env-values
+      - template: default-env-values
-      - template: env-secrets
+      - template: default-env-secrets
-
+      - template: ext-tcp-routes
   - name: navidrome
     chart: allangers-charts/navidrome
     namespace: applications
@@ -49,7 +76,6 @@ releases:
     inherit:
       - template: default-env-values
       - template: ext-traefik-middleware
-
   - name: navidrome-private
     chart: allangers-charts/navidrome
     namespace: applications
@@ -57,36 +83,45 @@ releases:
     inherit:
       - template: default-env-values
       - template: default-env-secrets
-
   - name: server-xray-public
     chart: allangers-charts/server-xray
     namespace: public-xray
-    version: 0.5.0
+    version: 0.4.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values
       - template: ext-tcp-routes
       - template: ext-cilium
       - template: ext-certificate
-
   - name: server-xray-public-edge
     chart: allangers-charts/server-xray
     installed: true
     namespace: public-xray
-    version: 0.5.0
+    version: 0.4.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values
       - template: ext-tcp-routes
       - template: ext-cilium
       - template: ext-certificate
+  - name: vaultwardentest
+    chart: allangers-charts/vaultwarden
+    version: 2.4.0
+    namespace: applications
+    installed: false
+    inherit:
+      - template: default-env-values
+      - template: default-env-secrets
+      - template: ext-database
 
-  - name: memos
+  - name: tandoor-recipes
-    chart: allangers-charts/memos
+    chart: allangers-charts/tandoor-recipes
+    installed: false
     version: 0.1.0
     namespace: applications
     inherit:
       - template: default-env-values
+      - template: default-env-secrets
       - template: ext-database
 
   - name: badhouseplants-net

installations/applications/helmfile-etersoft.yaml

@@ -8,8 +8,6 @@ repositories:
   - name: gabe565
     url: ghcr.io/gabe565/charts
     oci: true
-  - name: xray-docs
-    url: git+https://gitea.badhouseplants.net/badhouseplants/xray-docs.git@helm?ref=main
 releases:
   - name: openvpn
     chart: allangers-charts/openvpn
@@ -34,6 +32,12 @@ releases:
       - template: default-env-values
       - template: default-env-secrets
       - template: ext-database
+  - name: tf-ocloud
+    chart: ../../charts/tf-ocloud
+    namespace: pipelines
+    installed: false
+    inherit:
+      - template: default-env-secrets
 
   - name: nrodionov
     chart: bitnami/wordpress
@@ -43,26 +47,14 @@ releases:
     inherit:
       - template: default-env-values
       - template: default-env-secrets
-
+  - name: server-xray-public-bridge
-  - name: external-service-xray
+    chart: allangers-charts/server-xray
-    chart: ../../kustomizations/external-service-xray
     installed: true
     namespace: public-xray
-
+    version: 0.4.0
-  - name: server-xray-public
-    chart: allangers-charts/server-xray
-    namespace: public-xray
-    version: 0.5.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values
       - template: ext-tcp-routes
       - template: ext-cilium
       - template: ext-certificate
-
-  - name: xray-docs
-    chart: xray-docs/xray-docs
-    installed: true
-    namespace: public-xray
-    inherit:
-      - template: default-env-values

installations/applications/helmfile-xray-1.yaml

@@ -9,7 +9,7 @@ releases:
   - name: server-xray-public
     chart: allangers-charts/server-xray
     namespace: public-xray
-    version: 0.5.0
+    version: 0.4.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values

installations/applications/helmfile-xray-2.yaml

@@ -9,7 +9,7 @@ releases:
   - name: server-xray-public
     chart: allangers-charts/server-xray
     namespace: public-xray
-    version: 0.5.0
+    version: 0.4.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values

installations/databases/helmfile.yaml

@@ -12,7 +12,7 @@ releases:
     chart: bitnami/redis
     namespace: databases
     condition: redis.enabled
-    version: 20.7.1
+    version: 20.4.0
     inherit:
       - template: default-env-values
       - template: default-env-secrets
@@ -32,7 +32,7 @@ releases:
     namespace: databases
     chart: bitnami/postgresql
     condition: postgres17.enabled
-    version: 16.3.4
+    version: 16.0.6
     inherit:
       - template: default-env-values
       - template: default-env-secrets

installations/games/helmfile.yaml

@@ -13,7 +13,7 @@ releases:
   - name: minecraft
     chart: minecraft/minecraft
     namespace: games
-    version: 4.23.7
+    version: 4.23.6
     inherit:
       - template: ext-tcp-routes
       - template: default-env-values

installations/monitoring/helmfile.yaml

@@ -12,7 +12,7 @@ releases:
   - name: prometheus
     chart: prometheus-community/kube-prometheus-stack
     namespace: observability
-    version: 68.5.0
+    version: 66.3.1
     inherit:
       - template: default-env-values
       - template: default-env-secrets
@@ -20,7 +20,7 @@ releases:
   - name: grafana
     chart: grafana/grafana
     namespace: observability
-    version: 8.9.0
+    version: 8.6.4
     installed: true
     inherit:
       - template: default-env-values
@@ -28,7 +28,7 @@ releases:
   - name: loki
     chart: grafana/loki
     namespace: observability
-    version: 6.25.1
+    version: 6.23.0
     inherit:
       - template: default-env-values
       - template: ext-secret

installations/pipelines/helmfile.yaml

@@ -12,7 +12,7 @@ releases:
   - name: woodpecker-ci
     chart: woodpecker/woodpecker
     namespace: pipelines
-    version: 3.0.1
+    version: 2.0.2
     inherit:
       - template: ext-database
       - template: default-env-values
@@ -20,15 +20,14 @@ releases:
   - name: renovate-gitea
     chart: renovate/renovate
     namespace: pipelines
-    version: 39.171.0
+    version: 39.57.4
     inherit:
       - template: default-env-values
       - template: default-env-secrets
   - name: renovate-github
     chart: renovate/renovate
-    installed: false
     namespace: pipelines
-    version: 39.171.0
+    version: 39.57.4
     inherit:
       - template: default-env-values
       - template: default-env-secrets

installations/platform/helmfile.yaml

@@ -23,14 +23,12 @@ repositories:
     url: https://kubernetes-sigs.github.io/external-dns/
   - name: keel
     url: https://keel-hq.github.io/keel/
-  - name: uptime-kuma
-    url: https://helm.irsigler.cloud
 
 releases:
   - name: db-operator
     namespace: platform
     chart: db-operator/db-operator
-    version: 1.32.0
+    version: 1.30.0
 
   - name: db-instances
     chart: db-operator/db-instances
@@ -44,7 +42,7 @@ releases:
 
   - name: zot
     chart: zot/zot
-    version: 0.1.66
+    version: 0.1.65
     createNamespace: false
     installed: true
     namespace: platform
@@ -55,7 +53,7 @@ releases:
 
   - name: authentik
     chart: goauthentik/authentik
-    version: 2024.12.3
+    version: 2024.10.5
     namespace: platform
     createNamespace: false
     condition: workload.enabled
@@ -68,7 +66,7 @@ releases:
 
   - name: minio
     chart: minio-standalone/minio
-    version: 5.4.0
+    version: 5.3.0
     namespace: platform
     inherit:
       - template: default-env-values
@@ -77,22 +75,25 @@ releases:
   - name: kyverno
     chart: kyverno/kyverno
     namespace: kyverno
+    condition: workload.enabled
     labels:
       bootstrap: true
-    version: 3.3.6
+    version: 3.3.3
 
   - name: kyverno-policies
     chart: kyverno/kyverno-policies
     namespace: kyverno
+    condition: workload.enabled
     labels:
       bootstrap: true
-    version: 3.3.4
+    version: 3.3.2
     needs:
       - kyverno/kyverno
 
   - name: custom-kyverno-policies
-    chart: "../../kustomizations/kyverno/{{ .Environment.Name }}"
+    chart: ../../kustomizations/kyverno/
     namespace: kyverno
+    condition: workload.enabled
     labels:
       bootstrap: true
     needs:
@@ -100,7 +101,7 @@ releases:
 
   - name: external-dns
     chart: external-dns/external-dns
-    version: 1.15.2
+    version: 1.15.0
     namespace: platform
     inherit:
       - template: default-env-values
@@ -108,12 +109,6 @@ releases:
 
   - name: keel
     chart: keel/keel
-    version: v1.0.5
+    version: 1.0.4
     namespace: platform
-
+    condition: workload.enabled
-  - name: uptime-kuma
-    chart: uptime-kuma/uptime-kuma
-    version: 2.21.2
-    namespace: platform
-    inherit:
-      - template: default-env-values

installations/storage/helmfile.yaml

@@ -0,0 +1,34 @@
+bases:
+  - ../../common/environments.yaml
+  - ../../common/templates.yaml
+repositories:
+  - name: longhorn
+    url: https://charts.longhorn.io
+  - name: rook-release
+    url: https://charts.rook.io/release
+releases:
+  - name: rook-ceph
+    chart: rook-release/rook-ceph
+    installed: true
+    namespace: rook-ceph
+    version: v1.14.6
+    inherit:
+      - template: default-env-values
+  - name: rook-ceph-cluster
+    chart: rook-release/rook-ceph-cluster
+    installed: false
+    namespace: rook-ceph
+    version: v1.14.6
+    needs:
+      - rook-ceph/rook-ceph
+    inherit:
+      - template: default-env-values
+  - name: longhorn
+    chart: longhorn/longhorn
+    namespace: longhorn-system
+    installed: true
+    version: 1.7.2
+    inherit:
+      - template: default-env-values
+      - template: default-env-secrets
+      - template: ext-secret

installations/system/helmfile.yaml

@@ -45,14 +45,14 @@ releases:
 
   - name: coredns
     chart: coredns/coredns
-    version: 1.39.0
+    version: 1.37.0
     namespace: kube-system
     inherit:
       - template: default-common-values
 
   - name: cilium
     chart: cilium/cilium
-    version: 1.17.0
+    version: 1.16.4
     condition: base.enabled
     namespace: kube-system
     needs:
@@ -62,7 +62,7 @@ releases:
 
   - name: cert-manager
     chart: jetstack/cert-manager
-    version: v1.17.0
+    version: v1.16.2
     namespace: kube-system
     condition: base.enabled
     missingFileHandler: Warn
@@ -96,7 +96,7 @@ releases:
     chart: metallb/metallb
     namespace: kube-system
     condition: base.enabled
-    version: 0.14.9
+    version: 0.14.8
     needs:
       - kube-system/cilium
     inherit:
@@ -115,7 +115,7 @@ releases:
 
   - name: traefik
     chart: traefik/traefik
-    version: 34.3.0
+    version: 33.1.0
     condition: base.enabled
     namespace: kube-system
     needs:
@@ -127,7 +127,7 @@ releases:
   - name: velero
     chart: vmware-tanzu/velero
     namespace: velero
-    version: 8.3.0
+    version: 8.1.0
     condition: velero.enabled
     needs:
       - kube-system/cilium
@@ -140,7 +140,7 @@ releases:
     chart: openebs/openebs
     condition: openebs.enabled
     namespace: kube-system
-    version: 4.1.3
+    version: 4.1.1
     needs:
       - kube-system/cilium
     inherit:
@@ -166,7 +166,6 @@ releases:
   - name: istio-ingressgateway
     chart: istio/gateway
     condition: istio.enabled
-    installed: false
     namespace: istio-system
     needs:
       - istio-system/istio-base

kustomizations/external-service-xray/service.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: xray-external-proxy
-spec:
-  externalName: xray-public.badhouseplants.net
-  sessionAffinity: None
-  type: ExternalName
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRouteTCP
-metadata:
-  name: xray-external-proxy
-spec:
-  entryPoints:
-    - xray-public
-  routes:
-    - match: HostSNI(`*`)
-      services:
-        - name: xray-external-proxy
-          nativeLB: true
-          port: 27015
-

kustomizations/kyverno/etersoft/pvc-patch.yaml

@@ -1,20 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: replace-storage-class-by-openebs
-spec:
-  rules:
-    - name: replace-storage-class
-      match:
-        any:
-          - resources:
-              kinds:
-                - PersistentVolumeClaim
-              namespaces:
-                - application
-                - platform
-      mutate:
-        patchStrategicMerge:
-          metadata:
-            annotations:
-              volume.kubernetes.io/selected-node: yekaterinburg

manifests/peerauth.yaml

@@ -1,8 +0,0 @@
-apiVersion: security.istio.io/v1
-kind: PeerAuthentication
-metadata:
-  name: default
-  namespace: public-xray
-spec:
-  mtls:
-    mode: STRICT

scripts/get_kubeconfig_from_sa.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+
+# you need to have kubectl on PATH with the context set to the cluster you want to create the config for
+
+# Cosmetics for the created config
+clusterName="${CLUSTER_NAME}"
+# your server address goes here get it via `kubectl cluster-info`
+server="${CLUSTER_URL}"
+# the Namespace and ServiceAccount name that is used for the config
+export namespace='pipelines'
+export serviceAccount='woodpecker-ci'
+
+# The following automation does not work from Kubernetes 1.24 and up.
+# You might need to
+# define a Secret, reference the ServiceAccount there and set the secretName by hand!
+# See https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-long-lived-api-token-for-a-serviceaccount for details
+secretName=$(kubectl --namespace="$namespace" get serviceAccount "$serviceAccount" -o=jsonpath='{.secrets[0].name}')
+
+######################
+# actual script starts
+set -o errexit
+
+
+ca=$(kubectl --namespace="$namespace" get secret/"$secretName" -o=jsonpath='{.data.ca\.crt}')
+token=$(kubectl --namespace="$namespace" get secret/"$secretName" -o=jsonpath='{.data.token}' | base64 --decode)
+
+echo "
+---
+apiVersion: v1
+kind: Config
+clusters:
+  - name: ${clusterName}
+    cluster:
+      certificate-authority-data: ${ca}
+      server: ${server}
+contexts:
+  - name: ${serviceAccount}@${clusterName}
+    context:
+      cluster: ${clusterName}
+      namespace: ${namespace}
+      user: ${serviceAccount}
+users:
+  - name: ${serviceAccount}
+    user:
+      token: ${token}
+current-context: ${serviceAccount}@${clusterName}
+"
+

values/badhouseplants/org-badhouseplants/app-open-strike-2/values.yaml

@@ -1,20 +0,0 @@
-deployAnnotations:
-  keel.sh/policy: force
-  keel.sh/trigger: poll
-  keel.sh/initContainers: 'true'
-
-extra:
-  templates:
-    - |-
-      apiVersion: traefik.io/v1alpha1
-      kind: IngressRouteUDP
-      metadata:
-        name: "{{ .Release.Name }}-game"
-      spec:
-        entryPoints:
-        - game-udp
-        routes:
-        - services:
-          - name: app-open-strike-2-main
-            nativeLB: true
-            port: 27015

values/badhouseplants/org-badhouseplants/app-stalwart/secrets.yaml

@@ -1,27 +0,0 @@
-config:
-    env:
-        secrets:
-            data:
-                SW_ADMIN_SECRET: ENC[AES256_GCM,data:dG2zVmvycL7TZM922XADQ/SwWMBrUvXd+BPwpxIvmaDnjejpEaHUfB0xhpkhZqhAB8M=,iv:5hDpUFLLGLf4VLj8h3weOZhiwJKYORg5uKVgXVXKbgM=,tag:9FQru61B5hDPcIoIUDvUtg==,type:str]
-                MINIO_ACCESS_ID: ENC[AES256_GCM,data:HvZa/kOy8ZI=,iv:T2433k3OmZTmPTx2QWEAELlN7zY37LUynapVWpASrJ0=,tag:Kvr4wIgq5dMmXRJDoxqGxA==,type:str]
-                MINIO_SECRET_KEY: ENC[AES256_GCM,data:Tv5VWQprCKtJCghzhZ8YD8/9,iv:hioZ+d0ns+Hr3pBVyfFWgcuRKDrPQmskSnU0XOMwhzA=,tag:nuFn0qV9UMy2ywiFfx5gHg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMTZGN2NSYXUzcXNJVUx2
-            YXE3Nk5MbnV1dyttUEtmUExabFYvOGdHcTBRCkM1WE9uNlF1OGh4NnNDL3NabXhi
-            OW1NcDlydUMraTVQV2tjLzVla2tpSnMKLS0tIHN6RXVJTzNvZlkyTmdDb09UTUNy
-            TVJyRVI5U2NmV1VIQTk4cjlYM1htMFkKkxsXzn+7nFiTs3mANqO0+f7/TTGKogFk
-            8ix4OpiA9b33kuqi4Z7bXx4ucyCmlDwtxuHvmOEOyW4yJ9F1cgm+Uw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-15T23:05:04Z"
-    mac: ENC[AES256_GCM,data:Kix/IdONJ79Lj1dc/gigpM7BUPyg7EIsPQzkhtu8+nbIQZQsm0CYqlqPx1V7w0r9vef+rCd/8GX8RdKw0o5ZaDZY5l0nXEi9E7dEtcHTYlrr8fqljcsGRAKmOiBRMkPh0jGTEPlFRtb0Inrn85rWUiMJP12hwIIS0t7GpAydKdI=,iv:1pMdzj1x0Hf65nmZ28Lv7yu6Y+suQKxv274nYl8J3HI=,tag:GQL8HOSswz2N56iNAS9l9w==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4

values/badhouseplants/org-badhouseplants/app-stalwart/values.yaml

@@ -1,317 +0,0 @@
-shortcuts:
-  hostname: stalwart.badhouseplants.net
-
-base:
-  workload:
-    initContainers:
-      prepare-config:
-        image:
-          registry: registry.hub.docker.com
-          repository: library/alpine
-          tag: latest
-          pullPolicy: Always
-        volumeMounts:
-          files:
-            config:
-              path: /app/config/config.toml
-              subPath: config.toml
-          extraVolumes:
-            config:
-              path: /app/etc
-        command:
-          - sh
-        args:
-          - -c
-          - cp /app/config/config.toml /app/etc/config.toml && echo "" >> /app/etc/config.toml
-    containers:
-      stalwart:
-        volumeMounts:
-          extraVolumes:
-            certs:
-              path: /app/certs
-            stalwart:
-              path: /opt/stalwart-mail
-            config:
-              path: /opt/stalwart-mail/etc
-
-        envFrom:
-          secrets: {}
-          raw:
-            - secretRef:
-                name: app-stalwart-db-creds-17
-
-extraVolumes:
-  certs:
-    secret:
-      secretName: stalwart.badhouseplants.net
-  stalwart:
-    emptyDir: {}
-  config:
-    emptyDir: {}
-ingress:
-  main:
-    annotations:
-      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-      kubernetes.io/ingress.allow-http: "false"
-      kubernetes.io/ingress.class: traefik
-      kubernetes.io/ingress.global-static-ip-name: ""
-      kubernetes.io/tls-acme: "true"
-      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-config:
-  files:
-    config:
-      enabled: true
-      sensitive: false
-      remove: []
-      entries:
-        # Ref: https://github.com/stalwartlabs/mail-server/blob/main/resources/config/config.toml
-        config.toml:
-          data: |-
-            [lookup.default]
-            hostname = "{{ .Values.shortcuts.hostname }}"
-
-            [server.listener."smtp"]
-            bind = ["[::]:25"]
-            protocol = "smtp"
-            proxy.override = true
-            proxy.trusted-networks.0 = "192.168.0.0/16"
-
-            [server.listener."smtp-startls"]
-            bind = ["[::]:587"]
-            protocol = "smtp"
-            proxy.override = true
-            proxy.trusted-networks.0 = "192.168.0.0/16"
-
-            [server.listener."smtps"]
-            bind = ["[::]:465"]
-            protocol = "smtp"
-            tls.implicit = true
-            proxy.override = true
-            proxy.trusted-networks.0 = "192.168.0.0/16"
-
-            [server.listener."imap"]
-            bind = ["[::]:143"]
-            protocol = "imap"
-            proxy.override = true
-            proxy.trusted-networks.0 = "192.168.0.0/16"
-
-            [server.listener."imaptls"]
-            bind = ["[::]:993"]
-            protocol = "imap"
-            tls.implicit = true
-            proxy.override = true
-            proxy.trusted-networks.0 = "192.168.0.0/16"
-
-            [server.listener.pop3]
-            bind = "[::]:110"
-            protocol = "pop3"
-            proxy.override = true
-            proxy.trusted-networks.0 = "192.168.0.0/16"
-
-            [server.listener.pop3s]
-            bind = "[::]:995"
-            protocol = "pop3"
-            tls.implicit = true
-            proxy.override = true
-            proxy.trusted-networks.0 = "192.168.0.0/16"
-
-            [server.listener."sieve"]
-            bind = ["[::]:4190"]
-            protocol = "managesieve"
-            proxy.override = true
-            proxy.trusted-networks.0 = "192.168.0.0/16"
-
-            [server.listener."https"]
-            protocol = "https"
-            bind = ["[::]:443"]
-            tls.implicit = false
-
-            [server.listener."http"]
-            bind = "[::]:8080"
-            protocol = "http"
-            hsts = true
-
-            [store."minio"]
-            type = "s3"
-            bucket = "stalwart"
-            region = "eu-central-1"
-            access-key = "%{env:MINIO_ACCESS_ID}%"
-            secret-key = "%{env:MINIO_SECRET_KEY}%"
-            endpoint = "https://s3.badhouseplants.net:443"
-            timeout = "30s"
-            key-prefix = "/"
-
-            [store."postgresql"]
-            type = "postgresql"
-            host = "postgres17-postgresql.databases.svc.cluster.local"
-            port = 5432
-            database = "%{env:POSTGRES_DB}%"
-            user = "%{env:POSTGRES_USER}%"
-            password = "%{env:POSTGRES_PASSWORD}%"
-            timeout = "15s"
-
-            [storage]
-            data = "postgresql"
-            fts = "postgresql"
-            blob = "minio"
-            lookup = "postgresql"
-            directory = "internal"
-
-            [directory."internal"]
-            type = "internal"
-            store = "postgresql"
-
-            [authentication.fallback-admin]
-            user = "overlord"
-            secret = "%{env:SW_ADMIN_SECRET}%"
-
-            [tracer.console]
-            type = "console"
-            level = "info"
-            ansi = true
-            enable = true
-
-            [certificate."default"]
-            cert = "%{file:/app/certs/tls.crt}%"
-            private-key = "%{file:/app/certs/tls.key}%"
-
-  env:
-    secrets:
-      enabled: true
-      sensitive: true
-
-extra:
-  templates:
-    - |
-      apiVersion: traefik.io/v1alpha1
-      kind: IngressRouteTCP
-      metadata:
-        name: "{{ .Release.Name }}-smtp"
-      spec:
-        entryPoints:
-        - smtp
-        routes:
-        - match: HostSNI(`*`)
-          services:
-          - name: app-stalwart-mail
-            nativeLB: true
-            port: 25
-            proxyProtocol:
-              version: 2
-    - |
-      apiVersion: traefik.io/v1alpha1
-      kind: IngressRouteTCP
-      metadata:
-        name: "{{ .Release.Name }}-smtps"
-      spec:
-        entryPoints:
-        - smtps
-        routes:
-        - match: HostSNI(`*`)
-          services:
-          - name: app-stalwart-mail
-            nativeLB: true
-            port: 465
-            proxyProtocol:
-              version: 2
-    - |
-      apiVersion: traefik.io/v1alpha1
-      kind: IngressRouteTCP
-      metadata:
-        name: "{{ .Release.Name }}-smtp-startls"
-      spec:
-        entryPoints:
-        - smtp-startls
-        routes:
-        - match: HostSNI(`*`)
-          services:
-          - name: app-stalwart-mail
-            nativeLB: true
-            port: 587
-            proxyProtocol:
-              version: 2
-    - |
-      apiVersion: traefik.io/v1alpha1
-      kind: IngressRouteTCP
-      metadata:
-        name: "{{ .Release.Name }}-imap"
-      spec:
-        entryPoints:
-        - imap
-        routes:
-        - match: HostSNI(`*`)
-          services:
-          - name: app-stalwart-mail
-            nativeLB: true
-            port: 143
-            proxyProtocol:
-              version: 2
-    - |
-      apiVersion: traefik.io/v1alpha1
-      kind: IngressRouteTCP
-      metadata:
-        name: "{{ .Release.Name }}-imaps"
-      spec:
-        entryPoints:
-        - imaps
-        routes:
-        - match: HostSNI(`*`)
-          services:
-          - name: app-stalwart-mail
-            nativeLB: true
-            port: 993
-            proxyProtocol:
-              version: 2
-    - |
-      apiVersion: traefik.io/v1alpha1
-      kind: IngressRouteTCP
-      metadata:
-        name: "{{ .Release.Name }}-pop3"
-      spec:
-        entryPoints:
-        - pop3
-        routes:
-        - match: HostSNI(`*`)
-          services:
-          - name: app-stalwart-mail
-            nativeLB: true
-            port: 110
-            proxyProtocol:
-              version: 2
-    - |
-      apiVersion: traefik.io/v1alpha1
-      kind: IngressRouteTCP
-      metadata:
-        name: "{{ .Release.Name }}-pop3s"
-      spec:
-        entryPoints:
-        - pop3s
-        routes:
-        - match: HostSNI(`*`)
-          services:
-          - name: app-stalwart-mail
-            nativeLB: true
-            port: 995
-            proxyProtocol:
-              version: 2
-    - |
-      apiVersion: kinda.rocks/v1beta1
-      kind: Database
-      metadata:
-        name: "{{ .Release.Name }}-postgres17"
-      spec:
-        secretName: {{ .Release.Name  }}-db-creds-17
-        backup:
-          cron: 0 0 * * *
-          enable: false
-        credentials:
-          templates:
-            - name: POSTGRES_HOST
-              secret: true
-              template: "{{` {{ .Hostname }} `}}"
-            - name: POSTGRES_PORT
-              secret: true
-              template: "{{` {{ .Port }} `}}"
-        deletionProtected: true
-        instance: postgres17
-        postgres: {}

values/badhouseplants/org-badhouseplants/app-vaultwarden/secrets.yaml

@@ -1,31 +0,0 @@
-config:
-    env:
-        secrets:
-            enabled: ENC[AES256_GCM,data:hwTU7Q==,iv:1/GEM3RSfu11iQVA5uEm/PoZm3Vr6CZ1w7Qc4edUqgc=,tag:gAUwZ4IekLiyyPZoM8FlLQ==,type:bool]
-            sensitive: ENC[AES256_GCM,data:tbFk/g==,iv:FaKXMZxlcdGB3YI5+RC9LZR7S9FNZ87yPrJZsDJlhqw=,tag:+V77+cV4fRLTzi75o5OYQg==,type:bool]
-            data:
-                SMTP_USERNAME: ENC[AES256_GCM,data:Bq10,iv:h17Bam1uR/dhz9um0ixzVPKHlqY5GtU6V2+CjTPvuaw=,tag:x+WCQVTySTyHAkoooZg2NA==,type:str]
-                ADMIN_PASSWORD: ENC[AES256_GCM,data:eeJY2z6+Is3+PtZsRC6oyrJ9ArPMBpa2VQ==,iv:hHf/6AYUT3wHbKHPd3dfiTbmoaWr5OSnnRC68/15A90=,tag:qEQyvC+MiAdy3GcpYBIWFQ==,type:str]
-                ADMIN_TOKEN: ENC[AES256_GCM,data:pMh4vnJ6t80okBE5ywe+8LBSb5U9owebWuavCYPwqQ7bpB7qNfYijTbWS0afZGag4wEeTe4t49dNeFTEZ0ztrfm4yXyKcLFCV1E=,iv:RmV55yv8ytW/LvuuK9IPTsKPPdgiIdKX5PnkF5YCKBc=,tag:uRsiwnhYm/1lRfhDjDKqJA==,type:str]
-                DATABASE_URL: null
-                SMTP_PASSWORD: ENC[AES256_GCM,data:xx56/9ha07j5fcwDBuzOuFiS6PG1JHE7rQ==,iv:bT47zy9xk5eNz/CCRV5WEy0PAiFsBBxUxkZTCRASfE0=,tag:h3V9peXifp9lT/84TzWKLw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoaG8vRkM1cll5VDlUVW5v
-            WVA0SjdaOWkrTVoydERvcmFjN3ppTjFQdEZvClZENVpYWXMwTVoyOXFYL0xSRGFw
-            NnZDWUM1MGNla3daMU42dEptZzkrWUEKLS0tIG0reXRYMmpuOVZWbXJTbXYyaWJK
-            TE1rZDJ0QmY4VXJSZXoxMTRkNFgrZncK2AL7+jWWeEiV4ERoaCN9M4H1qlzz9i+F
-            23w3rtioCm2hJcBCnswU8Bs7OsBZqC8++35V1U54WktynWnPUcjcrw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-29T11:38:09Z"
-    mac: ENC[AES256_GCM,data:d9902N6sfF3aMokh9rZemL97i2hkwoPdAaJOoy/xFvFyDa2pxKuhwGJH4QU6JRnoqtay1HtnHsDXLggdxHgmUbUtNReVQdPbJhSHRhlDsuAM2ed+GCnecFQE9ggpRnwDn1wjemBqpn40uo9ka4XyMtuLJ9uaHqXRuFR+8y8oW18=,iv:EspFcGUXPgtgXzEWB1fE5O3ig0JJBIca+b6LLb9wJ0s=,tag:6UexlW0uVZUUG/zleiXnZQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.2

values/badhouseplants/org-badhouseplants/app-vaultwarden/values.yaml

@@ -1,63 +0,0 @@
-shortcuts:
-  hostname: vaultwarden.badhouseplants.net
-
-base:
-  workload:
-    kind: Deployment
-    strategy:
-      type: RollingUpdate
-    containers:
-      vaultwarden:
-        envFrom:
-          raw:
-            - secretRef:
-                name: app-vaultwarden-db-creds-17
-ingress:
-  main:
-    class: traefik
-    metadata:
-      annotations:
-        kubernetes.io/ingress.class: traefik
-        traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-        kubernetes.io/tls-acme: "true"
-        kubernetes.io/ingress.allow-http: "false"
-        kubernetes.io/ingress.global-static-ip-name: ""
-        cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-
-config:
-  env:
-    main:
-      enabled: true
-      sensitive: false
-      data:
-        SMTP_HOST: stalwart.badhouseplants.net
-        SMTP_SECURITY: "starttls"
-        SMTP_PORT: 587
-        SMTP_FROM: bot@badhouseplants.net
-        SMTP_FROM_NAME: Vault Warden
-        SMTP_AUTH_MECHANISM: "Plain"
-        SMTP_ACCEPT_INVALID_HOSTNAMES: "false"
-        SMTP_ACCEPT_INVALID_CERTS: "false"
-        SMTP_DEBUG: false
-        DOMAIN: "{{ .Values.shortcuts.hostname }}"
-        LOG_FILE: /app/logs/log.txt
-
-extra:
-  templates:
-    - |-
-      apiVersion: kinda.rocks/v1beta1
-      kind: Database
-      metadata:
-        name: "{{ .Release.Name }}-postgres17"
-      spec:
-        secretName: "{{ .Release.Name  }}-db-creds-17"
-        instance: postgres17
-        deletionProtected: true
-        backup:
-          enable: false
-          cron: 0 0 * * *
-        credentials:
-          templates:
-            - name: DATABASE_URL
-              template: "{{ `{{ .Protocol }}://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{ .Port }}/{{ .Database }}` }}"
-              secret: true

values/badhouseplants/secrets.external-dns.yaml

@@ -1,23 +1,23 @@
 env:
-    - name: ENC[AES256_GCM,data:iUkU/BNlitD6f6RQ,iv:x5aENGi0aw9gDh2a7h92DfxwQgdbacM3hHtnPVdIKWA=,tag:4vyOlP7XcC1F6pjnUieAuA==,type:str]
+  - name: ENC[AES256_GCM,data:RLLp8toAkoWLWRjp,iv:UUP3i5QkNBw/pgYmxHtRUDx0E6i42e/Ioh1z6WnLESk=,tag:+PEinrzkisEQx5gVCpdJ3g==,type:str]
-      value: ENC[AES256_GCM,data:cFypu5mF+ktwjNFCBcy0U/1UIt4Fc/CAtH/SngvaaBXY0yinYzaiOQ==,iv:2VQ1Cpmppkz2ylt5NMP84o+0EQkI43jz267HNRjMugg=,tag:co3LJzwxbmxT09km65MVuw==,type:str]
+    value: ENC[AES256_GCM,data:RKiCvUOctYha7fusMWNrOKHPgmMMjuejDCip470QMHQcxY1S+yJfXA==,iv:ESfZNZimJkD5T4tzRPMu53H+ushbhOuXaOdX73MaWV0=,tag:F516VFRCw6k589vClX8Jfw==,type:str]
 sops:
-    kms: []
+  kms: []
-    gcp_kms: []
+  gcp_kms: []
-    azure_kv: []
+  azure_kv: []
-    hc_vault: []
+  hc_vault: []
-    age:
+  age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
+      enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
+        -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwMXNsQjEwYXdaR0Y3bktt
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3eE5LTURCa1pyRjBocVpP
-            UGFYS09Nc29IR0w0YmpweUtyV2pPbXFPeFJnCjZkclRSVjREanorbk5MKzJybWJI
+        ZGxXMUZkUC9XK0xNb2duRnJiOHNzNGp0YXdrCkNvNWMvYWkyTHhQU1ZZeng2bmlz
-            UDlwdlVqWGZockVVeFVrNnZlZGp1NUkKLS0tIDhnUzgxdlFWa1NicVJEUk81cXp5
+        bGRrd3p2dmx6MjBuc0lYakhMNERMOVUKLS0tIGpsRHcxdUFtTHlXVGZLTEZ0c0ov
-            M2xvSjRrNUx5OFRqbUFpSXdyZ04xVzgKMsBwKA8dVSW9BR2jSTBxMPKevual5P8I
+        b0RMSlFCM250MXJHbWhRTWtGbkxHc0kKpyzba8yp0xN1KjcUACcmlznH9vQtYAsL
-            V+YUcIIUAP1sFjs4jVhTduBSMI/ZSArWYIEX+dQ46oGDLcRzODm9xQ==
+        3bm7Cw2AZO7nkdCxky/ITd8N3rbqAVGeM2CeTAxpcMbEXKq66/yqDA==
-            -----END AGE ENCRYPTED FILE-----
+        -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-16T14:21:33Z"
+  lastmodified: "2024-10-15T15:21:16Z"
-    mac: ENC[AES256_GCM,data:5nE5vx69ESp0HW0/uxYGp8Lq35Cjb5UpSmNkx1H4ux67K3xs3zEBSrupDuUqzrrj/WFFgTf8fIAnfu//bEUvRqtqkIOb7eTqBlQTCzdKWLMvfwhv3WnfXLljJvZZH+e430z7ayw6psfNbwm5sPr+/sPSijg31xv8x9wN8LfZqno=,iv:BKyKMqQ/eLiDspSlvMh0/I7hKb3xn2BUQhuHwrl+Pfc=,tag:is4SHDuAT2c3Ip2O5ifgWw==,type:str]
+  mac: ENC[AES256_GCM,data:aIXlmeiqaFu9Jn0zI1qyU3iAkhLKgqMwwLcLDlr+LeYX/88cZtzgP683jW3MYC/LxnNh4LG7v8EK/HViNnCkrvZ5iC9cibRPQYZJrkR3B3oGk4L+RxPws2VUa72pJsG0bQ8M2DDCoDO2T9OuuflqYENPLyYLL7D7CaeSj9w8G0A=,iv:EDaGmWFUnzp0vkIeR1J8iZ9+PjOMuRi4YltoqJAN0P0=,tag:DsSd6Nplvy0nIWaCJgnhgg==,type:str]
-    pgp: []
+  pgp: []
-    unencrypted_suffix: _unencrypted
+  unencrypted_suffix: _unencrypted
-    version: 3.9.4
+  version: 3.9.1

values/badhouseplants/secrets.minio.yaml

@@ -1,33 +1,30 @@
-rootPassword: ENC[AES256_GCM,data:CtIVMGYDrJ55wS6ZfLipEur8VeM=,iv:Vz4o+1JInlowgKwYN1bI9oxhTm/Yq8B5uhxIBh3SZ10=,tag:xyH66UMou4nalSzGps60Kw==,type:str]
+rootPassword: ENC[AES256_GCM,data:X4PQGfbMObmHkD7Qk1AGlnMK748=,iv:+obQfzC6F7cBNY1d6WpMPAMRZgfO9XXc8jFPZ36ShLs=,tag:79EvpFwM+vqqhBazwejXHw==,type:str]
 users:
-    - accessKey: ENC[AES256_GCM,data:wqwCa8NXAns=,iv:3oVMHIJ06q8OdpdufDH2R1CnV83ltweluMIFEplnoGw=,tag:1uLJAU0u+gMXHxBRbJ7mrg==,type:str]
+    - accessKey: ENC[AES256_GCM,data:nhagvffOzcI=,iv:HvLmKNCLapLpzpWt/xBRmAWhf73SnDA5qqbmOTxZi/0=,tag:dzBP0Yyv/M6Xvjv+fpFDew==,type:str]
-      secretKey: ENC[AES256_GCM,data:JnqlayhzqKro+tdDY70//ty9pg==,iv:2Vu8ZxKR3gMHQ99AbP5HAjAJJY4hnnXLtlBzShzgdjg=,tag:zk+tFw7sURDE+T4dDF3Bqg==,type:str]
+      secretKey: ENC[AES256_GCM,data:9IEqubInFr+m9QAnttGQYQTtVA==,iv:adfRWA2TYK+KrcnmziiBA3AgUZ+TUOzA4HfXUITQIFM=,tag:xDcFCmJA4svH7mcgeQseRg==,type:str]
-      policy: ENC[AES256_GCM,data:KOonZYe6MYk=,iv:o62YxxnBcpDhcnp6qrbJxDpm8GMzFl85QOw4Fd9Ask0=,tag:UBsKKdw5JLmOA5N9HHaVCA==,type:str]
+      policy: ENC[AES256_GCM,data:gQd5QKGHVrQ=,iv:nTWo4wHr4xzZn08DrJGXeceZqdVjy1ZY4bX3kMXl7Kk=,tag:5ZjPAtQyhsg7nBQTA2Kr7w==,type:str]
-    - accessKey: ENC[AES256_GCM,data:hQkz,iv:eJrFbiYcuRrZYRtk1UN3fL4+48nNUEdIKcCqH5RUShQ=,tag:HxnFCMdIB8HfixkUvE+LGw==,type:str]
+    - accessKey: ENC[AES256_GCM,data:XDX5,iv:520OfJb8RJgWpeAJ9J4V1jIAwXl9jT/V7GuAMr8PmBY=,tag:LOETQbQT7kwA7EIjAlPWLg==,type:str]
-      secretKey: ENC[AES256_GCM,data:R5uGEV5xGu2nCk4H18B7rXWyD+S3huHgig==,iv:WFjo+mHK5z6wXZZicezTlPwnlyU2mu7WljKz8lft9dg=,tag:P91sHa0yG88ka6fTIGrXEA==,type:str]
+      secretKey: ENC[AES256_GCM,data:QlVpl3lks1P81dLQdUuM6a9irH2ny53ZsA==,iv:eFADkYo9oj+ODQ1CPbIVc/rfA6rr8iF7wglfFksrkDo=,tag:JyFMTyuuQyWHaMLHKXOxEQ==,type:str]
-      policy: ENC[AES256_GCM,data:qeqH,iv:VrawQSqW+rhiS7NXdI7l81fy+c6GJkxYyfLEHYfrayc=,tag:JGQ7uxkPPzH4uUA0ZicKPg==,type:str]
+      policy: ENC[AES256_GCM,data:yeC1,iv:FE7WNpWN/dxgkBi9QJxtYRzZTnpgjYJ/ar9/45bETMo=,tag:eXN54Gvw9PXbp/vNoZLrNQ==,type:str]
-    - accessKey: ENC[AES256_GCM,data:CSzeTJP1kUMA,iv:VoD9gDtPUTQzWCxXMVfMH55M+OCrOtTzI5SgQUpUCpY=,tag:B4pjW91ENd66sPbh3JOxuA==,type:str]
+    - accessKey: ENC[AES256_GCM,data:drqrZ3/nCyGX,iv:ey3xBAhJG3htB6sehhAONQApwUgR0redb11wIyanyhE=,tag:2PM5xvwY9YjvJLm/+clF+Q==,type:str]
-      secretKey: ENC[AES256_GCM,data:rJu+Fo+SgZrGQ9nwEXih9gSZJqo=,iv:4RRUgquy8J3OODzktlGfIPwkVtCZa6SCsegYuTCsPyk=,tag:DjTKVpvzL0WlWKEVzAiiyw==,type:str]
+      secretKey: ENC[AES256_GCM,data:iKpEQkDFqYn7k5I2OVcIDrWDIpQ=,iv:m7FeYAIt0/jm66gWenOrOj2X989vpRQKr+GYdw8mrRU=,tag:GHOPwRLdRfpc2wLH4tX/Cw==,type:str]
-      policy: ENC[AES256_GCM,data:ZLRECDxDQcRQ,iv:x6qIPiRmIEdugU5WtFoErBbvpvS5QklaM6VzQlfSwcM=,tag:ZLbqfthesZmmfh4GVL+JTQ==,type:str]
+      policy: ENC[AES256_GCM,data:4XqHiO4Ut76p,iv:KbwPkexAVDaahi4F/Q6Wh6geGy28OggE2Rptmq1Lxrw=,tag:M5wFcNICGstXXGP5e+umcg==,type:str]
-    - accessKey: ENC[AES256_GCM,data:JnhlVBg=,iv:TBkM5z4ZeVxHyOnsAoMmWg6I/V7f962NbzqcvKtTkBE=,tag:di+TL5BRI1hLxnBLoB3P/g==,type:str]
+    - accessKey: ENC[AES256_GCM,data:ghT3JzY=,iv:65gARnb6O1r7nSJioVyZs7SyBk4aiDgyEq8iLFeMatI=,tag:pLx4r6txAjBBjnmG7AcTUA==,type:str]
-      secretKey: ENC[AES256_GCM,data:v00te7PKaNYXJ9C7eaN+w0Etl90qCShjsw==,iv:zIYh3qoDXp9ZOMPMGEzye3eu4bFHie5W58WrXRZdxME=,tag:C9Pq60Z4hQeIPJ2iIb5YMw==,type:str]
+      secretKey: ENC[AES256_GCM,data:Eq4OG7kPFxkhQ+gX7/ICSvjaWxf68nUs9g==,iv:1bgYfjXZLgVvcPTHNtOBaRKV5dWp/RmkisRdQUfWJqo=,tag:t8T9DY6+lr4VPofnOI+g+g==,type:str]
-      policy: ENC[AES256_GCM,data:H4WdjEk=,iv:WY52cXnGTug6I/F+ybQOtHED2fkoSULpJa/rP9smacw=,tag:GfoAGESDyb/oKmPU2N+IsQ==,type:str]
+      policy: ENC[AES256_GCM,data:7bF0/18=,iv:k5zb0KRyfOQvSWiVhy0au683aJhthrBoqxLHWyXuQD0=,tag:y0P69LtUb+dBc3BARp9p3w==,type:str]
-    - accessKey: ENC[AES256_GCM,data:F3Y/yMIvFPWX,iv:6qj9h1amuusGuOon9h/DKPjT7dk/akMVKMSLuKR80Bs=,tag:f2pEP3pYju2EbMYPZg+ijA==,type:str]
+    - accessKey: ENC[AES256_GCM,data:b923YDOG9Oxl,iv:rSDiwfWEzCof7Lj5zkOpvcH2p+zI4iqQC+uPxQUUvyI=,tag:gRUDQha2EITQ1VkCurnT0g==,type:str]
-      secretKey: ENC[AES256_GCM,data:krN8EIKt9cjd3EsKIAmdoSQ9y+IHy1LIeg==,iv:dk3wH2yY/IDBTEahYACAYsImNfiq9Zd697BcLvD0QzU=,tag:LYhBXJ1rml4ts7kEtfnJ7A==,type:str]
+      secretKey: ENC[AES256_GCM,data:iwpLzRUfZTqWWwzw+KOjko8rMcWwz0P4eg==,iv:THFj+8ILYlTHU8dAcCony7bI/5q5A83dRsjHoqeXa74=,tag:bo3VK4WflhXN9iGdkthYcQ==,type:str]
-      policy: ENC[AES256_GCM,data:sdydid+WXGxv,iv:P7plZmbxi3egYqYqzxc01T9/1edpZf1+RFTDCcezNn8=,tag:dLtii9vqw6s3lVXGO4KAMg==,type:str]
+      policy: ENC[AES256_GCM,data:v+H0vmJXHeJK,iv:S3JjrjZm4XdJnsg7hvXBsnZ0y+QSVD0zPS1cJlGxIw0=,tag:KBWkrID8knK6pvB8oa30ZA==,type:str]
-    - accessKey: ENC[AES256_GCM,data:hHjmZVAqUlY=,iv:liIg6UHUUl6B6eyFuWog2yu9UwrCP7hRHj4RRCnFdi4=,tag:UeEmUEm9ky6QvCc2KE5GEQ==,type:str]
-      secretKey: ENC[AES256_GCM,data:Gw3TRUHOkxYKCLh8giPOsC7n,iv:Kr9qbns7RI2kTFIphwIwJT9M6H2pCFKs+dRbnFdz8Jo=,tag:rKEQ7+5wt2mqK7QjVLJR7g==,type:str]
-      policy: ENC[AES256_GCM,data:c8J+dTNf+TU=,iv:yWxrOJvuSFPByV0vDcAVZSAhsiE/1m/PdjsqdJQv+zE=,tag:aQwQThS+FeeoxJWdDGG4JQ==,type:str]
 oidc:
-    enabled: ENC[AES256_GCM,data:iZ4KHw==,iv:tqyJs/qDfsn8hzGlBf7QZlfBpqImkSHgcDAjlGpleWw=,tag:v9qEwW0eOInDMGf1RMf6LQ==,type:bool]
+    enabled: ENC[AES256_GCM,data:c+ODwg==,iv:bY7yZXxhj5fGdT85yPEGD+2lsQ2l0+6BJkMcYzcZCwo=,tag:uHxzyeUpypMvcswCVv2pGw==,type:bool]
-    configUrl: ENC[AES256_GCM,data:meUwpcosuZ30Q+T9XhdhDV5u8UNY6QeEjHvvjc+4+bw5prPz7UpvanwvY2kz87kxjh/Jbr8vBe5BqCF1av1QlkLcpIRzVI/L3Fh3YInsuvNSdR1NITNZCM0=,iv:Is0pXDLvGInFiwbYgAi8vWvMRnoGcWsYqa1PWr7ks3w=,tag:qwAP3iBq8oj7DCDhH3V5AQ==,type:str]
+    configUrl: ENC[AES256_GCM,data:pzbhMON4qNE96d0AYDO1ojvXvQXBVgIWtjeRkpj7psDo5HBOLew73dzDPJgThWsZYthv5ROaLqQo2hmheuc0cP/AAa8JSaTGWFD13iN3d18iPI8ZaxnxZFg=,iv:GEYB7lX4+NWeD9VgjFu1CChg/ClDGvO3rGkuxvIcql0=,tag:QWEg0kMMcmIcJdsFgSCYqQ==,type:str]
-    clientId: ENC[AES256_GCM,data:tXLjOTg=,iv:bZqJa1VIcW3ohIACqruhDz+W49AX03qwCS5JniX7FWY=,tag:kcd6p07kflnOs/0huSUe3Q==,type:str]
+    clientId: ENC[AES256_GCM,data:DXn3ZGs=,iv:xHYHMB+LpMwdGgiiMcq5RE5idlEII1sY/7NWw0rT3aw=,tag:oG1pOyPnJCd1DUXtPQA8Bg==,type:str]
-    clientSecret: ENC[AES256_GCM,data:iR8vf8S4WYxRw5d26ROva1dWRa8VjbXEG6CT3TYiVTe0GJxzeihmD3kes7D2Ps94TsWChUho73GVlNrwMFyDLmC63xiwIRTYLsmxEjH2hxpRa0ickzzJ7yYiSm63TV7nMh87hq+ZZvBWA8W4NCA036uNSVNYUg5p/traBo7250M=,iv:28LxFf7QUtW3t2hVH+bFVSqemLozy43Ii2AJJ715TGc=,tag:GATqHiD3f+3sYtpGHlpMcQ==,type:str]
+    clientSecret: ENC[AES256_GCM,data:XwMEAxsyYnN3b2zTSIy7a3WGqGAQLF8MSQPMNXkx/zVNd9q6hVINXRbqeVRgF+y923DZYO5qnNdKhrVgby1qg7xYxgPfkK/ouDrzuftDa4agEjzJXw4QXRpHpaWujyYk3ltaRzi6ySgbMwj2z6G+ZMsbKuNKbv1yS1NOI/T45+Q=,iv:MkiPUjZV0HslDSZwc7sqzHzrejHRRVa6AIbLYZzciLQ=,tag:hp3uZjYJcDoalUOxGGnOGg==,type:str]
-    claimName: ENC[AES256_GCM,data:JPQZn+sE,iv:R7POgpEIk0l/5LD7viJ2CYpNNdGuUEUa35190UEzcgo=,tag:7fNRwiTx2s8ep8Ij2J0ekw==,type:str]
+    claimName: ENC[AES256_GCM,data:Mml/efpg,iv:imZD0TjiyhQRntes4Z0AcnjvsTjgdsRaFTnhFlqcxQ0=,tag:+oAMOz4tmi0yvmNPiDuqsA==,type:str]
-    redirectUri: ENC[AES256_GCM,data:M4PIfUybd3oEsRl8NOnDaWqWKfJPady/n76RD/jYTwpQs2f7Yk4hKbAJo6HAghw=,iv:wGM0+MldvRrf5kJjepEIJcQwzr0B/NhHJaranZI3/4s=,tag:PPOiO85oYW2Y0wuZgEtkNA==,type:str]
+    redirectUri: ENC[AES256_GCM,data:lRx520z6aq+UJc8a7NY/MNPQjOuDqY0Xuha9bOJn47tR+pkq63jh1ShYhmOM73Q=,iv:jCG6lxPV5jXdyvF7Td4yasHiqC1U22Kg6LdLqj8rKh0=,tag:5ix40wSSEW2JgzAZlgOuIQ==,type:str]
-    comment: ENC[AES256_GCM,data:L1MieehjgkbmkzoZPfKcZneiDAc=,iv:/yHluidYeCmGZu2XiEH0XyC3/GIThFHQbTblmKWShe8=,tag:oAd34cZnaULR2wnLGyzMEA==,type:str]
+    comment: ENC[AES256_GCM,data:mhzyX2SGy+12XjOl6PICR2Yvazs=,iv:o0O70wKypt6+HB7ex1Pno4A4XxB8ldTU5NTh627vMcw=,tag:1hlYLXJyzhLb3x0oYIee2w==,type:str]
     claimPrefix: ""
-    scopes: ENC[AES256_GCM,data:JDHNBeFHOnU6atZ2bChXlcOKQdsvCWBNNpCQ,iv:jSUNd0I32fvDbaIE5OYvyXRu/cvYnPn8H0j5bbfYzh8=,tag:DmzMYBN5VFCejbLYh8En9w==,type:str]
+    scopes: ENC[AES256_GCM,data:ztX8pA35GP2+kLLvQo5tLcsGdz2+/AGrwFJw,iv:qldaOWV5asc+WAAiHVAYoNkXVNMPVZfVTIHj3jd/cO4=,tag:6A+JiirnO7aMjO8i0zYbjA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -37,14 +34,14 @@ sops:
         - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXMGwvaUl5T2swV2I0ODMv
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONzFwREQ1dGdpS01VQ21I
-            VmZtUFJYQVNUc3hUTHZjOGxHUjhqMEdKNUFFCjgwUjhaT2hGQTRSd3NNMnhkUHFO
+            RFRna2QxejdiSUppZDlaeHpNdzhFWlQ4ZDE0CmNpR0hNMTZBWm9FdDhWY24wc0hD
-            bS9QZDZtVE5oV3dmR1RkcVpPTVAvQ1kKLS0tIFdaNnRqVGJCMk5zVkNBRWN6TWNv
+            RFBCWHhHekdja0xnL1BVOFVST2FGOFUKLS0tIDRkVW9ESnJLWmtuS3VWRDFna3hB
-            TlBsSmVENGw0TFhmemxmOXp1MHhseVkKwwpMCzto0h5CgE/xBX1rLlqhCzGRfOTu
+            aWlhcU9qSmNsRERJRDhqc1h3eVVOUncKQc21maFwBHZzD3xMedoqmCEFOwaTZkG8
-            JHvvn7OffKO0XDHBw/BRVJFtd9nbZPvlj/PNi5I7voFY8aJmxh5rfQ==
+            OD0o9sqjHqrHj4vqlWjj2LwAAoq3bL/ttvbEjm7jm8tHGIHTh13TDQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-15T23:35:02Z"
+    lastmodified: "2024-12-16T09:16:55Z"
-    mac: ENC[AES256_GCM,data:C0/AtGBnOsnky+yGVLuUquN7mdyewemGcaXu39H81CCjYgPx2sgheIMW14FjzCbAsVazoWaK0/cReTl0Pzlgjev1C7C+BE3RgVLMP7VtlLhPjJO8Qu7YKCxS3QCUh0UqDq/apoZoxtL1sKRBvfbpTOHa9xYfVzPrXcIcxuM/FC0=,iv:t12yHlPHy3CW6btSaI4d1yeIb+Giwh2WzBaxhavf6U8=,tag:oMG2zgRps18oPUtR642CJg==,type:str]
+    mac: ENC[AES256_GCM,data:+gZ0lhBo4j1GKfGupQh5UxYt6C+yfTRrMM2rwabU8Tr5ZNWviNfGQiDk67Dyio01NH4wAL6EhcL+xwG0+94DlTd/++VieKBQuCABhnugi0wvJO/wp2HOjotmb9hWhF+kIXLj2bPdkd0iJQuZM5CbDy1XLUlYaRT0H7s7IGA8QI4=,iv:jhrH7+Io7lx5xMS7feq/4g5iW58QFWjRyCfDoUZVC4g=,tag:6ozB9/8ULOJg8WHvAZYgpg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.2

values/badhouseplants/secrets.stalwart.yaml

@@ -0,0 +1,24 @@
+env:
+  secrets:
+    data:
+      SW_ADMIN_SECRET: ENC[AES256_GCM,data:SsReruQ9zGMiDcgfcjscnUH/4JBvGDNOyCH0vs75xXdSEPhERR+jju4aHGfd+mRcwvc=,iv:Oz3evN/OXUvEAWeYsP4wIVMwA2qwuB+Ny2Xy0EchrJM=,tag:C7CpSzG3RR1WhsDr6BfQAw==,type:str]
+sops:
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age:
+    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKUjdWR3pubjRuT3M5TEM4
+        eHhycWdZdTlRbFBaRnE1a3BqWDBCcHNIcUZFCjcwZ0tmVWZ6RkppNExWVFlJK2Ju
+        ZkEwam5PRXNQTUcveUE3c3NWdFE0amcKLS0tIGFnZ1dNRWppTEVURXVpN1F2Um9L
+        dm1HZ291WWhBbEtmdDB6aWJETUNLRGMKuP5y1lzxs3vusvJZLqlnTR+mWnC7YmNo
+        dhGpvh+W3nIrgb50OJV64xDU9Hqc2jVETmFq4RWqwEQTwSRv14grwg==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2024-10-14T08:08:21Z"
+  mac: ENC[AES256_GCM,data:+/WrvENJ/B5YjRb2K5D9V90ziuEOmP4a1D6CfdQHRShRPp4BZHtBFb5vr2kRIIY88eiv9cZm29G4U4X/46wi0SotxTpVOrefmM1ZQ7cV1J9o/mf2mnguno7WAsxEyTkk+MZoCgZEWbLEKZ+zqlHgRTN0VfBgBjbLR5bP39fd5xg=,iv:otaCp/LxQVUIZLAmLzceDQpvAY4bnPUm3MlyWUMW78M=,tag:6CXYN6/uAbetm7i8OeZA7g==,type:str]
+  pgp: []
+  unencrypted_suffix: _unencrypted
+  version: 3.9.1

values/badhouseplants/secrets.tandoor-recipes.yaml

@@ -1,8 +1,8 @@
 env:
     secrets:
         data:
-            SECRET_KEY: ENC[AES256_GCM,data:EUJXsWqV8l2YN5NkXvKqQRT86P3TS9d5fca8/vhN,iv:lFIhGFtCW9vAYwc5dSmkBYOqo6B5YcZygu6zAZ1qsrc=,tag:tIVk7YyN+bciP2wl/zMZOQ==,type:str]
+            SECRET_KEY: ENC[AES256_GCM,data:9ABsIVICRj0LO7q1iKPatWkjPLaqpBa7EaXIHzT7,iv:2P2qRyUnP7GP0VXTulxbgplagyaAV4RvHsUPEXuieq0=,tag:juNh+eY/7GfxWMb5VXlNjQ==,type:str]
-            SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:ZOHbv2LiZFBpxwCwD3we2U/NN1WW5vT14Fata5mA0amjPiXMuGgZYjUhA78ukZPbVVtZ4NTrOj/xLT1SfIzqDi0noDFmFuLVvQ6kjZ7/qdjPXUS5BV+63Bd9aZcrsyAWGujDhzMcjJe7ravIh6ChuIdqq1tkP6FL7fKcpg8Y1PFkIy2PfPjtxogmiOEbakmIJJ56ykPn8O6g5zFa69o7MsVueJAKk7fR1n9SBeZg/bKGC/iY5i1bnAqRdpQO5zRliZfNvrtz0Dk7Cl+jwCjl3cn4lp1u1sBINvAE5x0vrxWKPLkW23hgMIaRAvFB99FiBdY8UjBNM30NNiQKr051S8IgMyTE7w54yZZQZrFprqE1VplKSuuF5ope5CRS1mu/FxiZFjl0T4cYGxJt49S6cVlL2ihKO8Kkw+Jw7FRe+1hfaF/3i1S4O2g6adbAStlnaFvJgXRUiZt7grQDsSqy6tr6hemlOOpVp+b9//NBxb+rXWqUSph1dmo03viRAW3OZKzl7tohrJbirMxHUN6gAIBAvnd0go3qbaWjNg==,iv:nfSnL0kLCvM6d5UtMqp//7FCoWBVdftRPJAWRTtu8Fc=,tag:o7S4B6rMP6bZnHguw/w2Cw==,type:str]
+            SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:VaPaCl6QAn7cn1OlZYD/tkJk8jgDCyiTvrfGydWrFtpUJFyNA+Wfj6sWvkTqhHTk5GYN4h0IIfqQScxhTmbxHmnEctyorC0AvFEZRw6IQ0KGFgdoQFZ5MPcb1kL3neY+GJwm7UAmH2AjAwG7PTZJsnha7N8q672IkAljCAVAokL7s6IS0vGzVHbyRy/tbR1BxCWcJX2WF2kpXAlc+mTKMZWsFChvrjjK1h4RyrYIDgbKGhJVM4cnrOzGrliuI58Ief+QERMXsFMIY6fbUsPT3eGe+oQQ+lKZxvlEbgVZsnsafQX6ZSWvtylmYVMgNsXbdqsWKlCnRfmATkS9sSJiUX59/ZtZcL3giRrXNlnv5poumEp9PO5euexXwlmJURXOnnD/kEcJn/PxuL2aV390I8TmaNGUZe0vzrNDSVOhCsykGMxf1L+MO5+aU+OndT0FH6l1GTQHNzzeo8XRrF5U9EPN6dTxbYWsu4GL9WuL0jhm/wYlbn1bhNnr5+1+xTpAHl20MeVQ0t+cCiB/7ALraPnFS88HQiA59YfiJA==,iv:qZa9zUL3c2bemBFk2SexY5TfDYUVNkk8QbB8Ucj/040=,tag:8e6CddYfCPnCKSN4bh3XMA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -12,14 +12,14 @@ sops:
         - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3NnFEV3ZJQ1Z4Z1FGb3Fj
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTZ3JPMzhhVlVFR2R0R1hP
-            bzRkVjUrTUFIYjVmRXVYMFVsaWtKc1lWU3lZCnp5QzAvR0FXalR2QlhNOWcxZ0Rh
+            L25HUUdZRGp3dzViSk9vVXVvMVNTWWN0VmhnCkF1Y2F3SWdzR1p2LzJFd2xiWExW
-            OHJzak9vdWU0WlZYSVE2ZW5hUVcwdDAKLS0tIFZsNURiSjU4ZjZtNmh0K0xRaUpv
+            UnhjZVpFM3NOaVkyYXBKUGZiMXFSM1EKLS0tIGJyS1VRTnJKYjAzcXpMbnd5LzhP
-            UjA3U3FDL200V3JPQ2Zmb1c0V0hYcDAKbq2ywx3x9aiG+pCA/e87ja/1HfuA1o+n
+            bHd1UGd0R3NZMXdUblAzMXZFUWtPUncKab/saT736wWdksBB1swEZMY25LICviqc
-            BNeRIrOo6y4DBoCfaYVZc8U8m46Ul18RyGePsGUTVp1SSX54XfPb0w==
+            pzSL7VWlN4d+KEZu2mS4Z8Fxd+PqLmbKFtBL0pIYyXxmHmfI2AVS6Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-25T12:38:20Z"
+    lastmodified: "2024-12-01T23:22:38Z"
-    mac: ENC[AES256_GCM,data:yGvodMxMZWnExrWayPH0tRdDHvzeVf4dLi/AlEU/Smfh16K1rM2vnVLuo2EhBbaGj4nPl+VHGFdMgz+AhnnUhTtV0ez2uIPyGDLBJL5JhDG2937FjvJ7qduT9b/h7u+y9V4jxquaFruCAOX+uRLmsKuEucEuAAkMydRmRAM3HBk=,iv:KJpcAWasTALTBDgTYV4dh9QR8NIUmu5O5vhbZiknLyw=,tag:esfjk8CBlNByqU21l6zW4g==,type:str]
+    mac: ENC[AES256_GCM,data:+5B69+er2ofT3sk1a7bvZiTqNpGjlaPTWza+pZP2O0wOw52IxhLtJdzQbxaCeAYoztYqAnFuqnaSZM7BL9AoV8bq1aAwnq64/KquWQ5KtBaY5YxDSrt0XFqDW63gAmcO+kyi777HwYSjpphMg8L3hRMebnypVju08il0twaDfww=,iv:xI3cU0WfH9TQ8YyLwqsJqnPKhVCKX+3EXQrm3ToY7ZY=,tag:Lz1jjjiZnd11AZaQv//9CA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.9.1

values/badhouseplants/secrets.zot.yaml

@@ -1,25 +1,25 @@
 configFiles:
-    config.json: ENC[AES256_GCM,data:AmfyqvKW4RhxD3mbFNP9Qt6oKzvpPY78ysCwCDoQAHW2exl9p7JtQh/8M66HyE5dogTyKYfl5cpKrgafWu7ndfN6gCF6puHPC5uELFmJLpla/hrhivpBBjcSj5n4Nc3mgJVSndJvyvkOa4c8N7NInr41LDh+Ndv6kbEelyTOQw9gng5eeI/jSzYX6y3Zrt7oc+5FBbOABihBbz8Yfxww1QHnY6YDyuoSVrjf9Z3kQKxW4sJRviBNJGE+OCWB9oJ3RQ2RecamlX0XkmZyuqDCXU52OAIm8c5qDVd6QJR2so5wvrN0o2OWC8BMKLDWLw/TLO4AS9K4OWoJUlOGE2z3qxUG8moMxzHw2rCzBq1rMJaeho0/CZGiVPQWWzoruRurVCQoLXt6L5+oQSQj4ibpeJkP/Wnq3inT0EzEr41uas8kj7DdEJ+pKKy5tUdJXm5CRQfgFB8QdSbq/VE0alrsZ43iYNCj+CKWwnjPJ4ZGQJkNQKpRaBqrhnaGpuRDbJASSffSksrRxCunv1O2aqzY/gyrRieTU11SpCnQZ4ll/mhW6lhyuvLb741rV6vAHzaRnranhzLBECVIo/dy84tqNZ5OXUdXHBPRMzr+UX+2GdvcfGgzfaAJIeMul5Nl+nQAS/PmQOfejNTBGNQKKbz/i0+Mv/AwJvdpWA2laYjABPubFVM4671LPjVhEcFRsjnfYWs2MY43woTXVrjKZFghH5h4frwFAs/OhsYcPR0bOHMhF8brQgPHCsPWp5NhyhwRq7310krGyca1xdBvj+2oZHOohIvXk6hEHO7MFTOrn9iAeiGOnCn22GQZaK7EE2aKMleMJwfIo2Dyy6X+s007K+3Jjbt4yvUruB7hHkcVYyfHUABJLbkXPNUJ7xLgbcRXIaHJHlZ11prhBp2UDUgw9oSt/1kUHI2ZU46AfglWlGyd4xd4SgGmhs4R++P/O6GviVJXbIDGEA7UA5h6hlMNx3vuKRnjRl4OpSZbWQZh23dK1Kh1E5hV8TqbaPI8Wv7mvGd5QVRWMhwJp5dW004waifhrZNlZm4xEld1GFupK+ForBX0QLkk8juD1GBuYbawO8YTKDg5xlAKQtlVUmEPvVsAiGArYuPWuN34OqazWLvzXM1UFK9sztEPHwXgA+sOitOAOjEBfnFY0tYe6m3xrnHRNqLV2L1YK1F1V6g/+j60YHc3lofw87KpaaVJD7xF+HR9Ly2VskOmu2KTVD+j/ZIJWjGw96Asf0K5mKzBkyFGaFFYNpeHw9A3cGVYCYy7S9bFMVlPhoCJzAY4fyTw9GtpYKrXzL/u6hSOa0FRW5uvfvbCcK0spfT/CqFHkeRhNxleCvAkONZUfdKWdwvySUuRlV8rZfLOHX6IgosepvyH0WVaJpp6GBD1jyricfvp3eLocEY9Ih2eTB3j6IML10qMItdWv377B4Jnch/e3enNruivvptxAvq+rseiN+IHA/m6+xB9ZNmhIphTCfLyn1/pNb4uLfcMCldKqjzaIkAWcO+BhHJWLWvbms40uWsQ5tzdaZRcmvKonPGSKiOfouCOKZvos7uVmyTsXDFZu/2JweYu7DqrrxcJ4+dVzwcPA+FXI7DSV08n2DyOAMY8KjWkCw4pXIrT4BRCXjZaJbU5YE/25P/u9o3wjyv0+MICiGKGnNj869VG58CHjx+cjQegAAxC6XAk7egCXkRGZMJS0vnIlIAU7bDf6fYsTiOZ5BUtnjflFOA+z0apdzDjtA3aMdhzYjNmk2kLMo5w5h8k3k/GJKJFes/FiGJGQInaYizJDU1NewKZbm9kMNZsjUCVJG9aH2gXTngfRBGhgYAZG3ENBHR0wexsbBu8YpSzHduyzvrhvIlYFkdHVL4Pj6kdBeqA6FMWb9pVbIMlqW8tJeo+6TgBWUR9mWzEtGcUVpm9VxHorE9A7ten40ZR1nOpIDv4549LbxsqCrX3+VMUgVl/8eVj0iLCsKvThhuCRWB9gUfNBlHw4bxvteXMLiqhiuHY4X+8y9N9IlJKLtW6Pf2SedvrPNuTbJvPBog5YaKN63au7q6MNQZdAWhkKgcpgSwPwT4bK/uTsvrk0VAChThsMYUvgGY9NnN0qLlgZzQspFAhnBbnM3kCMjV8zgw8sPh3m8jfei+Hxz3CVF2gFGgcgG259hNjORZDqTXRiRZkVc/TtFXJKsPCuOK1ieGc4m+yqPUMp58tjL09tfAO3jmS4FY/FW4YohLPgtlvs+IFsJ+gh2VHGNNDuHUMwjRsBG/Mg9Ayz37jEphtRbE5Z09BN2b9v9aqzVrmMPW5N1DcaF5+aO8qqumUg3GC1dP7meybanfSF0qGtPH9VE8upqFqUWmaNDlPgPZ6KNwEDJyiAdRtnb2CA9B9ejM1A3BizjzcXMK/nTOs2+b79lmpXs0ziesNvDHuB3hyW8JePmmgBQF0GWx1lPNErBLYCeGKINSpUXn87OE7egKNlhjIEm//GqmPFA565uVkyhFgx/k0yw1FKLFP9M2ToJGScwV/wfIRXtcPioZ92uvrchKK2b756SDNIIR624jeHZioYmXvQMeG+S4vRPFz/QXKKdQ2OVaLhhWz3nocv9FivKb4rGRLm9FxcuGsY6DsiAjyYKkXIfcT/qXgMOnyj1BHBReFcrDHWb8CwMNSJ/tOewmToyIbe/lwbDUB5fOKO11tiXmLvaoSIJDU6k3Ls5z+A3IY/7wQbfwQb7Dnd+4w414ajfdJDJ7SqlBpTCjlrhJzmUXsqd14mlgmcmPBu4I9x8/kiYaIzHXUh3vS9URX2+3ifoXJm+KaiPTiGPJQIhoEH1kDFGm3PTxeFizgqlmQd3nPSDSUDaeE1fg3H2fn4/QxCJYTK2MZhTl52aswDwa8UWiv1zfCmtVLW2/MasVyjcPxu1PfCdGF59VKUQHQg1QJKSCYZ2tZmd+JiRLVSyXoUtyqJ5V4u4lSzhaUv+8ApaHRCVOEh5HwPtaDYVLrdcigxKmiMiqCAGdYEpPD6pn1N+KKCSQx/nhUTRBQ+4CEIEJBz7Yv+LLgkWD0T8tZb9pTAjt8MLNzeglomsAPX/LRkxgXbLUIvlcTH0jvDMPmvLCshzDvtckIzOj4bFdxVEdLo0JA8URFp3oP5pTqZGJXR4fx4Kgl/cXJwyX43VttNDPyc96KIBF33oy8c+z17OyQplcoFzFBpvaqA0cvmcl2BBtI1On4jYsx0VSbqKyOU4JawLcLcAOOTjYyYAC2iGxnn8gSoZF1DK83G/GRF1y23XDeoWSl9WMVgOiK35od3ZRjeaH/5Rq0Nq54bbJE4sN4DyjFJXkDbP10Rj3/BZp88AlFMCZk+9O2bUCbTzyqP9YO9QrgsnWxnms92BRXu/KBL+G9Ya3MH8DOMjXuFkuhN47PeZpMohW9ECVx1jHuC4eIpihh0oZKVBd2mULx48pYIHf8Fp2Ab4fafqUD7Tka4pN9apcZo/u04z5DW9q2S3T+c4G+r4O0y0R1GLDcTvTzVRxyzm2D1t87C9tZ1X3uPkQlechr86l5I4ylNghutX5wPlFSwjxKMy+ZUd09cKKDeG1GMvf5dXmhY4dvxxynFue1Ykq+ymLETogIdn7MZigUs0hjd2QgaQ5H/uarpjb8apovRPqyXUgfGQ06JjZcSCVLTuBeGahi1mI/WR2eM399idK5arUYhmjBIINVu2Wm47tgKiwYYJYdoV3MwbbNudMZDr4MP8HK+TTHmf03CXQId9htKOgJDosnNMiB+QcGGPaV2W5hv4bQ/QwGeFE7ZR+4h4NnrezE1OGfiqLYnCGZcmUl5G8WjMj5DW0nyQ5gHJwS1kitwxYzFwwKPYUv7Y5Sq182HdQ7Ox8wP74XAjlW+1ha5+tcJymNe8H9viPU/Z1QipmuZTgpNop/tLH6gc0qNkTlT2qpM0EY81lqQAB4j3IB9AFk91x+gOBszTXp/w+T1ZgfJ9+btxQnK03EqAPaI6G1n1ifpRg=,iv:O08z9Dz3ywRjsFu3Uu22+87/ZoElw0hmvsYPKYaBFuY=,tag:ph4Zi+Br9cdGIlldKw4TGg==,type:str]
+  config.json: ENC[AES256_GCM,data:/fAmvOe5kzboNsk/qhDrQ+wutaK1YE2W44MspKTwtOCVQLggGInfTCzlvTCgJibpeSXh7T8KF1IbIzG/pvIAB5zbXL/GxycU35iwhEC4llayb5aNovGmI5WdyhoRh7ldX0aSD6msKtvU1L5G9eTV0IZ9e2Td1/6CRnFr1a6DruFzPyIv+RLWaFUmTZzWbnFHM3zOvNFQ6Hr9L/niLIKvdhiTRzaqglfFgbNJzNfFQCKph3Y9P8K8YFtKST0G++xjI0GePhJdquQ4iwilq6Z9Khed9F+DpH/5k+wCBnPdt/Oto5mKc3d+XFMNznx3taKsVfR43hVdc6Z4qdu0YnHdHH5y++eI7MD0dVJPSl0QdkSN8yIcxj0VIoSFejhlwjQeZ47ySIDtNenkL75VCeZhPbahfwPIiIUDaLe2Gn6KFMDa7Q6VDi0atr3Lh6h2BYDrzf1wVEQhZFSChdS89T5okm7vUTMPIjFc43ag0uPjN3qLdHBRniMHzOIUnue/5h6ok9IkTD7veGpYkbPvQFWYJsl2sEDJ+lTlTc5t6QRFoL01J23YkzoIz9nRwe3h8SX+0VYsXXsS27OHlfY6laP++GPvdpTmAhTsmvDIyjMSUv1WpzETnaxm8Ym2MB/9rJloIpGhgsdLN2MxOrAaYMMJZeiQJZxnEWiKTl9moB0BtHM7Bs7/NeSU84yO9QZRvGoGWi0A0Hh9VbdPkpgMQbyL6wpCrQQ5msPTXef3K9MetiMLXbORrFyVE9BuxrGXVzF0d7DQOUiYzqSltW5Bf1eZ9uDrcHI1y3Hmn8Uh2Ga+ua2K5qT+XLjyybDwd4IlAUtaTnxcFBXALwuSrb6JYJZqeHZ7oxEfTMHDYcWviJA6xII1TzGRN8uJVKp14yTAcR3yVa/UcSOXdI7kBimS5oZPzUeE7KJeFZwcJiJdmsWEq3MExeJQ2o6ffdVdrR2AVH/VhYNJNG/Mrq3Vc+9WVQNQxapR6vapNx7FjQlFeDP5+YLzAzwCjgQcAi2i2gDqCIypfKJLFAJQidTEy10AG6Jx6hvUiQJfupazBvt2n/Snuyh/BQmdoIWYWlFhTspXMXrYAl9wV6a7H4QPa7Ijza+hZSpOa+vclfHXrBEIBo/KPt+k1Ly9sZZR1DFnVsR4BSxdTAvnLgJlr/qrgIw8j30Tczj5QOAjUNF3UeOVycODGoPlW+8jm96IaL+Ez3tTxDSFPR45BywVK06MRqKF4lL+h2nNOebTQDkQqVBglXOuXZrKA2UdKRFA/GaoGUjAaOGvG1ARpmU4oujECEaTkiCa1naCMs9Jx2PvKdHwPR97QE7nXrsgv7YhnYGKKfrgZRBz0v7259ZtZ9zShr0tOI8psVA6GRgg5Ly9Wz7j761get+VFCK6toOW3VQ1wBfEr++CfhvFfoWPQszfvjAqESvXcW16ScliWm4FoNm2XqtQi/q/R84sXSDNZq0dpauZEL70kuOGU4xSFNZQQSQ9AGDjv1wJYZuGp9T6M/GWUlplQaEj72DwZxDK7l5EWGa2FI/NZzUi/KxGI6c1YSR4bZQ02uOgDRHd679NnXUwsGyZ+kbwhvgOEQLIYzCJhtjvz7/l8weHkVn0MDm0Jnn4nk09FH4xkULr3kH/+eknSTVI1HB72GlOSnAR1v4dJfxzNRmRCmfqlPNS2PYWBjhRf5HbqdCAHhb2BYkijDS2JQlCW+0Yxdlem+7ScLCapidg5B5riP59NqVa+ZNoB34bw6rFCj4Pg165BMPezG8j1OYe8I133/zAuaQg4HwSY0O1M5O7xU3W2SftbBh0T0C23e/7aARvx+FFWXD0WtK1IaSmeXiJo/SclgQa+KkVd5JRB3GYvDwsP7Eens9lX63F73mub56v6hCZ0p2+rm7DVn2U/zUHTKmoy0YMkAU4Sg2aR1Gy9ZenX9Qkja3Tvw539GtvI9XYbHFgajuDnvmDOcq2+QKVHJtHk3rQ/h8ShB6KgzmIiQp7FW3otvwWN2WS7yXYNwJtQy2hf5fbQwnd/fO54vS/xQ0XiEJeOrjpVImAbJJDoy1YlP/tzVZj2SOHkuKw12m0Zvk78Oj0fPwx0SwRLe2GFkmBS+WJhPNp2y6lWJpVPxBt5DRhZGuwsJQxx/5vhVZpJQGGt7ojo31++IZYtG7GkcnyMPJvBJSgAZ7LpAsqIZHwWFpL+1kjcHcmQ0O0goNL0JFNfWYUEH1z8SF1cFjFv57XnyWcNwepgia5o0JZSOwtDlbrfsYhrc9rvqk36xxXSnpiqUYHUNskOF2lUcPPJZZmLTJE4pXt0AA7itP69OtLo47qeP+5F3rN51X804LSzE5h5tUMG0+t4u0fR/+MiJhwj+C4iDJ0kYb7lkyIYFLrkJ7TB5eIPfECbwCIdpHI5ylBD/ZYVetJnCtd1pTNFuP8BBxS2yjq2/AzuGDYYG7Cn+AB9ISmVI285t+8wGmweArXNXmzkeiwFE915WnpsDHPYp8wEYfASWx2oDx+CbMQzAEM6vmaxM92BizZDb5cjRqSpZN3uzjG8SaCI6L6UOJaCu19YGRWNp3O3vetsV7YVaSFPjPaAMS2p9UWzJETPBXY+GA9LI94rwfhreRTCEAK0abxbUyqc9NRLcdGmM7i5gwD+zBu9hjPqDJWxwNnUP/Dt2qXcPK1qXvAdJRDSAm4724CtyuuDshukL/F/x+oB1PNNnqzUrszTSjuzx834x9DzRG+KBB94RRuePsWksEPr5i5LhImb8BLz7AD7GCl/OsgCWF4VrwlS4cPvvChnaWV6CyGMjwUXHu0xt0tNBjQYPVF8gB7sjDo1AwP3tvcP9bqIu1KpzXPlrs53NpOgoRdETSW+P3Eh3pu5/WfT1Q6iRvhDmcSKRmtdUB+cd8yodTbTSKl2Dd1CQ5qEVR8+GvlqdTo+f2vtB3LDx1Kn544KNSwS9GF60PJmsSDHJf1BEkewQIt/LWeJrerXY3N/QgNR4+hz4BkVumh6zRjQTjetuFWznZKZQG6gHaatQGPeffL9n8xfORruhQUPeSrnbyOr9+91LJ1K0pnfIMRByUM/VK04/zekenh88x/Aj1DfQ/ELQ1tOfZJgCUBy3ox5jttYqNsyU2NRhKx+KYd0U1PJVLf0PBPfjFTqCBjG5bL/zJnAxx4eUgC1nTlswuRqlnkhHHjUcSumPcFjgbwspd43mC3HkX40XcGtzw4iPC1bv3JwQyfXb7cOPHRXFw2YnXiBWtOMXtF/piMILb+EE4gxWVWxFKHxwQhhnOrzXnS1sQMbbBb5/0U0K0UGnZygKAfptkFHzgPg24lxQGl54x0EtvNCJFhumq/wbauhX5TczitO8okgiJaH6hWuSASzHVqVPc3M5DNDZ4iBkOOOn1UPVpd0UnN28sjVv7ogPwcjNGJ6mK9BYCyNP+64HlpyYFbtCCF4A6u/PCI8ZBPhcgnnLxvGEW9m73fFI+xUWxzVvsVKZX/JHuOGu8RwN25/WaRr6wnN9sLkbUpkoQFisGrT8w78EZIVVmo5DgawJR/XDi0FjUkf2Gmmmvl5JuGq+HDpnswF8uPNMoXWJlACmn4LKV2Zl/aaYxa6vBfjAGFADtpP9JJS62iJyZ/+uBhYpw0x/NfDLnqbcGWKAwYP5vmrPlbTRB8irIUErcVW2bm8geEstj0W4UnYsAW1LX1vn9fajDW8yHPyI+3ejvAL39mAQ7csSqfI5uTEJGWDSJ3r9BYKydE/lvfKH+Pqfd/QEVD8Y5wSnfG3P0GlYYd2nEgAaM07ziPZ3BrA/+sAYF3o6+m+JXVKDW0vNqHymS1E6gdsur03vPFnIrolMwlOFq7DUdBf138r+fcBL9kqQVKpcLsRsFsduKeqC/pZwB79hKXp5kaR/S12jCTD9gGNhxS+xiRafpBF9kYoy6P2R6sHk4c+3k8iBEJr1iPsPvfPWMOrLJuP972tpmvYgi3llEJZp9usblT3Dr8CiTh1/DmHn7qAg==,iv:Ly38JP1MKsdms6UotTYCUCHDzTpc0LHNcU1rz4opPc0=,tag:9o6NALA1c/gAbnLcWlysAg==,type:str]
 secretFiles:
-    htpasswd: ENC[AES256_GCM,data:qdx8p+CfYhStN+gKUI5Zt5KD5R0AfZQUiERw+SVXgp7+zxYbcj/ZcdKgxLi06U2HJs1QTNdoTx5eDW5QY0CNUMxKdoGM7JSZwr0dckRAT3xGKyMUbzz4CTdi5UOSRX3EtI8F65tCDLWlneFWrWRzGgIOq6gNQV0TqGyzNfQClZ470AanPcpWFg==,iv:vZJF925Zq7xPsV9OLOF5eSMqNwtCc7FNfWNV/AQFdjQ=,tag:P/IezO7b4vYKA82OJUusVw==,type:str]
+  htpasswd: ENC[AES256_GCM,data:ypD56yI24fQKQpnjVwI8gdU5CrVhXiCGADUfNuv4a0pQ1LoRgPAHQRdzo5lnUd3qYt6EMytVzREr8UNMuYMOgVqLagcMWysC2oGYSc4x+DiBxmNgvfFmOEW8o/CF4qou7ev2SArKuMyuRX90qzkiMp8o3le6eLwbshL/74GNbjwxeKIgq0cx5Q==,iv:nRs/PJSjiE9VBjhzXuWLSPIX0oyJXyexRAyxI9Ex6AY=,tag:MMoAZP9VUO1k3Uzmo/FQAQ==,type:str]
-authHeader: ENC[AES256_GCM,data:pa9BRXRwPJHQyD0vzQjkgKu8YCbQwFAFgz3swq+Ofl12r5t5JFfKkU35zEKb7wJq,iv:xL2e/6sFxO4/FZRDsBxgzNujsLnIXO4LeEHsscjMIXk=,tag:oeb368hj+PWh9y4pLN2mNg==,type:str]
+authHeader: ENC[AES256_GCM,data:Xgix86b5wpqxLN8q/NecVtJ+cpRyYqdxNpFWTz+/yS49gmAzzVBgA56QqZDUKdkw,iv:5HcLyVlmSV6gG74xfewjEFxnqCQuYoiQslqL9gDxFhQ=,tag:R9y3LwvizL9snTXcBaUZ3Q==,type:str]
 sops:
-    kms: []
+  kms: []
-    gcp_kms: []
+  gcp_kms: []
-    azure_kv: []
+  azure_kv: []
-    hc_vault: []
+  hc_vault: []
-    age:
+  age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
+      enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
+        -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5QkNnYjFxN0xVVUFHOEJB
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRHQ3OWNzYm5uWE51ZExY
-            NnZicWVWOTg1Z1hGSmNjQU43RG9PNTR5Y2lnCmJLOTQvQndxN1dKV3pyZWdKOFpo
+        ZU5tWHVnVlFiQS84TXovNllza25GUTdramxvCkwycHR6RXZUSUtZVjZSclJHWlht
-            V0ZZbjRhK0tIaXVERnBFSFpybUEvNWsKLS0tIEY3d25aTlNCaVpxUCtkdGduN056
+        bXcrOS8wREtla3p0eHBqZFVUdERtU00KLS0tIHNHenRiLzBwQzBOeEpCSWlPVVRi
-            VFRWdXhMYmd6am9aTXNUYXRaWllpYncKxYAq1sg0mAvAjX7mfekZOcR9y9e5gSF1
+        bGRLRkphQnlHeWlPRysxS1JhSmpqd3MKOTrVSZCfw43CTmkUjZ94xHTGRDpdIOCC
-            L74UaXFN/OeQwzqlA0W+EuBeMvj5Xrp7ENconJ0P3ecAFa/t8VujPg==
+        turoYL+HZAeT81pI6cE4V6id7ep5kjJOVbXY3sLJ1nBNrYw5dscxpQ==
-            -----END AGE ENCRYPTED FILE-----
+        -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-12T16:13:40Z"
+  lastmodified: "2024-10-14T08:08:22Z"
-    mac: ENC[AES256_GCM,data:N6uiTszn+I+L2HmWDLG9/h1sttQQltvfM/7Lq3tdRei6fn6Erog6u8IKbr0guRe/sJdt0SMB0xE9gB46Ldwyv7U+Ut5gMSxrxz7FEZSBeH5ZKegGvmkPIqafwL8frZqwlR/3Kmbegs9yAM9VEZ/qcprx2M4gpffiKTATxbm0rI4=,iv:8OMSYrUxcOeuVnbOXoPgs42QPTXLOICnLvXuSbQBz6k=,tag:QPqwsHn1ktM9O2rsohMIIA==,type:str]
+  mac: ENC[AES256_GCM,data:UmIKltGrKM5geOIDHAykozPUKeW5fm0rIAb4TO8DZlhx2HA9esT+pWPQRKp8IiS1HogcXdoKT8wJisCZtlJ8xLDyl8dJZitsJ+DQI85QqsxaGzMhK1VnLwIja27MnzapNXplBdZ7wFRON09poY9lfN00QIE8UPqEpHy4aT+OLCE=,iv:m7ao4dl1qfj/FPIBrSaLeWbrJO4t7ssm6ssoYuFzm3g=,tag:cGMrLk99Ac3hFYn6VDytdw==,type:str]
-    pgp: []
+  pgp: []
-    unencrypted_suffix: _unencrypted
+  unencrypted_suffix: _unencrypted
-    version: 3.9.4
+  version: 3.9.1

values/badhouseplants/values.external-dns.yaml

@@ -1,15 +1,4 @@
 provider:
   name: cloudflare
-domainFilters:
+domainFilter:
   - badhouseplants.net
-excludeDomains:
-  - ru.badhouseplants.net
-policy: sync
-txtOwnerId: badhp
-txtPrefix: badhp-ext-dns-
-logFormat: json
-logLevel: info
-sources:
-  - service
-  - ingress
-  - crd

values/badhouseplants/values.gitea.yaml

@@ -40,15 +40,16 @@ replicaCount: 1
 clusterDomain: cluster.local
 resources:
   limits:
+    cpu: 512m
     memory: 1024Mi
   requests:
     cpu: 512m
-    memory: 1024Mi
+    memory: 256Mi
 persistence:
   enabled: true
   size: 15Gi
   accessModes:
-    - ReadWriteOnce
+    - ReadWriteMany
 # ------------------------------------------
 # -- Main Gitea settings
 # ------------------------------------------

values/badhouseplants/values.loki.yaml

@@ -63,10 +63,6 @@ distributor:
   replicas: 0
 compactor:
   replicas: 0
-gateway:
-  replicas: 1
-  affinity:
-    podAntiAffinity: ~
 indexGateway:
   replicas: 0
 bloomCompactor:

values/badhouseplants/values.memos.yaml

@@ -1,26 +0,0 @@
-shortcuts:
-  hostname: notes.badhouseplants.net
-ext-database:
-  enabled: true
-  name: memos-postgres16
-  instance: postgres16
-  credentials:
-    MEMOS_DRIVER: postgres
-    MEMOS_DSN: "{{ .Protocol }}://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{ .Port }}/{{ .Database }}?sslmode=disable"
-
-workload:
-  containers:
-    memos:
-      envFrom:
-        - main
-        - secretRef:
-            name: memos-postgres16-creds
-ingress:
-  main:
-    annotations:
-      kubernetes.io/ingress.class: traefik
-      kubernetes.io/tls-acme: "true"
-      kubernetes.io/ingress.allow-http: "false"
-      kubernetes.io/ingress.global-static-ip-name: ""
-      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure

values/badhouseplants/values.minio.yaml

@@ -1,3 +1,22 @@
+# ------------------------------------------
+# -- Istio extenstion. Just because I'm
+# --  not using ingress nginx
+# ------------------------------------------
+istio:
+  enabled: true
+  istio:
+    - name: minio-http
+      gateway: istio-system/badhouseplants-net
+      kind: http
+      hostname: minio.badhouseplants.net
+      service: minio-console
+      port: 9001
+    - name: s3-http
+      gateway: istio-system/badhouseplants-net
+      kind: http
+      hostname: s3.badhouseplants.net
+      service: minio
+      port: 9000
 ingress:
   enabled: true
   ingressClassName: ~
@@ -100,10 +119,6 @@ buckets:
     policy: false
     purge: false
     versioning: false
-  - name: stalwart
-    policy: false
-    purge: false
-    versioning: false
 metrics:
   serviceMonitor:
     enabled: false
@@ -182,10 +197,3 @@ policies:
           - 'arn:aws:s3:::states/*'
         actions:
           - 's3:*'
-  - name: stalwart
-    statements:
-      - resources:
-          - 'arn:aws:s3:::stalwart'
-          - 'arn:aws:s3:::stalwart/*'
-        actions:
-          - 's3:*'

values/badhouseplants/values.namespaces.yaml

@@ -5,13 +5,8 @@ namespaces:
   - name: databases
   - name: istio-system
   - name: applications
-    labels:
-      istio-injection: disabled
   - name: platform
   - name: games
   - name: team-fortress-2
   - name: pipelines
   - name: public-xray
-    labels:
-      istio-injection: disabled
-  - name: org-badhouseplants

values/badhouseplants/values.server-xray-public-edge.yaml

@@ -9,13 +9,6 @@ certificate:
       dnsNames:
         - xray-public-edge.badhouseplants.net
         - 195.201.249.91
-workload:
-  replicas: 1
-  containers:
-    server-xray:
-      ports:
-        shadowsocks-tcp: tcp
-        shadowsocks-udp: udp
 
 traefik:
   enabled: true
@@ -25,17 +18,6 @@ traefik:
       match: HostSNI(`*`)
       entrypoint: xray-edge
       port: 443
-    - name: server-shadowsocks-public-edge-tcp
-      service: server-xray-public-edge-shadowsocks-tcp
-      match: HostSNI(`*`)
-      entrypoint: ssocks-etcp
-      port: 8443
-  udpRoutes:
-    - name: server-shadowsocks-public-edge-udp
-      service: server-xray-public-edge-shadowsocks-udp
-      match: HostSNI(`*`)
-      entrypoint: ssocks-eudp
-      port: 8443
 shortcuts:
   hostname: xray-public-edge.badhouseplants.net
 ingress:
@@ -51,23 +33,8 @@ extraVolumes:
   certs:
     secret:
       secretName: xray-public-edge.badhouseplants.net
-service:
+workload:
-  shadowsocks-tcp:
+  replicas: 1
-    enabled: true
-    type: ClusterIP
-    ports:
-      tcp:
-        port: 8443
-        targetPort: 8443
-        protocol: TCP
-  shadowsocks-udp:
-    enabled: true
-    type: ClusterIP
-    ports:
-      udp:
-        port: 8443
-        targetPort: 8443
-        protocol: UDP
 ext-cilium:
   enabled: true
   ciliumNetworkPolicies:

values/badhouseplants/values.server-xray-public.yaml

@@ -9,7 +9,7 @@ certificate:
       dnsNames:
         - xray-public-dyn.badhouseplants.net
         - xray-public.badhouseplants.net
-        #- 195.201.249.91
+        - 195.201.249.91
 
 traefik:
   enabled: true

values/badhouseplants/values.stalwart.yaml

@@ -0,0 +1,218 @@
+shortcuts:
+  hostname: stalwart.badhouseplants.net
+workload:
+  strategy:
+    type: Recreate
+  initContainers:
+    prepare-config:
+      image:
+        registry: registry.hub.docker.com
+        repository: stalwartlabs/mail-server
+        tag:
+        pullPolicy: Always
+      mounts:
+        files:
+          config:
+            path: /app/config/config.toml
+            subPath: config.toml
+        extraVolumes:
+          etc:
+            path: /app/etc
+      command:
+        - sh
+      args:
+        - -c
+        - cp /app/config/config.toml /app/etc/config.toml
+  containers:
+    stalwart:
+      args:
+        - --config
+        - /app/etc/config.toml
+      mounts:
+        storage:
+          data:
+            path: /app/data
+        extraVolumes:
+          certs:
+            path: /app/certs
+          logs:
+            path: /app/logs
+          etc:
+            path: /app/etc
+      envFrom:
+        - secrets
+storage:
+  data:
+    enabled: true
+    storageClassName: openebs-hostpath
+    size: 1Gi
+    accessModes:
+      - ReadWriteMany
+extraVolumes:
+  certs:
+    secret:
+      secretName: stalwart.badhouseplants.net
+  etc:
+    emptyDir: {}
+  logs:
+    emptyDir: {}
+ingress:
+  main:
+    annotations:
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.class: traefik
+      kubernetes.io/ingress.global-static-ip-name: ""
+      kubernetes.io/tls-acme: "true"
+      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+traefik:
+  enabled: true
+  tcpRoutes:
+    - name: stalwart-smtp
+      service: stalwart-smtp
+      match: HostSNI(`*`)
+      entrypoint: smtp
+      port: 25
+      proxyProtocolVersion: 2
+    - name: stalwart-smpt-startls
+      match: HostSNI(`*`)
+      service: stalwart-submission
+      entrypoint: smtp-startls
+      port: 587
+      proxyProtocolVersion: 2
+    - name: stalwart-imap
+      match: HostSNI(`*`)
+      service: stalwart-imap
+      entrypoint: imap
+      port: 143
+      proxyProtocolVersion: 2
+    - name: stalwart-imaps
+      match: HostSNI(`*`)
+      service: stalwart-imaptls
+      entrypoint: imaps
+      port: 993
+      proxyProtocolVersion: 2
+    - name: stalwart-pop3
+      match: HostSNI(`*`)
+      service: stalwart-pop3
+      entrypoint: pop3
+      proxyProtocolVersion: 2
+      port: 110
+    - name: stalwart-pop3s
+      match: HostSNI(`*`)
+      service: stalwart-pop3s
+      entrypoint: pop3s
+      port: 995
+      proxyProtocolVersion: 2
+files:
+  config:
+    enabled: true
+    sensitive: false
+    remove: []
+    entries:
+      # Ref: https://github.com/stalwartlabs/mail-server/blob/main/resources/config/config.toml
+      config.toml:
+        data: |
+          [lookup.default]
+          hostname = "stalwart.badhouseplants.net"
+
+          [server.listener."smtp"]
+          bind = ["[::]:25"]
+          protocol = "smtp"
+          proxy.override = true
+          proxy.trusted-networks.0 = "192.168.0.0/16"
+
+          [server.listener."submission"]
+          bind = ["[::]:587"]
+          protocol = "smtp"
+          proxy.override = true
+          proxy.trusted-networks.0 = "192.168.0.0/16"
+
+          [server.listener."submissions"]
+          bind = ["[::]:465"]
+          protocol = "smtp"
+          tls.implicit = true
+          proxy.override = true
+          proxy.trusted-networks.0 = "192.168.0.0/16"
+
+          [server.listener."imap"]
+          bind = ["[::]:143"]
+          protocol = "imap"
+          proxy.override = true
+          proxy.trusted-networks.0 = "192.168.0.0/16"
+
+          [server.listener."imaptls"]
+          bind = ["[::]:993"]
+          protocol = "imap"
+          tls.implicit = true
+          proxy.override = true
+          proxy.trusted-networks.0 = "192.168.0.0/16"
+
+          [server.listener.pop3]
+          bind = "[::]:110"
+          protocol = "pop3"
+          proxy.override = true
+          proxy.trusted-networks.0 = "192.168.0.0/16"
+
+          [server.listener.pop3s]
+          bind = "[::]:995"
+          protocol = "pop3"
+          tls.implicit = true
+          proxy.override = true
+          proxy.trusted-networks.0 = "192.168.0.0/16"
+
+          [server.listener."sieve"]
+          bind = ["[::]:4190"]
+          protocol = "managesieve"
+          proxy.override = true
+          proxy.trusted-networks.0 = "192.168.0.0/16"
+
+          [server.listener."https"]
+          protocol = "https"
+          bind = ["[::]:443"]
+          tls.implicit = false
+
+          [server.listener."http"]
+          bind = "[::]:8080"
+          protocol = "http"
+          hsts = true
+
+          [storage]
+          data = "rocksdb"
+          fts = "rocksdb"
+          blob = "rocksdb"
+          lookup = "rocksdb"
+          directory = "internal"
+
+          [store."rocksdb"]
+          type = "rocksdb"
+          path = "/app/data"
+          compression = "lz4"
+
+          [directory."internal"]
+          type = "internal"
+          store = "rocksdb"
+
+          [tracer."stdout"]
+          type = "stdout"
+          level = "info"
+          ansi = false
+          enable = true
+
+          [authentication.fallback-admin]
+          user = "overlord"
+          secret = "%{env:SW_ADMIN_SECRET}%"
+
+          [tracer.console]
+          type = "console"
+          level = "info"
+          ansi = true
+          enable = true
+
+          [certificate."default"]
+          cert = "%{file:/app/certs/tls.crt}%"
+          private-key = "%{file:/app/certs/tls.key}%"
+env:
+  secrets:
+    enabled: true
+    sensitive: true

values/badhouseplants/values.tandoor-recipes.yaml

@@ -14,24 +14,15 @@ workload:
   containers:
     tandoor:
       securityContext:
-        runAsUser: 1001
+        runAsUser: 1000
-        runAsGroup: 1001
+        runAsGroup: 3000
-        fsGroup: 1001
+        fsGroup: 3000
+        supplementalGroups: [3000]
       envFrom:
         - main
         - secrets
         - secretRef:
             name: tandoor-postgres16-creds
-          extraVolumes:
-            common:
-              path: /opt/recipes
-      livenessProbe:
-        httpGet:
-          path: /
-          port: 8080
-        initialDelaySeconds: 10
-        failureThreshold: 30
-        periodSeconds: 10
 ingress:
   main:
     class: traefik
@@ -42,9 +33,7 @@ ingress:
       kubernetes.io/ingress.allow-http: "false"
       kubernetes.io/ingress.global-static-ip-name: ""
       cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-extraVolumes:
+
-  common:
-    emptyDir: {}
 env:
   main:
     enabled: true

values/badhouseplants/values.team-fortress-2.yaml

@@ -17,7 +17,7 @@ traefik:
   enabled: true
   tcpRoutes:
     - name: team-fortress-2
-      service: team-fortress-2-tf2-rcon
+      service: team-fortress-2-rcon
       match: HostSNI(`*`)
       entrypoint: tf2-rcon
       port: 27015
@@ -25,7 +25,7 @@ traefik:
     - name: team-fortress-2
       service: team-fortress-2-tf2
       match: HostSNI(`*`)
-      entrypoint: tf2-main
+      entrypoint: tf2
       port: 27015
 
 storage:

values/badhouseplants/values.traefik.yaml

@@ -16,6 +16,7 @@ ports:
     proxyProtocol:
       trustedIPs:
         - "192.168.0.0/16"
+      insecure: true
   ssh:
     port: 22
     expose:
@@ -46,9 +47,9 @@ ports:
     exposedPort: 25
     expose:
       default: true
-      proxyProtocol:
+    proxyProtocol:
-        trustedIPs:
+      trustedIPs:
-          - "192.168.0.0/16"
+        - "192.168.0.0/16"
   smtps:
     port: 465
     protocol: TCP
@@ -100,38 +101,27 @@ ports:
     proxyProtocol:
       trustedIPs:
         - "192.168.0.0/16"
-
   minecraft:
     port: 25565
     protocol: TCP
     exposedPort: 25565
     expose:
       default: true
-
+  shadowsocks:
-  game-udp:
+    port: 8388
+    protocol: TCP
+    exposedPort: 8388
+    expose:
+      default: true
+  tf2:
     port: 37015
     protocol: UDP
     exposedPort: 37015
     expose:
       default: true
-
+  tf2-rcon:
-      #  tf2-rcon:
+    port: 37015
-      #    port: 37015
+    protocol: TCP
-      #    protocol: TCP
+    exposedPort: 37015
-      #    exposedPort: 37015
+    expose:
-      #    expose:
+      default: true
-      #      default: true
-
-      #  ssocks-etcp:
-      #    port: 8444
-      #    protocol: TCP
-      #    exposedPort: 8443
-      #    expose:
-      #      default: true
-      #
-      #  ssocks-eudp:
-      #    port: 8445
-      #    protocol: UDP
-      #    exposedPort: 8443
-      #    expose:
-      #      default: true

values/badhouseplants/values.uptime-kuma.yaml

@@ -1,20 +0,0 @@
-ingress:
-  enabled: true
-  annotations:
-    kubernetes.io/ingress.class: traefik
-    kubernetes.io/tls-acme: "true"
-    kubernetes.io/ingress.allow-http: "false"
-    kubernetes.io/ingress.global-static-ip-name: ""
-    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-    external-dns.alpha.kubernetes.io/ingress-hostname-source: defined-hosts-only
-  hosts:
-    - host: uptime.badhouseplants.net
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-
-  tls:
-    - secretName: uptime.badhouseplants.net
-      hosts:
-        - uptime.badhouseplants.net

values/badhouseplants/values.velero.yaml

@@ -7,13 +7,6 @@ initContainers:
         name: plugins
 configuration:
   logLevel: error
-  repositoryMaintenanceJob:
-    requests:
-      cpu: 250m
-      memory: 256Mi
-    limits:
-      memory: 256Mi
-    latestJobsCount: 2
   backupStorageLocation:
     - name: hetzner
       provider: aws
@@ -40,8 +33,8 @@ configuration:
       config:
         region: us-east1
         s3ForcePathStyle: true
-        s3Url: https://s3.ru.badhouseplants.net
+        s3Url: https://s3e.badhouseplants.net
-        publicUrl: https://s3.ru.badhouseplants.net
+        publicUrl: https://s3e.badhouseplants.net
   volumeSnapshotLocation:
     - name: hetzner
       provider: aws
@@ -72,7 +65,6 @@ schedules:
         - applications
         - games
         - databases
-        - org-badhouseplants
   weekly:
     disabled: false
     labels:
@@ -92,7 +84,6 @@ schedules:
         - applications
         - games
         - databases
-        - org-badhouseplants
   monthly:
     disabled: false
     labels:
@@ -112,7 +103,6 @@ schedules:
         - applications
         - games
         - databases
-        - org-badhouseplants
   regular:
     disabled: false
     labels:
@@ -132,7 +122,6 @@ schedules:
         - applications
         - games
         - databases
-        - org-badhouseplants
   offsite-weekly:
     disabled: false
     labels:
@@ -149,27 +138,6 @@ schedules:
         - applications
         - games
         - databases
-        - org-badhouseplants
-      storageLocation: etersoft
-      volumeSnapshotLocations:
-        - etersoft
-  offsite-daily:
-    disabled: false
-    labels:
-      backups: regular
-      storage: etersoft
-    schedule: "0 3 * * *"
-    useOwnerReferencesInBackup: true
-    paused: false
-    template:
-      defaultVolumesToFsBackup: true
-      ttl: "240h"
-      includedNamespaces:
-        - platform
-        - applications
-        - games
-        - databases
-        - org-badhouseplants
       storageLocation: etersoft
       volumeSnapshotLocations:
         - etersoft

values/common/values.coredns.yaml

@@ -1,12 +1,6 @@
 service:
   clusterIP: 10.43.0.10
-replicaCount: 2
+
-resources:
-  limits:
-    cpu: 100m
-    memory: 256Mi
-  requests:
-    memory: 128Mi
 servers:
   - zones:
       - zone: .

values/common/values.traefik.yaml

@@ -3,7 +3,7 @@ globalArguments:
   - "--providers.kubernetesingress.ingressendpoint.publishedservice=kube-system/traefik"
 ports:
   web:
-    redirections:
+    redirectTo:
       port: websecure
 deployment:
   replicas: 2

values/etersoft/secrets.external-dns.yaml

@@ -1,23 +1,23 @@
 env:
-    - name: ENC[AES256_GCM,data:I+XVWWOUmm7Cd4mQ,iv:rfUzb5HMPVyNfzkCP2frVDxD+v4lTPzILRifcS3uG6s=,tag:1sXONdAjMZ85S8abMVZM1A==,type:str]
+  - name: ENC[AES256_GCM,data:RLLp8toAkoWLWRjp,iv:UUP3i5QkNBw/pgYmxHtRUDx0E6i42e/Ioh1z6WnLESk=,tag:+PEinrzkisEQx5gVCpdJ3g==,type:str]
-      value: ENC[AES256_GCM,data:h8sYBvFfm7uFoklqXE7QLNkikl1ihHz/KN4uYiZlRJBZkiUBbTk/Vg==,iv:/y6RdHVWwwBym5HiBaxEatTWG7I/gNY9ZIaQc4bk9h0=,tag:PytkOjvY3fy6XeLNmGPrXA==,type:str]
+    value: ENC[AES256_GCM,data:RKiCvUOctYha7fusMWNrOKHPgmMMjuejDCip470QMHQcxY1S+yJfXA==,iv:ESfZNZimJkD5T4tzRPMu53H+ushbhOuXaOdX73MaWV0=,tag:F516VFRCw6k589vClX8Jfw==,type:str]
 sops:
-    kms: []
+  kms: []
-    gcp_kms: []
+  gcp_kms: []
-    azure_kv: []
+  azure_kv: []
-    hc_vault: []
+  hc_vault: []
-    age:
+  age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
+      enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
+        -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBra0RUWVFDUXN0ejAxemE2
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3eE5LTURCa1pyRjBocVpP
-            VFlRcEtLNDJUblA3ZmoyMExPWWpjZzlVYjJzCnZVZDNSbnpjcFRUQ0hOMWxLNUZi
+        ZGxXMUZkUC9XK0xNb2duRnJiOHNzNGp0YXdrCkNvNWMvYWkyTHhQU1ZZeng2bmlz
-            RTg5Z2JVZzVoVFVYSVErcWdnbHVvVVkKLS0tIHdZMjVsc3lHRzlJODRWSEh0Wm8w
+        bGRrd3p2dmx6MjBuc0lYakhMNERMOVUKLS0tIGpsRHcxdUFtTHlXVGZLTEZ0c0ov
-            M09rOXZ3OHZVUUVlWWIwaTN0Z2RqRmcKe1ny6FJIFwR6Un0HBFZK2KXkzUQA63rU
+        b0RMSlFCM250MXJHbWhRTWtGbkxHc0kKpyzba8yp0xN1KjcUACcmlznH9vQtYAsL
-            JR7mpEzr2h2oXxOmyc7HeFFi2R66zendFzfhNcvSlm2L5td2Pnxyxg==
+        3bm7Cw2AZO7nkdCxky/ITd8N3rbqAVGeM2CeTAxpcMbEXKq66/yqDA==
-            -----END AGE ENCRYPTED FILE-----
+        -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-16T14:21:42Z"
+  lastmodified: "2024-10-15T15:21:16Z"
-    mac: ENC[AES256_GCM,data:SNHNvmPCt/6Xwd6xoCh5uHF1erhWpTfzEQ/krTvYtByvT7XvDtXjtslJqAa8RkNPl2QV34epWcj/Ff6xud9tvLdAR4Gj4MPJD8WBLUUFul4rvoXfaHyHhSanYmiOhdF0mArE81qsBY918LFS5fdWMrxCNDrHbDtW76KBoLcDUto=,iv:8/ZxjrER1151RGjSdICVjj8ptyQn60SInakqABXWQZE=,tag:/bQsE3TCXoMbXoAF1UErOw==,type:str]
+  mac: ENC[AES256_GCM,data:aIXlmeiqaFu9Jn0zI1qyU3iAkhLKgqMwwLcLDlr+LeYX/88cZtzgP683jW3MYC/LxnNh4LG7v8EK/HViNnCkrvZ5iC9cibRPQYZJrkR3B3oGk4L+RxPws2VUa72pJsG0bQ8M2DDCoDO2T9OuuflqYENPLyYLL7D7CaeSj9w8G0A=,iv:EDaGmWFUnzp0vkIeR1J8iZ9+PjOMuRi4YltoqJAN0P0=,tag:DsSd6Nplvy0nIWaCJgnhgg==,type:str]
-    pgp: []
+  pgp: []
-    unencrypted_suffix: _unencrypted
+  unencrypted_suffix: _unencrypted
-    version: 3.9.4
+  version: 3.9.1

values/etersoft/secrets.minio-self.yaml

@@ -1,38 +0,0 @@
-rootPassword: ENC[AES256_GCM,data:4rs7judCzIEqSRfGi8HLmzVftOinmHRAGA==,iv:t6bRBgKOQ+kGn9v0tixllqyeyEWuQTzBMLq36rixY8o=,tag:SZuW/gvFFI+nn/vtKSmc0w==,type:str]
-users:
-    - accessKey: ENC[AES256_GCM,data:wJ+sB2Jlt84=,iv:lrhvu5BfIRl6kmmVp/SzDHkS7KlZ/bB8Al5hKUOzmNY=,tag:XuC2cM6Twl/KaOPbEphgWw==,type:str]
-      secretKey: ENC[AES256_GCM,data:n5SSGB1AhxZm2uOrdW5kVLbUid8sACwyQw==,iv:hrMcDAWiXz14Q6Wf+bnxxJxFLL1QJBEr0JjWqTPBLN0=,tag:vekhUJFpIv4QmXFTuupOOA==,type:str]
-      policy: ENC[AES256_GCM,data:javfx3iMs44=,iv:naNJLTEs62JDgUgKWSRcCclsslJZkiazyJ0iyhTO3cM=,tag:7yOHyC0BfV/41zWDd0m4sg==,type:str]
-    - accessKey: ENC[AES256_GCM,data:oRP+H3vA,iv:N6XQ34NYrCfFci5dw6nQroc/tqByz4ilnQCDh4ZKL5A=,tag:2UFZDLdjBUN0HqRLXh87lw==,type:str]
-      secretKey: ENC[AES256_GCM,data:LPzli0O0ePL2vghWNsf07P41G3+aXUdBUQ==,iv:vu/TI1jU9/m30DegKxUAaObUq9FyB1IXUB1vqL5kKoI=,tag:1Ar6MNR5pTCzeBlH7yl2hQ==,type:str]
-      policy: ENC[AES256_GCM,data:gj1EGs4L,iv:N9J+yXcG3fLyg7dPlICi7tdTk6OPLpVpC0IFprfbGaM=,tag:65lRXTg0R76y23QXNLD5pA==,type:str]
-oidc:
-    enabled: ENC[AES256_GCM,data:ar/fBw==,iv:rs1ESCu8noZhU5nKkU6HS+qysYGQfFXo96uliAY+9xw=,tag:MvgSVLelQSlk1Swx47+s6g==,type:bool]
-    configUrl: ENC[AES256_GCM,data:195i1omIYscB5Qo+p+S0LBEI0CAHMaVz8smR7c4l57Yw05R4GfBJR16DswMgoF8FC+UFBlp46/WFYA5f1CZIlaVFipqBTYeEflDGQ59IJWVUo9Apw06Hfw43HrLC7POQL3w=,iv:x9WmZvzI3Gkf+2BMdIVkL/UxK6hIHJPVgOOVyDoPQHk=,tag:euHGWXq5PNLj55XuU3amGQ==,type:str]
-    clientId: ENC[AES256_GCM,data:DGIVa81hjIMmotzffms=,iv:mtuMKY07CKQD7GMyKJkUs3sQdbwnXCm3n78cfyxIvIY=,tag:sRQJXhOY4LPTry6TMtoqcg==,type:str]
-    clientSecret: ENC[AES256_GCM,data:HaRln7Az/+lP/01RFtlTCLSReAQ2OYxRlmQ3LSi9r1tVWZD501RaCif9/68BIOnhGUFGbZPobbRWOfQDULycXHdqK5nms5S0YOFNOwxUCPkttlljZ3fyw157lmFGUrivzMjWpIp5clqoWtIWE71q3UDJ95FoOBjG0HRtFoDo4d4=,iv:73/N0JSCwLd//HHOIjuPkHCY5lKtEuRahx93lG8Bipo=,tag:Tltx2XXeJYGQczCvb7rqBA==,type:str]
-    claimName: ENC[AES256_GCM,data:AnMUWTj8,iv:6tV4XKIT+utrSIbUVGHJVXjPI/i9mJrzki2zC4n+4Dc=,tag:iHnClGYFTHpUry/x/wZuTg==,type:str]
-    redirectUri: ENC[AES256_GCM,data:F30Q9PQvXb+bmkNib2/END1/E/my3kOo8RTvoN+/OJMCz/nDRR6lgoA3LYHXh88=,iv:47dIKSJW/5xQdmASUiPOfHo7193LfAQ/R/F+saAzSWg=,tag:SLREgi2vBl5mvh0J1K3nCw==,type:str]
-    comment: ENC[AES256_GCM,data:t/1OqmIDiudE536CpZUYIgIq9gI=,iv:uwzrEwQUO+eVpCTYYXHjfdnJmKm/mEwre7zTtbwO0Q0=,tag:J/vmOjueOqdUq8Kuq5Ke6Q==,type:str]
-    claimPrefix: ""
-    scopes: ENC[AES256_GCM,data:wqLHN7dmjg4Tly8wOIm/3zZyzx1Mw3NLNqpl,iv:p1iC127avWNcGV8Qj9WLFeAZTrZokF467nAqSwEe43k=,tag:SilNPiK+t2xvgvuTfQwhFQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cWJpMDFLTHZlTlZPMW8r
-            ZFpqM3VnM3dQeThqb1pOdHlVbHkyeVo1ZlFvCmhDV01rZklMME12NVl4YmthWEd4
-            RndOYkgwSkwwaGhMNE1NZVFxaWZnbXcKLS0tIENqa0RwR3B1MEk0cjJhbkIxdW1W
-            bFRMQm9QOFRQaFVpaFpqMmdjRTAvODAKhhEOX3d51JWmAYMZdT2LZpkLkuCOcpEz
-            8sfofHVU+5gCOTZj6fTvIm0wvnVC7lmTaRkZBEKnuPavjTDfXKluGQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-01T18:57:37Z"
-    mac: ENC[AES256_GCM,data:JzgKhfxs3QI6um/3xFlik6B7vgWAcIoswucE0j6h4Z7smHgP+FuuJxXEeqJQaAhSGEQnm7XhJRoJ3HfIaPK87D8cU8g0GeOOQMF2ZZL5gQ3YxWDsI5g9HayoCYqRQHd6uq4x6zGKQ+zodnHBBQnujnDWwOykfyANav6eloW5tnI=,iv:jkxc313m9KCoUjdHfUqpwLzFJe6bmSlM4kGdqEsUbMw=,tag:SDEnSkv8jB/RfUGj4zX+4w==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4

values/etersoft/secrets.minio.yaml

@@ -1,21 +1,21 @@
-rootPassword: ENC[AES256_GCM,data:OjZ/T/pAAotJvTUjkJ1yGooWnz6NfLZR2w==,iv:uG8cnfJJsx8yrAo1PONBPNF4pDC0PQz6LDpb97FRf58=,tag:/1KQ7Zp+UqA7TCloNkI5Xw==,type:str]
+rootPassword: ENC[AES256_GCM,data:btF9/FtQLpalONXSRhY8/HC4gq8vnuaaHw==,iv:K48dhNKPsqwaqvR0z+7sFdlKt56aa85z7NeSvd5KxVk=,tag:Okg6vpyaxpDFuF0sGuGthA==,type:str]
 users:
-    - accessKey: ENC[AES256_GCM,data:xaBSF0dMBQQ=,iv:1q33eR4d4Fw2m2m7d+gdT29/X8HKJAOyNcNO1vlNf+k=,tag:mcMkLEVqP7IgN6DcLjTagw==,type:str]
+    - accessKey: ENC[AES256_GCM,data:VU3XYBaFgnM=,iv:f8ph1DPZWHGQtfqgTby/P/ul7esiOaaUao4pjdxbW6w=,tag:MEpgtL5guJLdvELP+dUljQ==,type:str]
-      secretKey: ENC[AES256_GCM,data:GSjy0MYT5DAAIN86CATL68kqJGy7RApNLw==,iv:mVjOAzqLFB30plV2ZAHGNrphuwHhVY0gga2SH995NUM=,tag:rPxGHyfJIdzA10I1rhwb/Q==,type:str]
+      secretKey: ENC[AES256_GCM,data:rKH1j/NxhMtpPl5ugHftlAim4ZxWK2oCsQ==,iv:Dc3HGHyFzqwwBb2wau0H0Hu1d2cepckdp3O8AEsJ4xo=,tag:MXVe8mP/iAAxHV1yXReb6Q==,type:str]
-      policy: ENC[AES256_GCM,data:SRhftF+GquY=,iv:b3kR9lbrz85Ji/9kcOwAtDJXhoSLa/ujiMAUHWrabRQ=,tag:Pg1YnFxUfFZeeda/Hc2OZw==,type:str]
+      policy: ENC[AES256_GCM,data:MjyZxYF52hw=,iv:xEb55FQfwZGa0ye9kvEqcXRD8lYojprnhiy3yZ+4ldA=,tag:cwo0RUXdS+ECYBHEqPs4tA==,type:str]
-    - accessKey: ENC[AES256_GCM,data:De9lLs2l,iv:KL2afECLR7M5566v9aUzEr+vzOgld3yMJzjbP4wRpcQ=,tag:wXv33DjN+wm0FCa3/fQYfw==,type:str]
+    - accessKey: ENC[AES256_GCM,data:OgGOUoRh,iv:dznjmOZxw2YpCkyjfX61XkpRYk8sRq/vFsm2Vj2NUv4=,tag:3dZTLCRu7tLNfLxuGmuuGw==,type:str]
-      secretKey: ENC[AES256_GCM,data:FZDF6R2m0Z/UX9ywn4jgCsj+NcFh9v0aXA==,iv:Vr3icnAhYDZwyQVVHXnmZavP/8VEbIQs4nTOQNb8uyM=,tag:CowIx47b8T+kf/qhpBuqIg==,type:str]
+      secretKey: ENC[AES256_GCM,data:GlUxSIQMcUNqrj6ucgqnfIzp73DtEN0Ihg==,iv:HpSmvfE0Nml3rlTVtZUnfCNEK9L6yjnwBoxMArZiraQ=,tag:vNJr62ntsRu9muSav0TXug==,type:str]
-      policy: ENC[AES256_GCM,data:87m39jSs,iv:H2Yv8c8S13cm+Pi26UNeeS5f76ewskLsnT3aKyIAAT8=,tag:ixKsbZbZyVk5kS/Jqh35Cg==,type:str]
+      policy: ENC[AES256_GCM,data:aqDFdoy0,iv:nPNxbT0jwpTXDjs0hXgt5clFstAjbgqO6IH+Dnox/+Q=,tag:P/m0PHwZcqaF5QYQrD4oMQ==,type:str]
 oidc:
-    enabled: ENC[AES256_GCM,data:P8GEXQ==,iv:qeB8rYpZny+1NX/fLQi3Uu1rwdHHDC2VZSCl2HbbqYU=,tag:N+zfQUX6onM+YCJRUiFImw==,type:bool]
+    enabled: ENC[AES256_GCM,data:nxzzAQ==,iv:HTVeFQPTr0HUPBi9LDfRo5qVUv8XQsBnYqvFt8cKfuQ=,tag:ARZttgS1YwYW1QjIAtbJUQ==,type:bool]
-    configUrl: ENC[AES256_GCM,data:u0u2AxsupS4rC/C3PWZgNNrTyO12T/De81QHRa7NkiC/bb8hKJVutchNBpVr0zNg+Y9aRPo8cSlbepUVhFx5sZtdkaz98GeI5QmUzsi39LM7S9Mmp6fKP4aJTo4/vhXYF/A=,iv:d/g4Yxnpf4KlrAr1WjBNkKiobKHDYqgh7YwmTwpos60=,tag:CiOLeDM74ZOJav6Pmzzunw==,type:str]
+    configUrl: ENC[AES256_GCM,data:ZgPxRfSLkCtsFTq+MrZqm5ysRkAA8YemJsaxWl6WtRbnLnJZBQqBzx7qy5ZMFP4R4Z0+7JLg243gRS/PCyDWq3NJfmM4PasDe1WxAXWJHrp+lxcN7GOM5VHcsdCi5j6KDBg=,iv:/scg0KqjnngbpqBOPvl/T8wVKTZHcWsaYOi+M9YXsUg=,tag:HdSLxvw6+vGUxgOFUETLDw==,type:str]
-    clientId: ENC[AES256_GCM,data:doeMKUeB2L01bKiOjJw=,iv:Up3TS5W+ksedwN/lZRvSjBQ8QOty/0CCOQGzYZ6R9fE=,tag:vVuoKODoutu+oZPq8klJXw==,type:str]
+    clientId: ENC[AES256_GCM,data:EORYGlAJ6EFzOQCOKMw=,iv:XVhCaWaN65vFMEcSprkWKcciHbhZoCUz5PfWn4NNwo0=,tag:YDen+LDU8H0M8omnlvk0jw==,type:str]
-    clientSecret: ENC[AES256_GCM,data:YTg+KYc6oioRt5prvHTkA4GIhQgS/Oi3rpwpOSX/ImH9DHLxXcJnPDKzmW8DWTmG1YIkpJEfLWT+SAa3xz6jpd4EB0y5f86j8h0Ih00z5CS6HyfvFdwqSvKpK6B6b7LIE1x1wSbS4+0un1x6/zUKeqgkes3WMXfHzZCTnalWmqY=,iv:oas5s8SZauwoZHGPKQ1Kj0inn403ZSIrfUORBCAuPcw=,tag:+cB21h3D0jmDAO+MN5eU6A==,type:str]
+    clientSecret: ENC[AES256_GCM,data:O5mJ+uxo18o04LHjY31eVs2wzJePtEXoJxXn81NBcTs0GApVPciDfUPI4mZVXskBScqT9x9ZdgkTjD44gBMzqwBjmwHEeZfPD996uSKSu2soMELLDO+D1Vp/cNjSHnUx5VKgKWxcdSxQ2WN6kxRxgCDLk9B/Cpc+pRDFiR/w46c=,iv:yjg7NUiDxjXkeQu7gpxqaZ2oGOXCpEnN5OUowlbhSPc=,tag:2o80ngR33KLxVAAehON2EQ==,type:str]
-    claimName: ENC[AES256_GCM,data:GzxNUVk1,iv:SULbiq6jxrILbpVhxxxfUSsCfK2PvQ3cgrwefL4HykM=,tag:9vQ397kbTqP2hRetfCY+OA==,type:str]
+    claimName: ENC[AES256_GCM,data:0uU9ynkc,iv:e+0Bw9bEvr++OU8Gql0m16BRE+FwsiK9vkTjdLQXsGw=,tag:Sm/kP6a+tRHYj2cnvZf3+w==,type:str]
-    redirectUri: ENC[AES256_GCM,data:goPjtLTzVlwNcibzNS7ys9MwvyxC0Zod6oI6Ubnh3EQvPMVbV8jqR9VveHmNiLo=,iv:Bk3Ul5icqIi04knqBvTH7osv8GLqmX5YFe0Y8lE03UM=,tag:W2sSoLEe88/r8WRLIdtl1g==,type:str]
+    redirectUri: ENC[AES256_GCM,data:AMtRfHzCg4pUM2m7enLzMOgV+oVecMarndU99YTjZP1NqTlG6Dmo6beo3/FAQI4=,iv:0SuKeW6SoAuwnGLCWz6yUI7NSxlFz4P+QTA9IP5Dokc=,tag:Vp8pVYr72MfnZYKqD0o9Bg==,type:str]
-    comment: ENC[AES256_GCM,data:03n7KL8FN+RVac2Q6CDrGExDeXE=,iv:CKkwPr8qRkDKcWaSeSqRMeZCbnI67QKN2yQiVDTjTUs=,tag:A7PwDaoCvuHAdmYYDSYsSw==,type:str]
+    comment: ENC[AES256_GCM,data:QTHyj0dXt/N2ZMyv1rQyN1fUjuc=,iv:hxTK/rs1UL1n7v/2CBkHvEFZzlGZLyDv9nBmVVO+X10=,tag:haa6Hfk7pnhmCNZDWPkt9A==,type:str]
     claimPrefix: ""
-    scopes: ENC[AES256_GCM,data:06/xU5KnOnzSNksTrJxP31n+yL/uhm6oM6y+,iv:G84tDpX+qzWRYiQHaQDO9kHzK/15XRBLu2BGPmCeh7Y=,tag:kmdsIpB+BgejOxhuOy2XHQ==,type:str]
+    scopes: ENC[AES256_GCM,data:AENnoV/sNnYY/94ZTF8sbSowJn4rA1KQ4/NL,iv:+Aj93Y0j/irIfd7HsuM4n40BFwZx7zhIi5ccowLaaBY=,tag:PcT6Ywl/nnCp2bKEwsjUBg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -25,14 +25,14 @@ sops:
         - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUkJLbjYrYXAvSDZLeWo3
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSXNKMVQySmJ5U0VMY09L
-            NGdNSDcxSTltd29oWmpiRXZxUE5NSE1jSUNnCjVnK2M5OEtaTjJDdDkwSzlDMHRv
+            YklMNC9HZ3Jqb29Qa3Y0d3JJK3pqNHZEempzCkpkTnV4bHB2OU9rUExDNjFqdmkr
-            b1ZRUDh2UUF5b0xsNjE3V1JpYTJIc3MKLS0tIFVLcXh2c05aNGY1TlNzRy9SVXV2
+            am1LNG1zdFJBb1VLS0xhR0xwOWN1QXMKLS0tIFFZcXpiTUpZbm1sRUxMYVJva0w4
-            ZFM2eDBOZkdiV2p4d2tXYnZXRWJidjgKAL4Y+39jbNZo8cXZ7vmfxbfnrmOluE3A
+            RkhEbVRkLzZnWCtjVDYvNVVaRlpmRlEKQEq0OqdXuW56zNKrA2by3y2JfUnlIAV/
-            XWl5Udebr3cJ14UwP59mYFVL6A/0GaYuRqOwN3omJX4NEMKmzvJf4g==
+            dIjedNebsu3E/lIAZdo+gsjrzGIZSgIxjfKoqlVP6J16aJnka8iROw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-08T19:47:27Z"
+    lastmodified: "2024-12-15T18:54:09Z"
-    mac: ENC[AES256_GCM,data:hq8mAa0SIALlMh7xCAJ17l1IIHTStP5EAkqri9ueGDjLMDPdO2ewRL70SiNpP3CZgBvvqx2y/iwHrl8TKUGG1oiMK+CpKBZZG5JG53S4cDfvjk9koP0ZKek55MsqFVnhFNjoDhJUCKWnKmm+X4YuntmtNfsmkgWKuVGIDWcJ07Q=,iv:27ITELnJRW1M9XR02q2eEGSdUNWYCtBvameZBVo9iFo=,tag:gAOZsUZmSXcrlNLZVphVqA==,type:str]
+    mac: ENC[AES256_GCM,data:CRYlt6HYTH/HhRT46pME5IJ0xU+oHj84AFGvSn6nPLLKAkh6sTzDqG+6/t3MZ42SUtYa77rc2dVQ47RnkIyqCWNy5PBYCS4MVuOD9nuy1YdLhQn9QCExFO2b3BgW8tRKRuEJw2tcpk6W/aoy8qh3NddMAZAAWhMLoLENnLGiMVk=,iv:JthKqEKMTsZObMQFQYBn1KFTJUmASXWdKV19IoMzvWY=,tag:N+3lEu+8hr3TUwbo5VlFrA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.2

values/etersoft/secrets.server-xray-public.yaml

@@ -1,37 +0,0 @@
-files:
-    config:
-        enabled: ENC[AES256_GCM,data:QJdNMQ==,iv:m8KcSZ1Qi9lmCUTfJkceKMu1iWMBin2Y8P+6g7pSU4g=,tag:z4N53rRhoTNdlMK5nu8rYw==,type:bool]
-        sensitive: ENC[AES256_GCM,data:8ltdENw=,iv:qeBWpMCAxo0OwRc4B/6CAbkxn7Bal7iDfgidvqtEmpg=,tag:3ipWGmcf1ZjsNTP1zJuXhw==,type:bool]
-        remove: []
-        entries:
-            config.json:
-                data: ENC[AES256_GCM,data:8Lcjs0itPOyEy/ZQJS8KZBwFW5BEC039JJJCVhUjL29+NF31Os5vo8jLoCayW9e8tasVVhP8BQlGFq/ABQajXmLoLCSQI0yAOGdVSvQEXy4HjBxsDnPIvNq1/4dk0FsoQwTJYaVW0QxSUWkipyZD0cbzssJ9Zd+KnIIs4MGreXfibuyZI+HinrYlxP8CXNTn6o2eUSx3zXodD0K2IO7tUOlIbYK2PwIBvhz1JxUhqXIXfoEF2FoVU7ca6YCHA4b8kLLep9gz6z2yHrM6CMk2AUi6H90jGfUPu1dn+H0zBc9JsnVpbGp1KGtx5V6UAk8i4Ed1Iv8zVlvv/i8mmWhY2ue0doFj2cY6QgKc0fqgfkqTgy0k1IeTbxfWDH69KEKMpqk5UotvI31R6ZQlYNgc29IzdMDzXU9UVvDzwwP6bl10VYZp0pwwgV8nqOnr+ZTNR4Hy3Xrmq99SUAq1fc7/CPebj+g9v+PfjKMrOAL9kOVTNK7EJMMp7JQXTrtgifkz21HkfjMVKh3JMFs6gJla21zgYqHqpgU4t1dtA2+Y2OCJV43dZsNNnuEqvBVJhCMta/Lh6xoqtaLoC3TYRrkp1PWGNvP277UJnvS1RekDAl/RjFFOlOLHOrbQpFd5zTWeM6K8iOPcmugPreE8p9FQIFN9tyYW0SryrZ7V6dRb9qrEYbFXMqjLX9voTJyD7K6xX9omgX4OHC9RJA3P0hbsidwooZZBUDGs842LI5hCoEeEOYz1h5ZQV0tLUP8omIwZOvm5B9cXt3GmVvcWYw0Cy5h/1neuzZzQipveQoQkartZuvg+WjjJMOASdMuSqdvw+wCdGCGlNH8ACtFR3pvnXn3NIN5WaQukWpkpSWNGtr/teW/5KtFvICwg95ieNoAOar3T0txR4DQ4oHw8gh7JK/57E0HzC6q6gqCeqQGZYKt/0QVnQCMKHh7rD6nz1aiFgh15vzAU3sjWMlszt5Q6pNQCb9Ib8txJA3gvI2AuMr/614NwyN2WHtuangVBg/nLUQW/0IL0FZWYWAmjvn+e0Ucsx+gNt9XVzvJv8782gnt3LXMz9QqT+NbNW0lzrac5AQ5Ka/uImDFNmzKunk/3yTb9K2q2kzOx0QCBYGcvvCjeX4SP2cDOJkSQV7qB9AqiKJP4h/oDkrNHH+b6n624c9C/IDAqWu5Gr9RUbhADVbRsLJjbzNdQj9Feacvw2UDjE9BNz42RN5K+Nz8Cw72B3iUg/3gcAhhjUvI/liuZCf1Py6nxi1Hl4MpoAinKabIUGvoIt5fBv+iXKXmhe+qulKDuJj+maIAKKmcnVFxcl1waWLrVPLO4gSNVCTp8b7tCwGuLIcynPGCLxSOnis4YJi7ux5oA3pn9pq5jop3kXQTpU8AexU4bmDFF4pzqXogNSDbiy/fKQV2pFnMW3KwOSXCBTzS9RmnGm+X8zQbXxnX1cP/vSmh9Pqs/4FEVlg79P5uEY+0YGmKRqmzBFZEQgXaYhOMWWsIMCzES2wNe5LuHEYiVF0fXK0GsYswPejH2Y8kg4jT5gynzfHuQzNO2P9id/o+q/Ptf9w5fizPZOBeOLMPpDP5LzYA8mPyb3WMryUj6agYk/CnEc07R0Xqk62gh9l0kmmDJneciwUz9bcGQGwfZVDwJeHyI2cS1huU6Ay6s8D1XyZnzWRAk0uAdY1a7oYhs0X0XioG0jsz6NBhUfRMNTqxITmxLnrrC3RbZfHtKizBnBDZ/OsSvMcUDg+wxz84PKM3p+gXUzxXypWCBFxHUoAy5x1V9rVINha9LUdtWiYD3JeoUbmgTIWKGOTXuXGlDdqkVedAtLyqIwAxCRgLWra/NoLJ3ZSVjWB/bpsrDc6suVKTn2LXSk+QSHE/2mzIvO1XBDd2QvG0VnVXNwFFRP8321hERwgNDQgh2AlcPBFJX1VaP6EHqa/VjX3bIrXxZMmq3UKH+wxR1pn+D0x1npIk1lAOW9yvJH/CUpbXJcNzSRTy2OR2MFTJcW432KKdcm7VoWhmUciCfOnvcvJekH/1yjoXRd3D0T/2hdPnxdkcFyoM9QZ7/5T3NXnNxVwaZwqlzg5vKGf8YkqWL2PhsbqxkRk62oPYEAfamyyszn2WT8mxp1MjYmYxAxAxIiVBuZR/Vn/pU/Abpar+7hTUChKSz/hiR0vF6MiblMcyjLA4hZ0SRdkDDaofpvkg4qo4cAjTtIBHj4doPWPdieXYvxLp0SCUe41WnBj3Z4Cmxkc+V9UaFhRxmxCU18Q4eOZ5DMOikB9BbQooHQ/eqrkel8pT1ObtqxAmQmuFyiP5RvByEdyvM4R9hZ+nO/C9m4msoIxr0Zl3VR0oNZEjtIMS+RGfofK4Su611pkRk2nHVG9fJqvNjX30SZts7BZarrj3IZJNx0OGfXOEVAR2AftV0UlEIyjJm9oB/WTLlecUAXZgaVCkebB5R1rSB3Bxu4tFkb3AUdCFz9CpNH2IFVGaTPlQK9cowc+2s1fPVpDiVFU4NBPgPGKD3X7Reu/U0Z13J7gC9zcbPt+39GRomH/XhubjyWps1CQZRQ0XadiimQhlmiM+da9Gpy5VSUNCapr8+rw0SJhHP3oKbpPscBxjcaI5Q1wCMHzSfuF/rvGxeah2M/RHW8nFXWrZGMXHqjRQeDPagkRM782/wx1JBX5o0P1vbjV7pTRtySC9ukQPEoepjcGxR0eso1WHPO+oxaAc56ViORdfEBVMSdgVYJQJeCayIqYcQxFY1As0WT6JgQ9FyITIwJcPW8AQ6vzz6mDaBCpibNqWkv7SRe3vvivIaW+prQS+mujqsbgwtLq71LtGkjAbe5ANyBP9OfhIvYYY/yuENKfTe1pOnzQL1THyrfVTWhqsB9Smu7L3VCaULTLVxL/fELnunWNSWqzhAWLm3YP907phKt84bd/4vI/eN7RO6WpB/J0XpAbBfwVWB5A2fxToe9pfw9zJ//nJZg+iP0kX9aJkENV17YYINsd7QHgwWnAFgxcaQgco9VwugJz2B6mNAmhc3ahi6zdOon/E/mC7hKzKPIsf9Ll87L+1pcYO1yGdzKLl/vx6EcjqzIk/GnUnkr/8h6qNSUBPUzWqMce6DsxvbRYc07C3g/CjcS8SLoxLwHCsQhQev3vtSOT0VC3vuOKOu3f0zHJRyeyG2Ppn5hNtv3J6WWUOL3N8oVbOdH42JQnNxDrbXJNE93jN1YTgTUwhne4ZboqudGoZTnwzZo/1E0GvKA7aXq049isY9UdCU+LGb8pvJL/XjWXWApMiXDRMVAoG6+VxyIaDrrlSWoPdaSwhxNZM8Gzy0Y74=,iv:BdIS18qQNBFdjwlv0IH/t2L/R0FywZiu8+ExA7X2HIc=,tag:AiCzrJzmxzocT/fnshUttA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1OXIrRVJJS2hlZUQ0a3I5
-            SCtVeHFiWExFM1F5K1ZzVENOMGtvOWlJOEF3ClJTRXJ5NCtHT08zWkluL3oydkJR
-            aHd5ZmZKY0ZHcXdhaExiVE9tUVg4S0UKLS0tIEliYkxrck9tc2F2amF1TDVXZlZR
-            eU1ENGZHaUgwSXViNEY2cnhneUEvbDAKW4Ynu3DBBXRGn8l+yIMKTFp1+qnEEwhz
-            ZCX0RkdBusfX9IU+EZjAh6L0t+RKUf5vvC4giHbd4g0Fhui2E/NWpw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age17fyzv5mezck364lvyepp9pa3tnjn7jvsgcpykhhz2smnxyq6fdusvl7waf
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjUVNJN0VQSHlHVzRyem9H
-            a1pDT1lQZGRjRTcwUzFWSEgrdlljZDlnOEN3CktYakY5YWEvTloyaHBPR3hqVUph
-            WXFMb2krZnBWNWJhRWJBOFloNEFPUUUKLS0tIFRjYlNRb21TanF3SDkxRDk0N2k0
-            ZTZBWkxUbVZpYjdUZFZDK1JOREpDcmMKyBU5+qvwshU6LBzSPptQtqIY3X+gKgur
-            nhkMcV6g5z40EwfvuJvfAzqZrsuKOejungXunKV3Q/QyiTn+/RrJoA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-02-08T20:27:36Z"
-    mac: ENC[AES256_GCM,data:JT/yRb2b+wKSS66ZkqqzbTOQWs1dOjXSEKZeBP6hcaVwmPcFld4bOZgPmJeYl8ZTWJyIjNc5cwBB/VP95DdSBroFy2WCJeVjdSEWxQT37AvwJSXwHeODr5JOI+pwwubqzhorNKip/MDvZw3qnIUuFEaXWlwKMfMR01/M3nGB2HI=,iv:dfWIeGuk7S6jS12OOAzYVmDWFQmaiQP83roR1GxulaA=,tag:ZocnLTP4PO1QAw9F6oK1wQ==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.9.4

values/etersoft/values.external-dns.yaml

@@ -1,7 +1,5 @@
 provider:
   name: cloudflare
-policy: sync
+domainFilter:
-txtOwnerId: eter
+  - badhouseplants.net
-txtPrefix: eter-ext-dns
+  - nrodionov.info
-logFormat: json
-logLevel: info

values/etersoft/values.minio-self.yaml

@@ -1,119 +0,0 @@
-ingress:
-  enabled: true
-  ingressClassName: traefik
-  annotations:
-    kubernetes.io/tls-acme: "true"
-    kubernetes.io/ingress.allow-http: "false"
-    kubernetes.io/ingress.global-static-ip-name: ""
-    cert-manager.io/issuer: my-ca-issuer
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-  path: /
-  hosts:
-    - s3eself.badhouseplants.net
-  tls:
-    - secretName: s3eself.badhouseplants.net
-      hosts:
-        - s3eself.badhouseplants.net
-consoleIngress:
-  enabled: true
-  ingressClassName: traefik
-  annotations:
-    kubernetes.io/tls-acme: "true"
-    kubernetes.io/ingress.allow-http: "false"
-    kubernetes.io/ingress.global-static-ip-name: ""
-    cert-manager.io/issuer: my-ca-issuer
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-  path: /
-  hosts:
-    - min.self.badhouseplants.net
-  tls:
-    - secretName: min.self.badhouseplants.net
-      hosts:
-        - min.eself.badhouseplants.net
-rootUser: "overlord"
-replicas: 1
-mode: standalone
-environment:
-  MINIO_SERVER_URL: "https://s3eself.badhouseplants.net"
-tls:
-  enabled: false
-  certSecret: ""
-  publicCrt: public.crt
-  privateKey: private.key
-persistence:
-  annotations:
-    volume.kubernetes.io/selected-node: yekaterinburg
-  storageClass: local-path
-  enabled: true
-  accessMode: ReadWriteOnce
-  size: 60Gi
-service:
-  type: ClusterIP
-  clusterIP: ~
-  port: "9000"
-consoleService:
-  type: ClusterIP
-  clusterIP: ~
-  port: "9001"
-resources:
-  requests:
-    memory: 2Gi
-buckets:
-  - name: velero
-    policy: none
-    purge: false
-    versioning: false
-  - name: xray-public
-    policy: download
-    purge: false
-    versioning: false
-metrics:
-  serviceMonitor:
-    enabled: false
-    public: true
-    additionalLabels: {}
-policies:
-  - name: allanger
-    statements:
-      - resources:
-          - "arn:aws:s3:::*"
-        actions:
-          - "s3:*"
-      - resources: []
-        actions:
-          - "admin:*"
-      - resources: []
-        actions:
-          - "kms:*"
-  - name: velero
-    statements:
-      - resources:
-          - "arn:aws:s3:::velero"
-        actions:
-          - "s3:*"
-      - resources:
-          - "arn:aws:s3:::velero/*"
-        actions:
-          - "s3:*"
-  - name: Admins
-    statements:
-      - resources:
-          - "arn:aws:s3:::*"
-        actions:
-          - "s3:*"
-      - resources: []
-        actions:
-          - "admin:*"
-      - resources: []
-        actions:
-          - "kms:*"
-  - name: DevOps
-    statements:
-      - resources:
-          - "arn:aws:s3:::badhouseplants-net"
-        actions:
-          - "s3:*"
-      - resources:
-          - "arn:aws:s3:::badhouseplants-net/*"
-        actions:
-          - "s3:*"

values/etersoft/values.minio.yaml

@@ -9,11 +9,11 @@ ingress:
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
   path: /
   hosts:
-    - s3.ru.badhouseplants.net
+    - s3e.badhouseplants.net
   tls:
-    - secretName: s3.ru.badhouseplants.net
+    - secretName: s3e.badhouseplants.net
       hosts:
-        - s3.ru.badhouseplants.net
+        - s3e.badhouseplants.net
 consoleIngress:
   enabled: true
   ingressClassName: traefik
@@ -25,19 +25,19 @@ consoleIngress:
     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
   path: /
   hosts:
-    - minio.ru.badhouseplants.net
+    - min.e.badhouseplants.net
   tls:
-    - secretName: minio.ru.badhouseplants.net
+    - secretName: min.e.badhouseplants.net
       hosts:
-        - minio.ru.badhouseplants.net
+        - min.e.badhouseplants.net
-rootUser: "overlord"
+rootUser: 'overlord'
 replicas: 1
 mode: standalone
 environment:
-  MINIO_SERVER_URL: "https://s3.ru.badhouseplants.net"
+  MINIO_SERVER_URL: "https://s3e.badhouseplants.net"
 tls:
   enabled: false
-  certSecret: ""
+  certSecret: ''
   publicCrt: public.crt
   privateKey: private.key
 persistence:
@@ -50,11 +50,11 @@ persistence:
 service:
   type: ClusterIP
   clusterIP: ~
-  port: "9000"
+  port: '9000'
 consoleService:
   type: ClusterIP
   clusterIP: ~
-  port: "9001"
+  port: '9001'
 resources:
   requests:
     memory: 2Gi
@@ -63,10 +63,6 @@ buckets:
     policy: none
     purge: false
     versioning: false
-  - name: xray-public
-    policy: download
-    purge: false
-    versioning: false
 metrics:
   serviceMonitor:
     enabled: false
@@ -76,7 +72,7 @@ policies:
   - name: allanger
     statements:
       - resources:
-          - "arn:aws:s3:::*"
+          - 'arn:aws:s3:::*'
         actions:
           - "s3:*"
       - resources: []
@@ -88,17 +84,17 @@ policies:
   - name: velero
     statements:
       - resources:
-          - "arn:aws:s3:::velero"
+          - 'arn:aws:s3:::velero'
         actions:
           - "s3:*"
       - resources:
-          - "arn:aws:s3:::velero/*"
+          - 'arn:aws:s3:::velero/*'
         actions:
           - "s3:*"
   - name: Admins
     statements:
       - resources:
-          - "arn:aws:s3:::*"
+          - 'arn:aws:s3:::*'
         actions:
           - "s3:*"
       - resources: []
@@ -110,10 +106,10 @@ policies:
   - name: DevOps
     statements:
       - resources:
-          - "arn:aws:s3:::badhouseplants-net"
+          - 'arn:aws:s3:::badhouseplants-net'
         actions:
           - "s3:*"
       - resources:
-          - "arn:aws:s3:::badhouseplants-net/*"
+          - 'arn:aws:s3:::badhouseplants-net/*'
         actions:
           - "s3:*"

values/etersoft/values.qbittorrent.yaml

@@ -24,13 +24,13 @@ ingress:
       traefik.ingress.kubernetes.io/router.middlewares: applications-torrentauth@kubernetescrd
     enabled: true
     hosts:
-      - host: tor.ru.badhouseplants.net
+      - host: tor.e.badhouseplants.net
         paths:
           - path: /
     tls:
-      - secretName: tor.ru.badhouseplants.net
+      - secretName: tor.e.badhouseplants.net
         hosts:
-          - tor.ru.badhouseplants.net
+          - tor.e.badhouseplants.net
 persistence:
   config:
     annotations:

values/etersoft/values.server-xray-public.yaml

@@ -1,271 +0,0 @@
-certificate:
-  enabled: true
-  certificate:
-    - name: xray-public.ru.badhouseplants.net
-      secretName: xray-public.ru.badhouseplants.net
-      issuer:
-        kind: ClusterIssuer
-        name: badhouseplants-issuer-http01
-      dnsNames:
-        - xray-public.ru.badhouseplants.net
-
-traefik:
-  enabled: true
-  tcpRoutes:
-    - name: server-xray-public
-      service: server-xray-public-xray-https
-      match: HostSNI(`*`)
-      entrypoint: xray-internal
-      port: 443
-shortcuts:
-  hostname: xray-public.ru.badhouseplants.net
-ingress:
-  main:
-    enabled: true
-    annotations:
-      kubernetes.io/ingress.allow-http: "false"
-      kubernetes.io/ingress.class: traefik
-      kubernetes.io/ingress.global-static-ip-name: ""
-      kubernetes.io/tls-acme: "true"
-      meta.helm.sh/release-name: xray
-      meta.helm.sh/release-namespace: xray
-      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-extraVolumes:
-  certs:
-    secret:
-      secretName: xray-public.ru.badhouseplants.net
-
-workload:
-  replicas: 2
-
-ext-cilium:
-  enabled: true
-  ciliumNetworkPolicies:
-    - name: xray-public
-      endpointSelectors:
-        app.kubernetes.io/instance: server-xray-public
-        app.kubernetes.io/name: server-xray
-      egress:
-        - toEntities:
-            - cluster
-        - toPorts:
-            - ports:
-                - port: "53"
-                  protocol: ANY
-        - toEntities:
-            - world
-      egressDeny:
-        - toCIDR:
-            - 93.158.213.92/32
-            - 93.158.213.92/32
-            - 185.243.218.213/32
-            - 91.216.110.53/32
-            - 23.157.120.14/32
-            - 94.243.222.100/32
-            - 208.83.20.20/32
-            - 156.234.201.18/32
-            - 209.141.59.16/32
-            - 34.89.51.235/32
-            - 109.201.134.183/32
-            - 83.102.180.21/32
-            - 185.230.4.150/32
-            - 45.9.60.30/32
-            - 5.181.156.41/32
-            - 156.234.201.18/32
-            - 34.89.51.235/32
-            - 83.6.102.25/32
-            - 51.222.82.36/32
-            - 125.227.79.123/32
-            - 193.42.111.57/32
-            - 135.125.202.143/32
-            - 176.56.7.44/32
-            - 185.87.45.163/32
-            - 181.214.58.63/32
-            - 143.198.64.177/32
-            - 5.255.124.190/32
-            - 52.58.128.163/32
-            - 15.204.57.168/32
-            - 34.94.76.146/32
-            - 211.23.142.127/32
-            - 64.23.195.62/32
-            - 23.153.248.83/32
-            - 82.156.24.219/32
-            - 37.235.176.37/32
-            - 176.123.1.180/32
-            - 35.227.59.57/32
-            - 62.210.114.129/32
-            - 185.216.179.62/32
-            - 34.94.76.146/32
-            - 121.199.16.229/32
-            - 23.163.56.66/32
-            - 176.99.7.59/32
-            - 207.241.231.226/32
-            - 207.241.226.111/32
-            - 27.151.84.136/32
-            - 104.244.77.14/32
-            - 5.102.159.190/32
-            - 184.61.17.58/32
-            - 125.227.79.123/32
-            - 181.214.58.63/32
-            - 95.217.167.10/32
-            - 159.148.57.222/32
-            - 15.204.57.168/32
-            - 211.23.142.127/32
-            - 34.94.76.146/32
-            - 187.56.163.73/32
-            - 109.71.253.37/32
-            - 5.182.86.242/32
-            - 104.244.77.14/32
-            - 190.146.242.81/32
-            - 89.110.76.229/32
-            - 138.124.183.78/32
-            - 209.126.11.233/32
-            - 167.99.185.219/32
-            - 37.59.48.81/32
-            - 27.151.84.136/32
-            - 142.132.183.104/32
-            - 193.53.126.151/32
-            - 74.48.17.122/32
-            - 93.158.213.92/32
-            - 156.234.201.18/32
-            - 35.227.59.57/32
-            - 34.89.51.235/32
-            - 34.94.76.146/32
-            - 184.61.17.58/32
-            - 125.227.79.123/32
-            - 104.21.58.176/32
-            - 172.67.162.102/32
-            - 181.214.58.63/32
-            - 93.185.165.29/32
-            - 95.217.167.10/32
-            - 159.148.57.222/32
-            - 15.204.57.168/32
-            - 211.75.210.220/32
-            - 125.227.79.123/32
-            - 211.23.142.127/32
-            - 172.67.165.72/32
-            - 104.21.57.182/32
-            - 35.227.59.57/32
-            - 34.89.51.235/32
-            - 34.94.76.146/32
-            - 187.56.163.73/32
-            - 109.71.253.37/32
-            - 5.182.86.242/32
-            - 104.244.77.14/32
-            - 193.53.126.151/32
-            - 104.19.22.31/32
-            - 104.19.22.22/32
-            - 104.19.22.27/32
-            - 104.19.22.23/32
-            - 104.19.22.30/32
-            - 104.19.22.24/32
-            - 104.19.22.26/32
-            - 104.19.22.29/32
-            - 104.19.22.32/32
-            - 104.19.22.28/32
-            - 104.19.22.25/32
-            - 74.48.17.122/32
-            - 184.61.17.58/32
-            - 104.21.62.230/32
-            - 172.67.139.235/32
-            - 172.67.135.244/32
-            - 104.21.26.114/32
-            - 104.21.72.244/32
-            - 172.67.136.175/32
-            - 172.67.183.130/32
-            - 104.21.64.112/32
-            - 104.26.10.105/32
-            - 104.26.11.105/32
-            - 172.67.70.119/32
-            - 172.67.144.128/32
-            - 104.21.71.114/32
-            - 172.67.161.130/32
-            - 104.21.65.89/32
-            - 172.67.156.75/32
-            - 104.21.40.186/32
-            - 65.21.91.32/32
-            - 184.61.17.58/32
-            - 104.21.82.111/32
-            - 172.67.200.173/32
-            - 104.21.13.129/32
-            - 172.67.200.14/32
-            - 104.21.89.147/32
-            - 172.67.160.224/32
-            - 172.67.139.235/32
-            - 104.21.62.230/32
-            - 93.158.213.92/32
-            - 185.243.218.213/32
-            - 91.216.110.53/32
-            - 23.157.120.14/32
-            - 94.243.222.100/32
-            - 208.83.20.20/32
-            - 156.234.201.18/32
-            - 209.141.59.16/32
-            - 34.94.76.146/32
-            - 35.227.59.57/32
-            - 34.89.51.235/32
-            - 109.201.134.183/32
-            - 83.102.180.21/32
-            - 185.230.4.150/32
-            - 45.9.60.30/32
-            - 5.181.156.41/32
-            - 83.6.102.25/32
-            - 54.39.48.3/32
-            - 51.222.82.36/32
-            - 125.227.79.123/32
-            - 193.42.111.57/32
-            - 135.125.202.143/32
-            - 176.56.7.44/32
-            - 185.87.45.163/32
-            - 93.185.165.29/32
-            - 181.214.58.63/32
-            - 143.198.64.177/32
-            - 5.255.124.190/32
-            - 52.58.128.163/32
-            - 15.204.57.168/32
-            - 35.227.59.57/32
-            - 34.89.51.235/32
-            - 34.94.76.146/32
-            - 211.23.142.127/32
-            - 211.75.210.220/32
-            - 125.227.79.123/32
-            - 64.23.195.62/32
-            - 51.81.222.188/32
-            - 23.153.248.83/32
-            - 82.156.24.219/32
-            - 37.235.176.37/32
-            - 51.15.41.46/32
-            - 176.123.1.180/32
-            - 104.244.77.87/32
-            - 34.94.76.146/32
-            - 34.89.51.235/32
-            - 35.227.59.57/32
-            - 62.210.114.129/32
-            - 185.216.179.62/32
-            - 34.94.76.146/32
-            - 34.89.51.235/32
-            - 35.227.59.57/32
-            - 121.199.16.229/32
-            - 35.227.59.57/32
-            - 34.89.51.235/32
-            - 34.94.76.146/32
-            - 23.163.56.66/32
-            - 176.99.7.59/32
-            - 207.241.231.226/32
-            - 207.241.226.111/32
-            - 27.151.84.136/32
-            - 51.159.54.68/32
-            - 104.244.77.14/32
-            - 5.102.159.190/32
-            - 190.146.242.81/32
-            - 89.110.76.229/32
-            - 89.47.160.50/32
-            - 138.124.183.78/32
-            - 209.126.11.233/32
-            - 167.99.185.219/32
-            - 27.151.84.136/32
-            - 37.59.48.81/32
-            - 27.151.84.136/32
-            - 142.132.183.104/32
-            - 159.148.57.222/32
-            - 159.148.57.222/32

values/etersoft/values.traefik.yaml

@@ -5,18 +5,12 @@ ports:
       default: true
     exposedPort: 1194
     protocol: TCP
-  xray-public:
+  xray:
     port: 27015
     expose:
       default: true
     exposedPort: 27015
     protocol: TCP
-  xray-internal:
-    port: 27016
-    expose:
-      default: true
-    exposedPort: 27016
-    protocol: TCP
 providers: # @schema additionalProperties: false
   kubernetesCRD:
     enabled: true

values/etersoft/values.uptime-kuma.yaml

@@ -1,20 +0,0 @@
-ingress:
-  enabled: true
-  annotations:
-    kubernetes.io/ingress.class: traefik
-    kubernetes.io/tls-acme: "true"
-    kubernetes.io/ingress.allow-http: "false"
-    kubernetes.io/ingress.global-static-ip-name: ""
-    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-    external-dns.alpha.kubernetes.io/ingress-hostname-source: defined-hosts-only
-  hosts:
-    - host: uptime.ru.badhouseplants.net
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-
-  tls:
-    - secretName: uptime.ru.badhouseplants.net
-      hosts:
-        - uptime.ru.badhouseplants.net

values/etersoft/values.vaultwardentest.yaml

@@ -1,5 +1,5 @@
 shortcuts:
-  hostname: vaulttest.ru.badhouseplants.net
+  hostname: vaulttest.badhouseplants.net
 ext-database:
   enabled: true
   name: vaultwardentest-postgres16
@@ -35,7 +35,7 @@ ingress:
       kubernetes.io/ingress.global-static-ip-name: ""
       cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
     rules:
-      - host: vaulttest.ru.badhouseplants.net
+      - host: vaulttest.badhouseplants.net
         http:
           paths:
             - backend:
@@ -47,8 +47,8 @@ ingress:
               pathType: Prefix
     tls:
       - hosts:
-          - vaulttest.ru.badhouseplants.net
+          - vaulttest.badhouseplants.net
-        secretName: vaulttest.ru.badhouseplants.net
+        secretName: vaulttest.badhouseplants.net
 extraVolumes:
   logs:
     emptyDir: {}
@@ -64,7 +64,7 @@ env:
     enabled: true
     sensitive: false
     data:
-      DOMAIN: https://vaulttest.ru.badhouseplants.net
+      DOMAIN: https://vaulttest.badhouseplants.net
       #SMTP_HOST: mail.badhouseplants.net
       #SMTP_SECURITY: "starttls"
       #SMTP_PORT: 587

values/etersoft/values.xray-docs.yaml

@@ -1,38 +0,0 @@
-workload:
-  metadata:
-    annotations:
-      keel.sh/policy: force
-      keel.sh/trigger: poll
-      keel.sh/initContainers: 'true'
-
-ingress:
-  main:
-    metadata:
-      annotations:
-        kubernetes.io/ingress.class: traefik
-        traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-        kubernetes.io/tls-acme: "true"
-        kubernetes.io/ingress.allow-http: "false"
-        kubernetes.io/ingress.global-static-ip-name: ""
-        cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-        traefik.ingress.kubernetes.io/router.middlewares: public-xray-xraydocsauth@kubernetescrd
-
-extra:
-  templates:
-    - |-
-      apiVersion: v1
-      kind: Secret
-      metadata:
-        name: xray-docs-auth
-      stringData:
-        users: |
-          ilove:$apr1$N65S3o4r$Yc9pJnHPN4tUE1ZLzJsGI.
-    - |-
-      apiVersion: traefik.io/v1alpha1
-      kind: Middleware
-      metadata:
-        name: xraydocsauth
-      spec:
-        basicAuth:
-          secret: xray-docs-auth
-

values/xray-1/secrets.promtail.yaml

@@ -0,0 +1,27 @@
+config:
+    clients:
+        - url: ENC[AES256_GCM,data:CFq8x1jLDO8aLitEOlCOXeG1yp8RqKHdeqf8x7o9YESOmTAKFTuLpcBUDeESNTv9,iv:68uLarfOiS4oTcvEQu4uHMQUzRhXhqAZb5c4ik4U2E4=,tag:GhkkzriBYhWmTxt0KNwMkg==,type:str]
+          tenant_id: ENC[AES256_GCM,data:Iad0xh30fhwNiDh8SRU=,iv:A9o5brTa/2YbdYCIg5D4RHY2LXkMauIZBfygGsyV8gM=,tag:vNbcRImDSRCkM34B03MiMQ==,type:str]
+          basic_auth:
+            username: ENC[AES256_GCM,data:kUgLwA==,iv:5rAxU463ynXXZQfmGykocKmWm+VKahatT2KokSux16E=,tag:vYe9g0mePeYAapJlHAOWVw==,type:str]
+            password: ENC[AES256_GCM,data:2Zb4d8Aj5M27V7YNvcdFIkHHAl5dvNIlB46sP2sJ,iv:wW31BhjGvN2ii60p+/hSs2IqaIhLbDgl70KFfGiTbXM=,tag:50DB7GxuuAl+8GJ7K2ePvA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdjR0eFRDS2dCVTNENUFr
+            V0k4T2Q2cmxua05QeDlzdnB2WWJLQ2hQbUdZCndjT0cxcytPUW0zOWtxVy9sazlr
+            Z3RKSkFVeGx2UkdtWmhLQXhNUnpKeUEKLS0tIGV3L1pRNXlZMG92K1N6aGlvSVBz
+            ZVV1d3R6KzJtT0drOVNHSThDdjAxekkK1RXCHM6QhNXto5D6yFTlvANN3E4iYfOC
+            Bf8s76p0ynI3tqfH6IgA9NFRPxYPzMGC/1zsQ95n5N6fMXh/KouRqg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-17T16:09:55Z"
+    mac: ENC[AES256_GCM,data:EM9kmYq/6en0XwMtmDcx5yO6VflugTbqDgPvvIBl7m6EvFi9EkMx/Aa9jkVYS+VFvS+pJ9pVe8+F/TL5+o/K0O9rkgZ8+ciAYXoRDBb1o9qUMoy2+ZjbjI7FMXDp8c8UED0MK+SZYNZ2C+44C9kohX5cPwOQCHd+0HxJKOTzH8U=,iv:The91sevo/IqJIXBt8BAta5RYDtv1oFaGQRyqzrm+tM=,tag:fKduoewHPG/N1qGr76r/8A==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

values/xray-1/secrets.server-xray-public.yaml

@@ -0,0 +1,37 @@
+files:
+    config:
+        enabled: ENC[AES256_GCM,data:KhdaSQ==,iv:/RR/lub7n1fYtAntHcy4Ul0R9bxrfDJs1KlED+8tH/Y=,tag:VhQ6pjrRai9HD0nH1dqO9g==,type:bool]
+        sensitive: ENC[AES256_GCM,data:4WIq3z8=,iv:JMNb5dUGVWBUO4ymsp4MULD3kPMAmUzedSxB8IHCXtA=,tag:Xj8ItxuhgY5se8jAyFne5A==,type:bool]
+        remove: []
+        entries:
+            config.json:
+                data: ENC[AES256_GCM,data:XqWiy83f0OxEMu5exDowE3wkPz5/MARnsIhdq3dcZlK7NXZJERHO1UXr6emVnn8W9Wcg+BDl17FkA7A4DZNuAChRHNg3AqcX1dZYBGcU44VG5r8qS76o1+in7TrSN56TgEBEBcifsV6TE/snilq+SpRgLoPy0196XgBM+0FZasRHY/Feda/JTLubvrHYW/zY2ACxAEfaxQzqGt80SlZgvfVN+xk1vu7mR8TdQXQjE64Y9vSL+94UoeRSOUHLjdGNndtP5p62IfZS6QChA78f8s/yfYW8/oQZ2/WPPQFNCb2ZEJT7S/exUDzt5UpXVgLo+m5c3VpmDuR+Zj+uTBzWHs46Nw538xzJaDA6Xz60zhL7SSm8/qdkPc4TT04zGqPXmA2wftBjHFm3M3yM4KZix2C8ILfZiQoBLg9LV9In2kj60kyxwiASd8hyCrTWO6j9rnReBQwVIvmYFvU/A6CUvkrflJcIQ3ETnxQH9bkJEd1y+3Znqdn3rlkGFd2UJ/erLqowJPkLDFHMzs3RZHevrBMunuF4WSCggeXeIeZcqRcJzEjsUeSATUoot+T88XC/6B8xbqinn4Z7rlGajQdp+OIIU/5daMj7wMHZ99N6g0Mfpf331TzbUtDVBZj83VlIslVd6XXCLaBHswWBplMgBC5u/5kTy+cNK7Tif3ltWZLyAsafvchR1vJLmf3MaxUURZ5uqTQIvd4CB39i/Yju9CSuUoIgBR/LUEM9ErqXP52IapEEg2csepGBru5gjLR30SP1tGBPbszo7KuIN6MwtBxtxLqa9zBY+IVW19nDD6LoXZR463IYle2JuOEhpeOLIZcEpx/4vpWAeJSdVcA63ndTqWJ3lvzLUCXIK8XhoHxOAeGn4S6lGb+sNMNNIKQr7p3a7RvRq0zLTiC20bW6JoYj6BqQBC35w+mx9f6Qq3Bv8PggHzp5KSVUSOFWssrzFdGF7pOqnB+vK15VSu2IWa2vozcQlRG5xPnnN/OhiPXYcyvgxeL8a66pltrmrAm+NE4vn08OurE0nglAKJLz5lSWzkXyQtTs4TP8XcXdKMP5ZQv+Y1fH50D5Ubr9Sjbl0XHsG3uv1A5Ad+SaZiw7bJNRL8uuEIBOm52PoWczdI+ZM/uX6bntrZvWpj8Cy660y6iIeyIXuJHTxLpqJU6M4PdjXmEX2RIC14YAFqErzxk+o8sHNwrfHAaLDL3e80jET1kTq/UvQkkAYn8cudEIkOsyRo3hX1Gb+YifMGhFZC2TnvVG0Sh+seIKoQer8lSKJroVoOFB6V4i2isoq0k1gJK3ImqJb8Jn8RGMFill4izGFdlmSI0EPQO0FI5LEIrZpCfyuZdjVSyuiMwIXMpz8DPcAONETdgjRgIKFfKnVMNOqqSK+07asL+N7a2JsUPve2t7VinTXv6RpuQ92UqMtv+KtsrqRq1+b2JW1wl6ScI7ZTby0r1zaR8da1suxmpbSvUzp22hYj2gMJyFRklYF5QVm8qc4+CoARrsjAZDv6P4bZin8OBzFvLt4a0RDPa5I+rjTH8ZIUxYM75kMcIaziUESXeFaC9XGUUTaSiBWmZfe8oETe08S1tQB2kT2oZZCbMHW1JNBWwe8ujcQjRWL8s8bKJNRbmRqtEo8BpUQQBE+Y4QzQVYgsp7vj9fqYZeTIpWvpsI+TmScExGhkwqOSJC9+Cd51SBx/Op7IWhjL3quEr89KXSH5zva8aokM3/2LkYyYGq+RPOZyxwMdJXgHPMCqbuu9ephhD4wLFDbiDOKAkxUb7TBNS/wONt4wAzoRdZ78fxY/pbPOXhJ3470Z5K7fiXeL9JD7595kQM2pcNEI6JdFk+pPLSa3r6q8c6CaHH035TXCUhuJQzO1L0aXi+DSuj418gc1TyQxoXsZfoe9ZnnUO6qHZRALboitn2b2jENP79XeN62LVcko30LJ1nzfcNoqDaflGmwaH+24vdFsDC5WoONoQ9hX519pyeHHc7tKtPS0NLcKkljLckIaTN1OIEHIhsbm0Z3Vhdkymq7k3h5sp5nveBXmWcRoZgd7EJdB9aZDDEuLaGImtYhexyqcckzjyN5YroHOaKdEDtMIkfSDj/+Z9TVnfd0RFTV4emdzW/o0VTPpkKohTIOoavW3Axi95z/uqflIJL7C1gOwIQ0aaE2pvLf+BTj99Tt3aCZRpYf1mftoo7YKCQscr6+aEFgO0Kk0XEGjpIz1+JWhlm768QY7ZemZrMAuxT5CsqbfncZah5EV/iHIPWmjsUMckN7ff6OxK7jOjTIvDZJVCWFE1aeqiN9zHQhb2VX1r0cKyhjPEHhpEagxWGVmCMG1iyv/+FZWKcT+arvaNTyTwc2wKm9OHpJ3dckTO31bYnXYi/jGdoxN5u1lnkFJ2ERtnCRzCt4SCOUoejTb3+tI+rn/+Qg/Y6BIvx2LmpnFvSuw3/fEqZnI9gSObKjVJNywjkLYLvQoedwYaR0RVXhz1NQ0tyGQH5Z/ydEm0vcXOtzFqmGqHr6f1p9j7DEi7aK+0KDI/nTsrvDlUFp8oZBUpVjbwMrwm3a8CQWuF6JpadU8tbp0qllj6fOuLm2Tj1AEQzeCSRnZHIup+9k+Jh+U2rmx7ofpwJGYXiCOGUWQsSldscW2NEo5HOUPLRge7bUFNmZ9Kd9p/gon5cXdE4zgmf+c4XZ1zAvUsi74bJZTzYPay8OLurD8r5vIHYlHCQcScOvuh6i7qday3Wqw3jd4S7HxbQ19YqtBw2eGQj2A4iZqizdIhYPbmvJ65mponevIrPDiEgBmmQdXxYlpl/xUiv8hcFOB0RO6Plt6yyNxWhEtf0vuD8bR8UsZKuWAH2db1NHtFNBxn2g/nmnBpcFGgHkF30e3RHQ0DIMpiTAXDFoHMtCwlyiuTJjaAubg3KwVR4bOmmigz1Q40t09EZJNfnK9JEWaJlnUJOgiDlKlovq+cr+YVbqnGMDLa5tBCDLz2C3AoSTGbLuZ3A91pVHl6kTLrY4N5zRZstbDny4KXsAapIwCH7IfJd/9gBa/VCPetXB/ReTrYi6Y7Y25YhqEL1hks9IlO7Iz56DHk2spbBkJ8C4a525doBmKQ8AS2vwZ2BRJhYXFxaVP47o4+R+duDZzfhqZy1pT9HAMuBPUmEQDs+KxqgoKLiAyRYvcHgO/mBj1Oftu0SwzEMYan1fzyqCfCrZTO6EVcH4M3dmIbzTyCoyJvOCHS1HNqPNrTR5DMahVc527CImS4pBCv1vXvN/IXshrymJF5Z1seZ1HgGtU4rwcMEFvVGTgya4Z9Je9fa2SSG4S7YeV4urJME9xhoSyG58VWK7pJMI4kLfm6RPtQyT6i2pCGCzAujFwYoa0fl5tBhGO1kZkOMfXcaCOG3ymcEdQagvVcIa9hbNSvgkcT4VGnT4zA1QFazRfsi1n4vTTDk8yMq7jLQNn6aEgbewLq4wHNIZBli+gnijCNVts6bfPOTb82OVYirwtn+2IyMhO9kT1sqH4PEsxl20onYTatTP7Qk41RogLLP1IHvhwAj00DFPxg3iIWbzk4zATAkiZCe0Emb3+ci74uSnjDeVbVVZXprfcrjt+zAoZABCza4sHudp4fJcemHm69LV8yCZRz7HrnxcjQig7cDz12ma/9IVNV0wBCFxlT5NgVp9tZS+lWPtEI6bia1vtLVarEfm068+NRIs+GziTadip7c8QdGUKaonLjdR2G8o7x2k4X5fn65qYLqsOlEu0fWz8LhiC3bc2nwtQxVZ/qRKF0stdFvN9Lgqrf860QE6ubw2RE7MW/k8hLG0gjLctQqpTWrzW7C4KUBGBnOa9w5HyDwFNqvkV01tomjPvvkiHCC4qCiE/yQvDiNEFdWe3NGV0e1IdONmy8qdOs6ZWeSJ8MMQ+j+EP2Wh9ap1ntK1/Gg80pOw/UDldzQg3Duld+Rm4imLJAGNfB2NEOQd/S+SsbW4wg/vfT9VXkSahaWn2u0YG5hBHI=,iv:YE2VLQd+7RCULF/DRvrni6lM52jkpJJA5HlmUleNZZo=,tag:mGjeVtozDL3X8n37frkIPQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBveXp2aTlkcXkwelVCenlW
+            U1d3R0VxNFNyMGJYbHZtMTRrbDlkQWdFczJRCjVyd1V0OVJTNEkzUjBIZmJXejFX
+            WmVNcVM1SFRrN1Vna25DU2pua09HZWcKLS0tIEk4MEFjb3FGZHhzMHNuSXhJRXNv
+            ZVE2RExscWxhejV2YnBFTUxTVEFVSTAKxHqBMIgPFDESbmxip5sJDmZriijPqjjw
+            9JFRSrGYCZE2cnMwu8BuHQzQnTTNZBrRzqWKJ2q+HygxvIbki8EOpQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17fyzv5mezck364lvyepp9pa3tnjn7jvsgcpykhhz2smnxyq6fdusvl7waf
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPTmxnUzFVbGtRbGY0a1Av
+            aEtUanBJVTcrSm5weFkxSnptSGNUM0dQZUFnCnNLdUhiektTQmEwUXY0bWZycTht
+            T20xdDJwdVAzdGdUMzFoVFBaSHNKNzAKLS0tIEYvVnF5a2VpMWVJNTV5TytIYUZZ
+            eWUvblIxK3pzV3ExTVpES2x3ZmVGV1kKA2sYyBydUNnN7V1o+PR5tL+pNQKUK8HP
+            /bRbyvQhx0V45LBdiJheNAenMo7DA6J5INsMt0X26k8wobqrTSEi0w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-20T03:07:02Z"
+    mac: ENC[AES256_GCM,data:t5qbsQu1PmRxw4C8pQuSWXPB6ojZpszsWnaBlcxvqOYoCMsdk6HAFfyIv1MTCOaA4zI53jy+u2wDwcQ72lCLicfQppce2ZeveIuBFUoKJ9AZdKKDJfQr1BeNbqu8/J+XO61teT7TCteiQARiI29xtwr3gyDX3SzIoKWlt6ySjq4=,iv:Cg+giduUBZCbBJuPtNoOaRSWWdEu7Wo0jolR0GMG3uc=,tag:TSR5jeF+v+4I6Z7NL7/3RA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

values/xray-1/values.namespaces.yaml

@@ -0,0 +1,3 @@
+namespaces:
+  - name: public-xray
+  - name: promtail

values/xray-1/values.promtail.yaml

@@ -0,0 +1,7 @@
+config:
+  snippets:
+    pipelineStages:
+      - match:
+          pipeline_name: "drop-all"
+          selector: '{namespace!~"public-xray"}'
+          action: drop

values/xray-1/values.roles.yaml

@@ -0,0 +1 @@
+roles: []

values/xray-1/values.server-xray-public.yaml

@@ -0,0 +1,26 @@
+ext-self-signed-cert:
+  enabled: true
+  name: xray.badhouseplants.net
+  domain: xray.badhouseplants.net
+ingress:
+  main:
+    enabled: false
+service:
+  xray-https:
+    enabled: true
+    type: NodePort
+    ports:
+      https:
+        port: 443
+        targetPort: 443
+        nodePort: 30015
+        protocol: TCP
+  xray-http:
+    enabled: true
+    type: NodePort
+    ports:
+      http:
+        port: 80
+        targetPort: 80
+        protocol: TCP
+        nodePort: 30014

values/xray-2/secrets.promtail.yaml

@@ -0,0 +1,27 @@
+config:
+    clients:
+        - url: ENC[AES256_GCM,data:CFq8x1jLDO8aLitEOlCOXeG1yp8RqKHdeqf8x7o9YESOmTAKFTuLpcBUDeESNTv9,iv:68uLarfOiS4oTcvEQu4uHMQUzRhXhqAZb5c4ik4U2E4=,tag:GhkkzriBYhWmTxt0KNwMkg==,type:str]
+          tenant_id: ENC[AES256_GCM,data:Iad0xh30fhwNiDh8SRU=,iv:A9o5brTa/2YbdYCIg5D4RHY2LXkMauIZBfygGsyV8gM=,tag:vNbcRImDSRCkM34B03MiMQ==,type:str]
+          basic_auth:
+            username: ENC[AES256_GCM,data:kUgLwA==,iv:5rAxU463ynXXZQfmGykocKmWm+VKahatT2KokSux16E=,tag:vYe9g0mePeYAapJlHAOWVw==,type:str]
+            password: ENC[AES256_GCM,data:2Zb4d8Aj5M27V7YNvcdFIkHHAl5dvNIlB46sP2sJ,iv:wW31BhjGvN2ii60p+/hSs2IqaIhLbDgl70KFfGiTbXM=,tag:50DB7GxuuAl+8GJ7K2ePvA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBdjR0eFRDS2dCVTNENUFr
+            V0k4T2Q2cmxua05QeDlzdnB2WWJLQ2hQbUdZCndjT0cxcytPUW0zOWtxVy9sazlr
+            Z3RKSkFVeGx2UkdtWmhLQXhNUnpKeUEKLS0tIGV3L1pRNXlZMG92K1N6aGlvSVBz
+            ZVV1d3R6KzJtT0drOVNHSThDdjAxekkK1RXCHM6QhNXto5D6yFTlvANN3E4iYfOC
+            Bf8s76p0ynI3tqfH6IgA9NFRPxYPzMGC/1zsQ95n5N6fMXh/KouRqg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-17T16:09:55Z"
+    mac: ENC[AES256_GCM,data:EM9kmYq/6en0XwMtmDcx5yO6VflugTbqDgPvvIBl7m6EvFi9EkMx/Aa9jkVYS+VFvS+pJ9pVe8+F/TL5+o/K0O9rkgZ8+ciAYXoRDBb1o9qUMoy2+ZjbjI7FMXDp8c8UED0MK+SZYNZ2C+44C9kohX5cPwOQCHd+0HxJKOTzH8U=,iv:The91sevo/IqJIXBt8BAta5RYDtv1oFaGQRyqzrm+tM=,tag:fKduoewHPG/N1qGr76r/8A==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

values/xray-2/secrets.server-xray-public.yaml

@@ -0,0 +1,37 @@
+files:
+    config:
+        enabled: ENC[AES256_GCM,data:yOJqDw==,iv:p4YUaymPlFvDKex//IBK14xG82ekakbvXbdQ7wnXLkw=,tag:iVbfnbdtLZyf8ux4kw/JNg==,type:bool]
+        sensitive: ENC[AES256_GCM,data:XkpvCgA=,iv:vWxJBv0xhr0tcJvrW8E6OwAPQNlb/cGHeZULBHO51QU=,tag:XwbCtmnH5a59FmGrOXmA/w==,type:bool]
+        remove: []
+        entries:
+            config.json:
+                data: ENC[AES256_GCM,data:xOqEXdNdjjDvDVxrujUSaeUE8lTzW6tx3DE4NRL0FmJm/TibDR4uDpQPhHtXkLzwlKlongyal6/ts62Ord80ZfhqAcILp4zS6vfWqsZb1mJaHZMNrbeTqqvM8160bRHoHO6Cm48ANAK0qL3hxNoxzjoogpAKpXkYil+Puy8GvS6TshIUFFzpRYc0ROmdadUFdC4Nv2UxQW9tE8ZVLaHzdopBfSmE5rVAZqYeycj3ykSmRIu71JEdsF1ZLK6Fkv/L9l3XIf8TWFh9ztAGd940VCplwNv8iA/OgEokR8SNe5MdJvgTxabN+qZ4SwZy6Z1e8RsmVR4cah3vvIfa2YvvapKIwYLoVgC1VwDwdGxHRurg3czrzdgxi9vbbuX3Hz8Zxs/dyj7Twriftwu4KQeNCsn4Uvnkmz5V1Yo4scrtAkh6GViiat/pGtaF0oJgEEtMfUkDPiWdDVJpNS8vFUOEUo//8ftduc73lzqOuh08/YiCWAoovggJVweSX1ZglOg3KEUjBMgCW/Xj5Q8JZG6Yw4D4p7CImGLHgD1Ie/+xjjA/tdJtSpBtnCNybb55wNOBgrr9KwIyNLMBRLjXgQl5OgaNsh97DbaI7hxLdwQW1vJBmDUBYGVR0DLM42bGZzO6yJsphcQw6thvKQEZ+GExeDZKc/ic9y/2qP3K6A6xgkKe9hQWe45NfK5BFtTDeOS7U02y3lmEotV4+KicNILnetTHuGT9+XywocUew/BH/dWbaOdvQWmMGsecPz2F4R0jbVycKaITIaqn5C6IG4rOQ2lbI7nesLz9x6yFiiQDCURUY7kiSdFGl+F5Y+ydl1I8qus1bP0eKR54iYu2rms7EfapkBG04RJ3e0jix986QLG8kcXxxUlNixrTxH5H8HyK2eo38ZdYyCJTcHYoZ+/htbgUuI3iTuBI/u4mZvFrugbNHZrChOMaUpPgbMhtaLQ6X7OjkLzshV1/OPkXzNQXqXMMZxUn4ybL2yw2fImXwGfevXzx63nE1EVob+iph1q+EO0tGGn/n5d2WXEZ7Qopwdwhhl4oYA1co2DKb3rVd5PSgTrlBqhOsEbPjo5TdKHEHufkO60Kse6t5EMK2/fjN/6WOnSypzgqmMaCrZExB5GFh5BqwMAoa/xtw5dhLwgav5lZLckAxXucMH2p533WzHN0V5PM0DhRsrdm3EGT7gpG3E5avWw+pDexaja3uWp5wqvQOW6q5ImwkgZ+lAbKnArwqFBnnb9eOjgriTMYd9s79xpfJqCjGNbDWKy1mnuRR2EUVt3v1RIFQiIdtovyqB5KrSvukyIyUYDuqZhPAqc7nR0ATecvgiYnalL9xgr0L0x4Z9KNqOu1LqrykD3giNtcWnlXTQ9h4dwGwRAvzxzjANx9B6uJYSkN6k2kl6ScjSoIndhr2b8tEIIGLwM9TXMeNhg4OsOTm844rmweAOsCzaQqm++I8wtDY8l9OUnwVN+fbYdRsBntHO9fqliK2KRFs5rnl97GLqW5MjDl7gCgLKDULQp9yvuoTStnZ2qvgIWVKTvEDEybxutGvPVDuam34qSp80YlzR4MacHUgOshJbQ0nbTNNc+qjYi4DxEOj/T1OoRlS6UJmsrqec8uglfIYWd9ZqRSRazpsy1jLzPeUTY5OWjpkHFryjFFEhxy6tlpEHJr4FQbDA5taHI3TcfsBby8DNC1h3/maLBZMlHswxDolEPw4qQw7lqqmvY69CFTkUmZv7gAuOSyNSueVTnlccEnJNH5MNFzvJZLSYOlWuYW1GosnQT6EkNTM+Vu99nqiRnfs9jn8ObRdhsQMBTKKFN4mrdWsIhuw4WE1egi1HQP5ZT+/4944X1nAk4fWHmVgCrY4WTt+fxxjRr7NYGX+aXF7ploJydPtyI7IwPITBRQNoCizV5Z4ecMmj64PPDAXESO4427FMIC5qfGBtOIdEyKL1doOkCcYSrWZ1ngHu06HV69wECZumYmPE3+81F/QuSzoPw/5eLmkKmd/NDHhfai3064opCB+xQFvS7awoApzP91+nE0gd39xQQNbCCpmzFFMDwPp1uhxr60LcmwTE2anRjggUmqtqzraM7TATJWdTMlnov8KBoKwImpCA7fj+3N97FV1f+b/30uE+tC4bOW5RFjgY3MdA50P4PjoH0xiskAFXbrgD4BWm58vJT21gJP2cIXp1HfHjGxgpAX1W52wsnDwQs7bD+SdNVmR+h2IxH64DjKpbm3HIWTgSQ0xiXgjkqJIRKNXeDDGf4S7inkN6WtQH9v2KtWB2QeWJt+gAcqHKA3RbGGOyvVwxpBalrNMdV+dSqAF2jKOvJ5CEmWmyxpAREA9yKevSp7vjLpuFxhtT99N5NvM2K+iDKLH0VCJsp6WsPSbqnOwW8qvqzH7DXSW4LGdCgPFniJJ2zmwI1o2BkwwDxvbEk0sEAt8eSlZC1qb361AWBmIceHIXgtePRgHgrB1uUW7lMBLl+5Noj1SoszggAohUG0R8HFyZceGiHh9yW7+HxKcOUEzEH83WLZmlfKXmNlalVD3l2h1KKSEd5LEOPlE3AORQv89JBmDrAv3WAFPU1Fl7bej69Q9jOJuAmpOozi2qVxCVhJETfAvwj//2Z2cAZHqpEAEHdqfhqOR4EFFTLuUWsF9gIFfAxCBvjtb6n8zaQufYHfOk25So8GTtBtqSj59ZpwiG3R/wnQxFgJUx2otCn1sAC7w7Nr8PdbsIoxMJzAEsJfWddA/m77Bj7ckwMVw18Hneo18f7XDxf2PjdUpSGwbQ6PCSotWXsDol7jIQ3gAa5etVJ4J7q+7ban3JAGyCF7xnRRcCgK0QENS1bVeNoxKNsPzlLnNeirnnWwCHr3Fz4+eN04WhHEq1X3i0ftvnA0K7D7dTm0iXAsqZAXQeVZ/CN0ejdvtdjWNS23h+cPt63QeLflyZe6mHw8/wWPP0i3B8Y6ld/0R4OGiqORlV1S+SUzbUkSCgL9UuK4T6igGda5gLqgj32OYAH67iBsF29TNfjQ2/pOQyNf9dhJASWVuJAWy6B8QA/mVayqHFlKh9opQJHVhj8D27v2nAjN9YJOiz3RDbrBUOkTNGTRCL8YuOVXfpN6PVDVBXnR90X7AmXKi+wqZBfAIU1wdGoNq0Af8c+XuRxK+WrGpAhk0B72H4J7ATZl2vGb6+731s4tdW1b4LClhq6LJrn9TeXt1S/OyGSZY1tp/v5ShyeDSVq1XpTVDVn4dSLLVuigT6m8GK4WJRLzwQQ6sMZ1k8HmJNcoVjQxhPdp1SLP6z+kVcuRJpiGTTeF6bvH7OlxPnUKNLj2VJzQ9fisrR+vZ6TgrHAAu3xbMCgSg1Y0yV1xjYKyHudQ1WMqsbbkb9LugwPbLPCedyEmScER80Vvf4uTVh2DDYxMG1Y2FIAtInsAGg86b+t3zenOJWZNmD+EKNmud8vcl8ByIz/MS7sRtBlGaU4y1MzVWyCmQFTDhov1E2fuiMCYWSNsUa/lf7h9/yW9U1R0ZLYescgUfnHda10N6DprhNP/XiczIT07BesYRrAd/Dc1aNEAX5MrcouOK4OpSA9Fm+JI9R7qF2GLpptmIhAaUQs6U7paY9kxoqsVlpRTCylNczNdNkKQL+bfZklyefdMgdPN/XeOtVYUS0wZ/Ert6oXXVDa4MwNUOpOFwsj01j6bzLBzQ28zeneiW59ESKTplvBjZwx33BwYo49+MLksSJjjox4IspAHdFAI85ijqDHf2gbfvarjQ9vVpkgqQ0/Ff4e+oQ3sKvgjMd3edfHusezPr8N9nhzgp7DRNTkW/yt2jZkE+XIiLh7gkUc0BJvhXBfwwSp9JI0Db84qilmkitucI6eoHX9q+ycIVlO84SzrzBbzLW69IjNmUYytPzXm+9s0pg7mQH72Q11qvgLp5QLMLnnszbFRWVWkQhOSDY9wN9mqvJ1Xv0yM980ZvdTM6LhgXr95sTcsJ2u6pZo/Gir2B2I=,iv:aLUnJ9/VjkEbNa097xFNUyeFEzTqs2Pxgye/05TmgSI=,tag:sXp48SCtbCGRyVrZZHZv9g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhWHcxNDNucmt1THVHLytL
+            ZHdoMWI2SGF6bjJvQ0lKT0g2UklLS2xnRzNVCk1FcGxaa3hIbHpnTGtRRE9BT3do
+            a3ZlL0pLaXRibkc5bW1pL0xzMzlxUmsKLS0tIFUvV0F3QVozajZXb05MYXZjWVpT
+            OHJ3a1ZOLzEzS1N2Tis1L3pQVnhZYUkKRSEWDMZdaHsZeblED32ZUgtKlB1E5cTJ
+            c4k/tXW+KiwG2h2SVgTrsl/hIZiT98K0gKq0N/OCdA8CKiREA5Fa1Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age17fyzv5mezck364lvyepp9pa3tnjn7jvsgcpykhhz2smnxyq6fdusvl7waf
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4M3dXQys2VVFXcExVNHhj
+            eWJvU01BUExpSzZPVFBXbWk1UFRzSVJ3OFh3ClJ5ZEdVcWVEeG4yRFhLQndGcFBk
+            dWMxWlNjeEszMXFTZUx3RVcwNnR0L28KLS0tIDA4bVcvdjVBcnNQeHp0Q1RhTlZQ
+            R2t4Y1YycmpPT2JZdUxsUUdUMUdDT2cKyFvSZWn+0e058lRqTTN7DCRrp2gn77BX
+            4cT52WV+t4Ik621Eg/o7ZfdUUJimjS3dbuMg9A1ieGO2FcgxoNPkzg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-20T03:00:02Z"
+    mac: ENC[AES256_GCM,data:K0U7maV2lt8cUxkX/kNgily376Y2YbNnHoG92jWVCzjsw/wyE8jwMRW6cFVQqAWgnX5maScT+AJITRvvuM2CQTTItcCYe3FrTHw0WxJui3uzn85TViACo8YTj5DGYW890CBfBTSm9IgQPMtCIjQx/AazFtnhl7kOe7W68xpbAtQ=,iv:niMD6YjXxvY2OxQlXn5aoH8hf+5IhPogS5/F1JQFglk=,tag:z4X8npY1dAiit3Op0Iv3AQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

values/xray-2/values.namespaces.yaml

@@ -0,0 +1,3 @@
+namespaces:
+  - name: public-xray
+  - name: promtail

values/xray-2/values.promtail.yaml

@@ -0,0 +1,7 @@
+config:
+  snippets:
+    pipelineStages:
+      - match:
+          pipeline_name: "drop-all"
+          selector: '{namespace!~"public-xray"}'
+          action: drop

values/xray-2/values.roles.yaml

@@ -0,0 +1 @@
+roles: []

values/xray-2/values.server-xray-public.yaml

@@ -0,0 +1,26 @@
+ext-self-signed-cert:
+  enabled: true
+  name: xray.badhouseplants.net
+  domain: xray.badhouseplants.net
+ingress:
+  main:
+    enabled: false
+service:
+  xray-https:
+    enabled: true
+    type: NodePort
+    ports:
+      https:
+        port: 443
+        targetPort: 443
+        nodePort: 30015
+        protocol: TCP
+  xray-http:
+    enabled: true
+    type: NodePort
+    ports:
+      http:
+        port: 80
+        targetPort: 80
+        protocol: TCP
+        nodePort: 30014